Azure Resource Manager
AzureResourceManager Queries List¶
This page contains all queries from AzureResourceManager.
| Query | Severity | Category | Description | Help |
|---|---|---|---|---|
| Key Vault Not Recoverable 7c25f361-7c66-44bf-9b69-022acd5eb4bd |
High | Backup | Key Vault should have 'enableSoftDelete' and 'enablePurgeProtection' set to true | Documentation |
| Azure Instance Using Basic Authentication 6797f581-0433-4768-ae3e-7ceb2f8b138e |
High | Best Practices | Azure Instances should use SSH Key instead of basic authentication | Documentation |
| Secret Without Expiration Date cff9c3f7-e8f0-455f-9fb4-5f72326da96e |
High | Best Practices | All Secrets must have an expiration date defined | Documentation |
| Azure Managed Disk Without Encryption 350f3955-b5be-436f-afaa-3d2be2fa6cdd |
High | Encryption | Azure Disk Encryption should be enabled | Documentation |
| Storage Account Allows Unsecure Transfer 1367dd13-2c90-4020-80b7-e4339a3dc2c4 |
High | Encryption | 'Microsoft.Storage/storageAccounts' should force the use of HTTPS | Documentation |
| Web App Not Using TLS Last Version b5c851d5-00f1-43dc-a8de-3218fd6f71be |
High | Encryption | Resources of type 'Microsoft.Web/sites' should define 'properties.siteConfig.minTlsVersion' with '1.2' | Documentation |
| Website Not Forcing HTTPS 488847ff-6031-487c-bf42-98fd6ac5c9a0 |
High | Insecure Configurations | 'Microsoft.Web/sites' should force the use of HTTPS | Documentation |
| Network Security Group With Unrestricted Access To SSH 2ade1579-4b2c-4590-bebb-f99bf597f612 |
High | Networking and Firewall | Port 22 (SSH) is exposed to the Internet | Documentation |
| Trusted Microsoft Services Not Enabled e25b56cd-a4d6-498f-ab92-e6296a082097 |
High | Networking and Firewall | Trusted Microsoft Services should be enabled for Storage Account access | Documentation |
| Network Security Group With Unrestricted Access To RDP 59cb3da7-f206-4ae6-b827-7abf0a9cab9d |
High | Networking and Firewall | Port 3389 (Remote Desktop) is exposed to the Internet | Documentation |
| Website with Client Certificate Auth Disabled 92302b47-b0cc-46cb-a28f-5610ecda140b |
High | Networking and Firewall | 'Microsoft.Web/sites' should have client certificate authentication enabled | Documentation |
| Storage Blob Service Container With Public Access a0ab985d-660b-41f7-ac81-70957ee8e627 |
High | Networking and Firewall | Storage Blob Service Container should not publicly accessible | Documentation |
| SQL Database Server Firewall Allows All IPS 6a3201a5-1630-494b-b294-3129d06b0eca |
High | Networking and Firewall | SQL Database Server Firewall endIpAddress should not be '255.255.255.255' when startIpAddress is '0.0.0.0' since this allows all IPS | Documentation |
| MySQL Server SSL Enforcement Disabled 90120147-f2e7-4fda-bb21-6fa9109afd63 |
High | Networking and Firewall | 'Microsoft.DBforMySQL/servers' should enforce SSL | Documentation |
| PostgreSQL Database Server SSL Disabled bf500309-da53-4dd3-bcf7-95f7974545a5 |
High | Networking and Firewall | Microsoft.DBforPostgreSQL/servers sslEnforcement property should be set to 'Enabled' | Documentation |
| Role Definitions Allow Custom Subscription Role Creation 8fa9ceea-881f-4ef0-b0b8-728f589699a7 |
Medium | Access Control | Role Definitions should not allow custom subscription role creation (actions set to '*' or 'Microsoft.Authorization/roleDefinitions/write') | Documentation |
| AKS Cluster RBAC Disabled 9307a2ed-35c2-413d-94de-a1a0682c2158 |
Medium | Access Control | Microsoft.ContainerService/managedClusters should have enableRBAC set to true | Documentation |
| SQL Server Database With Alerts Disabled 574e8d82-1db2-4b9c-b526-e320ede9a9ff |
Medium | Best Practices | All Alerts should be enabled in SQL Database Server SecurityAlerts Policy Properties | Documentation |
| AKS Cluster Network Policy Not Configured 25c0228e-4444-459b-a2df-93c7df40b7ed |
Medium | Insecure Configurations | Azure Kubernetes Service must have a network policy defined. | Documentation |
| PostgreSQL Database Server Log Connections Disabled e69bda39-e1e2-47ca-b9ee-b6531b23aedd |
Medium | Networking and Firewall | Microsoft.DBforPostgreSQL/servers/configurations should have 'log_connections' property set to 'on' | Documentation |
| PostgresSQL Database Server Connection Throttling Disabled a6d774b6-d9ea-4bf4-8433-217bf15d2fb8 |
Medium | Networking and Firewall | Microsoft.DBforPostgreSQL/servers/configurations should have 'connection_throttling' property set to 'on' | Documentation |
