### Base

I controlli di base includono verifiche sull'oggetto ARM iniziale per semplici impostazioni booleane "attiva/disattiva" del servizio in questione.

**Esempio: Azure Container Registry adminUser**

[acr_adminUser](https://github.com/jsa2/east/blob/public/providers/microsoft.containerregistry/functions/acr_adminUser.js)

Portal|EAST
-|-
  ![image](https://assets.kitploit.com/production/public/readmes/5701/955386627eceb05ef02ac4f9aed2c6671397ff9f86946fab1422f65c40510e5d.png) | ``if (item.properties?.adminUserEnabled == false ){returnObject.isHealthy = true }``



### Avanzato

I controlli avanzati includono verifiche che vanno oltre l'oggetto ARM iniziale. Spesso invocano nuove richieste per ottenere ulteriori informazioni sulla risorsa in esame e la sua relazione con altri servizi.


**Esempio: Assegnazioni di Ruoli**

Oltre a verificare le assegnazioni di ruoli della sottoscrizione, viene eseguito un controllo aggiuntivo tramite Azure AD Conditional Access Reporting per MFA, e che gli account privilegiati non siano protetti solo da password (SPN con segreti client).

**Esempio: Azure Data Factory**

[ADF_pipeLineRuns](https://github.com/jsa2/east/blob/public/providers/microsoft.datafactory/functions/ADF_pipeLineRuns.js)

La mappatura delle pipeline di Azure Data Factory combina pipeline, attività e destinazioni dati insieme e poi verifica la presenza di segreti trapelati nei log tramite la cronologia delle esecuzioni delle attività suddette.

![img](https://assets.kitploit.com/production/public/readmes/5701/bceb35d6b891df36e341228206a02952c46b7a271be23b40d9a72ff76a0c357f.png)

---

### Composito

I controlli compositi combinano due o più risultati di controllo dalla pipeline per formare uno o più nuovi controlli. L'uso dei compositi risolve due casi d'uso per EAST
1. Non puoi garantire un ordine dei risultati di controllo restituiti nella pipeline
2. Devi restituire più di un risultato di controllo da un singolo controllo

**Esempio: [composite_resolve_alerts](https://github.com/jsa2/east/blob/public/composites/composite_resolve_alerts.js)**

1. Ottieni avvisi da Microsoft Cloud Defender sul controllo della sottoscrizione
2. Crea nuovi controlli per resourceProvider per gli avvisi

## Reporting

EAST non è focalizzato sulla generazione automatica di report, poiché fornisce principalmente file JSON con stato di controllo e valutazione. L'idea è di utilizzare strumenti separati per creare report, che sono abbastanza semplici da automatizzare tramite script di creazione markdown e strumenti come [Pandoc](https://github.com/jgm/pandoc#the-universal-markup-converter)

- Sebbene l'attenzione non sia sulla reportistica, questo repository include un esempio di automazione per la creazione di report con pandoc per facilitare la lettura dei risultati in un unico formato documento.


Sebbene questo strumento non distribuisca pandoc, può essere utilizzato nella creazione dei report, pertanto viene aggiunta la seguente citazione: https://github.com/jgm/pandoc/blob/master/CITATION.cff```
cff-version: 1.2.0
title: Pandoc
message: "If you use this software, please cite it as below."
type: software
url: "https://github.com/jgm/pandoc"
authors:
  - given-names: John
    family-names: MacFarlane
    email: [email protected]
    orcid: 'https://orcid.org/0000-0003-2557-9090'
  - given-names: Albert
    family-names: Krewinkel
    email: [email protected]
    orcid: '0000-0002-9455-0796'
  - given-names: Jesse
    family-names: Rosenthal
    email: [email protected]

[jump to next step](#login-az-cli-and-run-the-scan)

#### Prerequisiti dettagliati (Questo se hai scelto di non fare la versione "fire and forget")

**Prerequisiti**```bash

git clone https://github.com/jsa2/EAST --branch preview
cd EAST;
npm install

**Installazione di pandoc su distribuzioni che supportano APT**```bash
# Get pandoc for reporting (first time only)
sudo apt install pandoc

![img](https://assets.kitploit.com/production/public/readmes/5701/e85a6607ac555d9bbde7a179042df2a344b0a9f004e99f27ade78e0bc20af5b5.gif)





**Genera report**

``cd EAST; node templatehelpers/eastReports.js --doc`` 

- Se desideri includere tutti i risultati di Azure Security Benchmark nel report

``cd EAST; node templatehelpers/eastReports.js --doc --asb`` 

**Esporta report da cloud shell**

`` pandoc -s fullReport2.md -f markdown -t docx --reference-doc=pandoc-template.docx -o fullReport2.docx `` 

