### Basic

Les contrôles de base incluent des vérifications sur l'objet ARM initial pour des réglages simples "activer/désactiver" (booléens) dudit service.

**Exemple : adminUser d'Azure Container Registry**

[acr_adminUser](https://github.com/jsa2/east/blob/public/providers/microsoft.containerregistry/functions/acr_adminUser.js)

Portal|EAST
-|-
  ![image](https://assets.kitploit.com/production/public/readmes/5701/955386627eceb05ef02ac4f9aed2c6671397ff9f86946fab1422f65c40510e5d.png) | ``if (item.properties?.adminUserEnabled == false ){returnObject.isHealthy = true }``



### Avancé

Les contrôles avancés incluent des vérifications au-delà de l'objet ARM initial. Ils invoquent souvent de nouvelles requêtes pour obtenir plus d'informations sur la ressource concernée et sa relation avec d'autres services.


**Exemple : Attributions de rôles**

En plus de vérifier les attributions de rôles de l'abonnement, une vérification supplémentaire est effectuée via le rapport d'accès conditionnel Azure AD pour l'authentification multifacteur (MFA), et afin de s'assurer que les comptes privilégiés ne sont pas uniquement protégés par des mots de passe (SPN avec secrets clients).

**Exemple : Azure Data Factory**

[ADF_pipeLineRuns](https://github.com/jsa2/east/blob/public/providers/microsoft.datafactory/functions/ADF_pipeLineRuns.js)

Le mappage de pipelines d'Azure Data Factory combine les pipelines -> les activités -> et les cibles de données, puis vérifie les fuites de secrets dans les journaux via l'historique d'exécution desdites activités.

![img](https://assets.kitploit.com/production/public/readmes/5701/bceb35d6b891df36e341228206a02952c46b7a271be23b40d9a72ff76a0c357f.png)

---

### Composite

Les contrôles composites combinent deux ou plusieurs résultats de contrôle du pipeline pour former un ou plusieurs nouveaux contrôles. L'utilisation de composites résout deux cas d'utilisation pour EAST :
1. Vous ne pouvez pas garantir un ordre des résultats de contrôle retournés dans le pipeline
2. Vous devez retourner plus d'un résultat de contrôle à partir d'une seule vérification

**Exemple : [composite_resolve_alerts](https://github.com/jsa2/east/blob/public/composites/composite_resolve_alerts.js)**

1. Obtenir les alertes de Microsoft Cloud Defender lors de la vérification de l'abonnement
2. Former de nouveaux contrôles par ressourceProvider pour les alertes

## Rapport

EAST n'est pas conçu pour fournir une génération automatisée de rapports, car il fournit principalement des fichiers JSON avec l'état des contrôles et de l'évaluation. L'idée est d'utiliser des outils séparés pour créer des rapports, ce qui est assez simple à automatiser via des scripts de création de markdown et des outils tels que [Pandoc](https://github.com/jgm/pandoc#the-universal-markup-converter).

- Bien que l'accent ne soit pas mis sur la génération de rapports, ce dépôt inclut un exemple d'automatisation pour la création de rapports avec pandoc afin de faciliter la lecture des résultats dans un format de document unique.

Bien que cet outil ne distribue pas pandoc, il peut être utilisé lors de la création des rapports, donc la citation suivante est ajoutée : https://github.com/jgm/pandoc/blob/master/CITATION.cff```
cff-version: 1.2.0
title: Pandoc
message: "If you use this software, please cite it as below."
type: software
url: "https://github.com/jgm/pandoc"
authors:
  - given-names: John
    family-names: MacFarlane
    email: [email protected]
    orcid: 'https://orcid.org/0000-0003-2557-9090'
  - given-names: Albert
    family-names: Krewinkel
    email: [email protected]
    orcid: '0000-0002-9455-0796'
  - given-names: Jesse
    family-names: Rosenthal
    email: [email protected]

[passer à l'étape suivante](#login-az-cli-and-run-the-scan)

#### Prérequis détaillés (Ceci est si vous avez opté de ne pas faire la version 'fire and forget')

**Prérequis**```bash

git clone https://github.com/jsa2/EAST --branch preview
cd EAST;
npm install

**Installation de pandoc sur les distributions prenant en charge APT**```bash
# Get pandoc for reporting (first time only)
sudo apt install pandoc

![img](https://assets.kitploit.com/production/public/readmes/5701/e85a6607ac555d9bbde7a179042df2a344b0a9f004e99f27ade78e0bc20af5b5.gif)





**Générer un rapport**

``cd EAST; node templatehelpers/eastReports.js --doc`` 

- Si vous souhaitez inclure tous les résultats du benchmark de sécurité Azure dans le rapport