| AKS With Authorized IP Ranges Disabled 2583fab1-953b-4fae-bd02-4a136a6c21f9 |
Medium | Networking and Firewall | Azure Kubernetes Service must have an authorized IP range for API Services enabled | Documentation |
| PostgreSQL Database Server Log Checkpoints Disabled f9112910-c7bb-4864-9f5e-2059ba413bb7 |
Medium | Networking and Firewall | Microsoft.DBforPostgreSQL/servers/configurations should have 'log_checkpoint' property set to 'on' | Documentation |
| Standard Price Is Not Selected 2081c7d6-2851-4cce-bda5-cb49d462da42 |
Medium | Networking and Firewall | Azure Security Center provides more features for standard pricing mode, so it must be activated. | Documentation |
| Storage Logging For Read Write And Delete Requests Disabled 43f6e60c-9cdb-4e77-864d-a66595d26518 |
Medium | Observability | Storage Logging should be enabled for read, write and delete methods | Documentation |
| AKS Logging To Azure Monitoring Is Disabled 9b09dee1-f09b-4013-91d2-158fa4695f4b |
Medium | Observability | Azure Kubernetes Service should have logging to Azure Monitoring enabled. | Documentation |
| SQL Server Database With Unrecommended Retention Days c09cdac2-7670-458a-bf6c-efad6880973a |
Medium | Observability | SQL Server Database Auditing Settings should keep the audit logs in the storage account for at least 90 days | Documentation |
| Log Profile Incorrect Category 4d522e7b-f938-4d51-a3b1-974ada528bd3 |
Medium | Observability | Log Profile Categories should be set to 'Write', 'Delete', and/or 'Action' | Documentation |
| Unrecommended Log Profile Retention Policy 25684eac-daaa-4c2c-94b4-8d2dbb627909 |
Medium | Observability | Log Profile Retention Policy should be enabled and the recommended number of days for the retention should be higher than 365 or 0 (0 will retain the events indefinitely) | Documentation |
| Unrecommended Network Watcher Flow Log Retention Policy 564b70f8-41cd-4690-aff8-bb53add86bc9 |
Medium | Observability | Network Watcher Flow Log Retention Policy should be enabled and the recommended number of days for the retention should be higher than 90 | Documentation |
| SQL Server Database Without Auditing e055285c-bc01-48b4-8aa5-8a54acdd29df |
Medium | Observability | Every 'Microsoft.Sql/servers/databases' resource should have Auditing Enabled | Documentation |
| Hardcoded SecureString Parameter Default Value 4d2cf896-c053-4be5-9c95-8b4771112f29 |
Medium | Secret Management | Secure parameters should not have hardcoded default value | Documentation |
| Website Azure Active Directory Disabled e9c133e5-c2dd-4b7b-8fff-40f2de367b56 |
Low | Access Control | WebApp should have Azure Active Directory enabled with 'identity.type' set to 'SystemAssigned' or 'userAssignedIdentities' set to 'true' | Documentation |
| AKS Dashboard Is Enabled c62d3b92-9a11-4ffd-b7b7-6faaae83faed |
Low | Best Practices | Azure Kubernetes Service should have the Kubernetes dashboard disabled. | Documentation |
| Phone Number Not Set For Security Contacts 3e9fcc67-1f64-405f-b2f9-0a6be17598f0 |
Low | Best Practices | Microsoft.Security securityContacts should have a phone number defined | Documentation |
| Website with 'Http20Enabled' Disabled 70111098-7f85-48f0-b1b4-e4261cf5f61b |
Low | Networking and Firewall | 'Microsoft.Web/sites' should have 'Http20Enabled' enabled | Documentation |
| Storage Account Allows Default Network Access 9073f073-5d60-4b46-b569-0d6baa80ed95 |
Low | Networking and Firewall | 'Microsoft.Storage/storageAccounts' should force the use of HTTPS | Documentation |
| App Service Authentication Is Not Set 83130a07-235b-4a80-918b-a370e53f0bd9 |
Info | Access Control | Azure App Service should have App Service Authentication set | Documentation |
| SQL Alert Policy Without Emails 89b79fe5-49bd-4d39-84ce-55f5fc6f7764 |
Info | Best Practices | SQL Database Server should contain emails to be notified in the event of a Security Alert | Documentation |
| Account Admins Not Notified By Email a8852cc0-fd4b-4fc7-9372-1e43fad0732e |
Info | Best Practices | Account admins should be notified by email in the event of security alerts | Documentation |
| Email Notifications Disabled 79c2c2c0-eb00-47c0-ac16-f8b0e2c81c92 |
Info | Networking and Firewall | Email notifications about new security alerts, should be set to 'On', and be sent to persons with specific RBAC roles on the subscription | Documentation |