![image](https://assets.kitploit.com/production/public/readmes/5701/503e773de2e18294b3d74101d8c2eb6f675e1057c838e89703b440650450c374.png)

**Azure Devops (Sperimentale)**
Esiste un controllo di Azure Devops per scaricare i log delle pipeline. Puoi specificare l'esecuzione del controllo con il seguente esempio:``` node ./plugins/main.js --batch=10 --nativescope=true --roleAssignments=true --helperTexts=true --checkAad=true --scanAuditLogs --composites --subInclude=$subId --azdevops "organizationName" ```

--- 
## Licensing

**Community use**
- Share relevant controls across multiple environments as community effort

**Company use**
- Companies have possibility to develop company specific controls which apply to company specific work. Companies can then control these implementations by decision to share, or not share them based on the operating principle of that company. 

**Non IPR components**
- Code logic and functions are under MIT license. since code logic and functions are alredy based on open-source components & vendor API's, it does not make sense to restrict something that is already based on open source

If you use this tool as part of your commercial effort we only require, that you follow the very relaxed terms of [MIT license](https://github.com/jsa2/east/blob/public/LICENSE)

[Read license](https://github.com/jsa2/EAST/blob/public/LICENSE)

---

# Tool operation documentation

## Principles


### AZCLI USE
**Existing tooling enhanced with Node.js runtime**

Use rich and maintained context of [Microsoft Azure CLI](https://github.com/Azure/azure-cli#microsoft-azure-cli) ``login & commands``  with Node.js control flow which supplies enhanced rest-requests and maps results to schema.
 - This tool does not include or distribute Microsoft Azure CLI, but rather uses it when it has been installed on the source system (Such as Azure Cloud Shell, which is primary platform for running EAST)

### Speedup

View more [details](https://github.com/jsa2/east/blob/public/speedup.md)

✅ Using Node.js runtime as orchestrator utilises Nodes asynchronous nature allowing batching of requests. Batching of requests utilizes the full extent of Azure Resource Managers incredible speed. 

✅ Compared to running requests one-by-one, the speedup can be up to 10x, when Node executes the batch of requests instead of single request at time

## Parameters reference


**Example:**
```shell
node ./plugins/main.js --batch=10 --nativescope --roleAssignments --helperTexts=true --checkAad --scanAuditLogs --composites --shuffle --clearTokens``` 

Param| Description | Default if undefined
-|-|-
`` --nativescope `` | Currently mandatory parameter | no values
`` --shuffle `` | Can help with throttling. Shuffles the resource list to reduce the possibility of resource provider throttling threshold being met  | no values 
`` --roleAssignments `` | Checks controls as per [microsoft.authorization](https://github.com/jsa2/east/blob/public/providers/microsoft.authorization/controls) | no values
`` --includeRG `` | Checks controls with ResourceGroups as per [microsoft.authorization](https://github.com/jsa2/east/blob/public/providers/microsoft.authorization/controls) | no values
`` --checkAad `` | Checks controls as per [microsoft.azureactivedirectory](https://github.com/jsa2/east/blob/public/providers/microsoft.azureactivedirectory/controls) | no values
`` --subInclude `` | Defines subscription scope | no default, requires subscriptionID/s, if not defined will enumerate all subscriptions the user have access to
`` --namespace `` | text filter which matches full, or part of the resource ID <br> **example** `` /microsoft.storage/storageaccounts`` all storage accounts in the scope| optional parameter
`` --notIncludes `` | text filter which matches full, or part of the resource ID <br> **example** `` /microsoft.storage/storageaccounts`` all storage accounts in the scope are **excluded**| optional parameter
`` --batch `` | size of batch interval between throttles |5
`` --wait `` | size of batch interval between throttles | 1500
`` --scanAuditLogs `` | optional parameter. When defined in hours will toggle Azure Activity Log scanning for weak authentication events <br> **defined in:** [scanAuditLogs](https://github.com/jsa2/east/blob/public/providers/microsoft.authorization/functions/scanAuditLogs.js) | 24h
`` --composites `` | read [composite](#composite)| no values
`` --clearTokens `` | clears tokens in session folder, use this if you get authorization errors, or have just changed to other `` az login `` account <br> use `` az account clear`` if you want to clear AZ CLI cache too | no values
`` --tag `` | Filter all results in the end based on single tag``--tag=svc=aksdev``  | no values
``--ignorePreCheck``  | use this option when used with browser delegated tokens| no values
``--helperTexts``  | Will append text descriptions from [general](https://github.com/jsa2/east/blob/public/providers/microsoft.general/controls) to manual controls| no values
``--reprocess``  | Will update results to existing content.json. Useful for incremental runs| no values


**Parameters reference for example report:**
```shell
node templatehelpers/eastReports.js --asb``` 