``cd EAST; node templatehelpers/eastReports.js --doc --asb`` 

**Exporter le rapport depuis le cloud shell**

`` pandoc -s fullReport2.md -f markdown -t docx --reference-doc=pandoc-template.docx -o fullReport2.docx `` 

![image](https://assets.kitploit.com/production/public/readmes/5701/503e773de2e18294b3d74101d8c2eb6f675e1057c838e89703b440650450c374.png)

**Azure DevOps (Expérimental)**
Il existe un contrôle Azure DevOps pour vider les journaux de pipeline. Vous pouvez spécifier l'exécution du contrôle en suivant l'exemple :``` node ./plugins/main.js --batch=10 --nativescope=true --roleAssignments=true --helperTexts=true --checkAad=true --scanAuditLogs --composites --subInclude=$subId --azdevops "organizationName" ```

--- 
## Licensing

**Community use**
- Share relevant controls across multiple environments as community effort

**Company use**
- Companies have possibility to develop company specific controls which apply to company specific work. Companies can then control these implementations by decision to share, or not share them based on the operating principle of that company. 

**Non IPR components**
- Code logic and functions are under MIT license. since code logic and functions are alredy based on open-source components & vendor API's, it does not make sense to restrict something that is already based on open source

If you use this tool as part of your commercial effort we only require, that you follow the very relaxed terms of [MIT license](https://github.com/jsa2/east/blob/public/LICENSE)

[Read license](https://github.com/jsa2/EAST/blob/public/LICENSE)

---

# Tool operation documentation

## Principles


### AZCLI USE
**Existing tooling enhanced with Node.js runtime**

Use rich and maintained context of [Microsoft Azure CLI](https://github.com/Azure/azure-cli#microsoft-azure-cli) ``login & commands``  with Node.js control flow which supplies enhanced rest-requests and maps results to schema.
 - This tool does not include or distribute Microsoft Azure CLI, but rather uses it when it has been installed on the source system (Such as Azure Cloud Shell, which is primary platform for running EAST)

### Speedup

View more [details](https://github.com/jsa2/east/blob/public/speedup.md)

✅ Using Node.js runtime as orchestrator utilises Nodes asynchronous nature allowing batching of requests. Batching of requests utilizes the full extent of Azure Resource Managers incredible speed. 

✅ Compared to running requests one-by-one, the speedup can be up to 10x, when Node executes the batch of requests instead of single request at time

## Parameters reference


**Example:**
```shell
node ./plugins/main.js --batch=10 --nativescope --roleAssignments --helperTexts=true --checkAad --scanAuditLogs --composites --shuffle --clearTokens``` 

Param| Description | Default if undefined
-|-|-
`` --nativescope `` | Currently mandatory parameter | no values
`` --shuffle `` | Can help with throttling. Shuffles the resource list to reduce the possibility of resource provider throttling threshold being met  | no values 
`` --roleAssignments `` | Checks controls as per [microsoft.authorization](https://github.com/jsa2/east/blob/public/providers/microsoft.authorization/controls) | no values
`` --includeRG `` | Checks controls with ResourceGroups as per [microsoft.authorization](https://github.com/jsa2/east/blob/public/providers/microsoft.authorization/controls) | no values
`` --checkAad `` | Checks controls as per [microsoft.azureactivedirectory](https://github.com/jsa2/east/blob/public/providers/microsoft.azureactivedirectory/controls) | no values
`` --subInclude `` | Defines subscription scope | no default, requires subscriptionID/s, if not defined will enumerate all subscriptions the user have access to
`` --namespace `` | text filter which matches full, or part of the resource ID <br> **example** `` /microsoft.storage/storageaccounts`` all storage accounts in the scope| optional parameter
`` --notIncludes `` | text filter which matches full, or part of the resource ID <br> **example** `` /microsoft.storage/storageaccounts`` all storage accounts in the scope are **excluded**| optional parameter
`` --batch `` | size of batch interval between throttles |5
`` --wait `` | size of batch interval between throttles | 1500
`` --scanAuditLogs `` | optional parameter. When defined in hours will toggle Azure Activity Log scanning for weak authentication events <br> **defined in:** [scanAuditLogs](https://github.com/jsa2/east/blob/public/providers/microsoft.authorization/functions/scanAuditLogs.js) | 24h
`` --composites `` | read [composite](#composite)| no values
`` --clearTokens `` | clears tokens in session folder, use this if you get authorization errors, or have just changed to other `` az login `` account <br> use `` az account clear`` if you want to clear AZ CLI cache too | no values
`` --tag `` | Filter all results in the end based on single tag``--tag=svc=aksdev``  | no values
``--ignorePreCheck``  | use this option when used with browser delegated tokens| no values
``--helperTexts``  | Will append text descriptions from [general](https://github.com/jsa2/east/blob/public/providers/microsoft.general/controls) to manual controls| no values
``--reprocess``  | Will update results to existing content.json. Useful for incremental runs| no values


**Parameters reference for example report:**
```shell
node templatehelpers/eastReports.js --asb``` 