Param| Description | Default if undefined
-|-|-
`` --asb `` | gets all ASB results available to users | no values
`` --policy `` | gets all Policy results available to users | no values
``  --doc`` | prints pandoc string for export to console | no values

## (Highly experimental) Running in restricted environments where only browser use is available

Read here [Running in restricted environments](https://github.com/jsa2/EAST/tree/DelegationToken#highly-experimental---bypassing-trusted-device-requirements-for-azure-cli-in-highly-restricted-environments-where-apis-are-available-for-browser-sessions)

## Developing controls 
Developer guide including control flow description is here [``dev-guide.md``](https://github.com/jsa2/east/blob/public/dev-guide.md)

        
## Updates and examples
### Auditing Microsoft.Web provider (Functions and web apps)

✅ Check roles that are assigned to function managed identity in Azure AD and all Azure Subscriptions the audit account has access to <br>
✅ Relation mapping, check which keyVaults the function uses across all subs the audit account has access to<br>
✅ Check if Azure AD authentication is enabled
✅ Check that generation of access tokens to the api requires assigment ``.appRoleAssignmentRequired`` <br>
✅ Audit bindings <br>
  - Function or Azure AD Authentication enabled
  - Count and type of triggers
<br>

✅ Check if [SCM](https://docs.microsoft.com/en-us/azure/azure-functions/security-concepts#secure-the-scm-endpoint) and [FTP](https://docs.microsoft.com/en-us/azure/azure-functions/security-concepts#disable-ftp) endpoints are secured 


![image](https://assets.kitploit.com/production/public/readmes/5701/b074ecdbe5d910c416ad2bbc5b5c57295c3f61348d5a8bb35146112959a15be8.png)


### Azure RBAC baseline authorization 

⚠️ Detect principals in privileged subscriptions roles protected only by password-based single factor authentication. 
-  Checks for users without MFA policies applied for set of conditions
-  Checks for ServicePrincipals protected only by password (as opposed to using Certificate Credential, workload federation and or workload identity CA policy)
  
  Maps to [App Registration Best Practices](https://docs.microsoft.com/en-us/azure/active-directory/develop/security-best-practices-for-app-registration#credential-configuration)
- *An unused credential on an application can result in security breach. While it's convenient to use  <span style="color:red">password</span>. secrets as a credential, we strongly recommend that you use x509 certificates as the only credential type for getting tokens for your application*

``✅State healthy`` - **User result example**  
```JSON
{ 
  "subscriptionName": "EAST -msdn",
  "friendlyName": "[email protected]",
    "mfaResults": {
      "oid": "138ac68f-d8a7-4000-8d41-c10ff26a9097",
      "appliedPol": [{
        "GrantConditions": "challengeWithMfa",
        "policy": "baseline",
        "oid": "138ac68f-d8a7-4000-8d41-c10ff26a9097"
      }],
      "checkType": "mfa"
    },
    "basicAuthResults": {
      "oid": "138ac68f-d8a7-4000-8d41-c10aa26a9097",
      "appliedPol": [{
        "GrantConditions": "challengeWithMfa",
        "policy": "baseline",
        "oid": "138ac68f-d8a7-4000-8d41-c10aa26a9097"
      }],
      "checkType": "basicAuth"
      },
    }

{ 
  "subscriptionName": "EAST - HoneyPot",
      "friendlyName": "thx138-kvref-6193053b-408b-44d0-b20f-4e29b9b67394",
      "creds": {
        "@odata.context": "https://graph.microsoft.com/beta/$metadata#servicePrincipals(id,displayName,appId,keyCredentials,passwordCredentials,servicePrincipalType)/$entity",
        "id": "babec804-037d-4caf-946e-7a2b6de3a45f",
        "displayName": "thx138-kvref-6193053b-408b-44d0-b20f-4e29b9b67394",
        "appId": "5af1760e-89ff-46e4-a968-0ac36a7b7b69",
        "servicePrincipalType": "Application",
        "keyCredentials": [],
        "passwordCredentials": [],
        "OnlySingleFactor": [{
          "customKeyIdentifier": null,
          "endDateTime": "2023-10-20T06:54:59.2014093Z",
          "keyId": "7df44f81-a52c-4fd6-b704-4b046771f85a",
          "startDateTime": "2021-10-20T06:54:59.2014093Z",
          "secretText": null,
          "hint": null,
          "displayName": null
        }],
        "StrongSingleFactor": []
        }
}