Param| Description | Default if undefined
-|-|-
`` --asb `` | gets all ASB results available to users | no values
`` --policy `` | gets all Policy results available to users | no values
``  --doc`` | prints pandoc string for export to console | no values

## (Highly experimental) Running in restricted environments where only browser use is available

Read here [Running in restricted environments](https://github.com/jsa2/EAST/tree/DelegationToken#highly-experimental---bypassing-trusted-device-requirements-for-azure-cli-in-highly-restricted-environments-where-apis-are-available-for-browser-sessions)

## Developing controls 
Developer guide including control flow description is here [``dev-guide.md``](https://github.com/jsa2/east/blob/public/dev-guide.md)

        
## Updates and examples
### Auditing Microsoft.Web provider (Functions and web apps)

✅ Check roles that are assigned to function managed identity in Azure AD and all Azure Subscriptions the audit account has access to <br>
✅ Relation mapping, check which keyVaults the function uses across all subs the audit account has access to<br>
✅ Check if Azure AD authentication is enabled
✅ Check that generation of access tokens to the api requires assigment ``.appRoleAssignmentRequired`` <br>
✅ Audit bindings <br>
  - Function or Azure AD Authentication enabled
  - Count and type of triggers
<br>

✅ Check if [SCM](https://docs.microsoft.com/en-us/azure/azure-functions/security-concepts#secure-the-scm-endpoint) and [FTP](https://docs.microsoft.com/en-us/azure/azure-functions/security-concepts#disable-ftp) endpoints are secured 


![image](https://assets.kitploit.com/production/public/readmes/5701/b074ecdbe5d910c416ad2bbc5b5c57295c3f61348d5a8bb35146112959a15be8.png)


### Azure RBAC baseline authorization 

⚠️ Detect principals in privileged subscriptions roles protected only by password-based single factor authentication. 
-  Checks for users without MFA policies applied for set of conditions
-  Checks for ServicePrincipals protected only by password (as opposed to using Certificate Credential, workload federation and or workload identity CA policy)
  
  Maps to [App Registration Best Practices](https://docs.microsoft.com/en-us/azure/active-directory/develop/security-best-practices-for-app-registration#credential-configuration)
- *An unused credential on an application can result in security breach. While it's convenient to use  <span style="color:red">password</span>. secrets as a credential, we strongly recommend that you use x509 certificates as the only credential type for getting tokens for your application*

``✅State healthy`` - **User result example**  
```JSON
{ 
  "subscriptionName": "EAST -msdn",
  "friendlyName": "[email protected]",
    "mfaResults": {
      "oid": "138ac68f-d8a7-4000-8d41-c10ff26a9097",
      "appliedPol": [{
        "GrantConditions": "challengeWithMfa",
        "policy": "baseline",
        "oid": "138ac68f-d8a7-4000-8d41-c10ff26a9097"
      }],
      "checkType": "mfa"
    },
    "basicAuthResults": {
      "oid": "138ac68f-d8a7-4000-8d41-c10aa26a9097",
      "appliedPol": [{
        "GrantConditions": "challengeWithMfa",
        "policy": "baseline",
        "oid": "138ac68f-d8a7-4000-8d41-c10aa26a9097"
      }],
      "checkType": "basicAuth"
      },
    }

{ 
  "subscriptionName": "EAST - HoneyPot",
      "friendlyName": "thx138-kvref-6193053b-408b-44d0-b20f-4e29b9b67394",
      "creds": {
        "@odata.context": "https://graph.microsoft.com/beta/$metadata#servicePrincipals(id,displayName,appId,keyCredentials,passwordCredentials,servicePrincipalType)/$entity",
        "id": "babec804-037d-4caf-946e-7a2b6de3a45f",
        "displayName": "thx138-kvref-6193053b-408b-44d0-b20f-4e29b9b67394",
        "appId": "5af1760e-89ff-46e4-a968-0ac36a7b7b69",
        "servicePrincipalType": "Application",
        "keyCredentials": [],
        "passwordCredentials": [],
        "OnlySingleFactor": [{
          "customKeyIdentifier": null,
          "endDateTime": "2023-10-20T06:54:59.2014093Z",
          "keyId": "7df44f81-a52c-4fd6-b704-4b046771f85a",
          "startDateTime": "2021-10-20T06:54:59.2014093Z",
          "secretText": null,
          "hint": null,
          "displayName": null
        }],
        "StrongSingleFactor": []
        }
}