🧠 Azure Network Security Group allows unrestricted WinRM traffic - prod.logic.yaml🟢

Contextual name: 🧠 prod.logic.yaml🟢
ID: /ce/ca/azure/virtual-network/security-group-allows-unrestricted-winrm-traffic/prod.logic.yaml
Tags:
- 🟢 Logic test success
- 🟢 Logic with extracts
- 🟢 Logic with test data

Uses

📗 Azure Network Security Group
🔌 Azure Network Security Group Rule - object.extracts.yaml
🧪 test-data.json

Test Results 🟢

Generated at: 2026-11-14T12:03:59.283137906Z Open

Result	Id	Condition Index	Condition Text	Runtime Error
🟢	winrm-port-5985	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	winrm-port-5986	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	winrm-wildcard	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	winrm-range	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	winrm-private	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	winrm-ipv6	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	winrm-prefix-list	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	winrm-deny	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	winrm-outbound	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	winrm-unrelated	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	winrm-missing-protocol	✔️ `299`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(UNDETERMINED)`	✔️ `null`
🟢	winrm-missing-source	✔️ `299`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(UNDETERMINED)`	✔️ `null`
🟢	winrm-empty	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	winrm-mixed	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	winrm-unknown-access	✔️ `299`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(UNDETERMINED)`	✔️ `null`
🟢	winrm-unknown-direction	✔️ `299`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(UNDETERMINED)`	✔️ `null`
🟢	winrm-protocol-udp	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	winrm-protocol-unknown	✔️ `299`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(UNDETERMINED)`	✔️ `null`
🟢	winrm-protocol-icmp	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	winrm-protocol-esp	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	winrm-protocol-ah	✔️ `300`	✔️ `otherwise`	✔️ `null`
🟢	winrm-protocol-violation-unknown	✔️ `199`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(INCOMPLIANT)`	✔️ `null`
🟢	winrm-protocol-excluded-unknown	✔️ `299`	✔️ `CA10__Azure_Network_Security_Group_Rules__r.has(UNDETERMINED)`	✔️ `null`

Generation Bundle

	File	MD5
Open	`/ce/ca/azure/virtual-network/security-group-allows-unrestricted-winrm-traffic/policy.yaml`	`8BD692B4074CFAB04D94EEFF3549BD91`
Open	`/ce/ca/azure/virtual-network/security-group-allows-unrestricted-winrm-traffic/prod.logic.yaml`	`080A755D76730ADF6E138820408BB972`
Open	`/ce/ca/azure/virtual-network/security-group-allows-unrestricted-winrm-traffic/test-data.json`	`21128FA76A712AA2CB2B9ACC0EDF96EB`
Open	`/types/CA10__CaAzureNetworkSecurityGroupRule__c/object.extracts.yaml`	`A60C817EFBC8F066D6D082898E8597BC`

Available Commands

repo-manager policies generate FULL /ce/ca/azure/virtual-network/security-group-allows-unrestricted-winrm-traffic/prod.logic.yaml
repo-manager policies generate DEBUG /ce/ca/azure/virtual-network/security-group-allows-unrestricted-winrm-traffic/prod.logic.yaml
repo-manager policies generate CAPTURE_TEST_DATA /ce/ca/azure/virtual-network/security-group-allows-unrestricted-winrm-traffic/prod.logic.yaml
repo-manager policies generate TESTS /ce/ca/azure/virtual-network/security-group-allows-unrestricted-winrm-traffic/prod.logic.yaml
# Execute tests
repo-manager policies test /ce/ca/azure/virtual-network/security-group-allows-unrestricted-winrm-traffic/prod.logic.yaml

Content

Open File

---
inputType: CA10__CaAzureNetworkSecurityGroup__c
testData:
- file: test-data.json
conditions:
- status: INCOMPLIANT
  currentStateMessage: The network security group exposes winrm ports to the internet.
  remediationMessage: Remove or restrict public winrm ingress rules.
  check:
    RELATED_LIST_HAS:
      relationshipName: CA10__Azure_Network_Security_Group_Rules__r
      status: INCOMPLIANT
- status: UNDETERMINED
  currentStateMessage: Some network security group rules cannot be assessed.
  check:
    RELATED_LIST_HAS:
      relationshipName: CA10__Azure_Network_Security_Group_Rules__r
      status: UNDETERMINED
otherwise:
  status: COMPLIANT
  currentStateMessage: No current assessed rule exposes winrm ports to the internet.
relatedLists:
- relationshipName: CA10__Azure_Network_Security_Group_Rules__r
  importExtracts:
  - file: /types/CA10__CaAzureNetworkSecurityGroupRule__c/object.extracts.yaml
  conditions:
  - status: INAPPLICABLE
    currentStateMessage: This rule denies traffic.
    check:
      IS_EQUAL:
        left:
          EXTRACT: CA10__access__c
        right:
          TEXT: Deny
  - status: INAPPLICABLE
    currentStateMessage: This is an outbound rule.
    check:
      IS_EQUAL:
        left:
          EXTRACT: CA10__direction__c
        right:
          TEXT: Outbound
  - status: UNDETERMINED
    currentStateMessage: The rule access value is unexpected.
    check:
      NOT:
        arg:
          IS_EQUAL:
            left:
              EXTRACT: CA10__access__c
            right:
              TEXT: Allow
  - status: UNDETERMINED
    currentStateMessage: The rule direction is unexpected.
    check:
      NOT:
        arg:
          IS_EQUAL:
            left:
              EXTRACT: CA10__direction__c
            right:
              TEXT: Inbound
  - status: INAPPLICABLE
    currentStateMessage: The recognized protocol does not carry the assessed traffic.
    check:
      CONTAINS:
        arg:
          SET:
            itemType: TEXT
            items:
            - Udp
            - Icmp
            - Esp
            - Ah
        search:
          EXTRACT: CA10__protocol__c
  - status: UNDETERMINED
    currentStateMessage: The rule protocol is unsupported.
    check:
      NOT:
        arg:
          CONTAINS:
            arg:
              SET:
                itemType: TEXT
                items:
                - Tcp
                - '*'
            search:
              EXTRACT: CA10__protocol__c
  - status: UNDETERMINED
    currentStateMessage: The rule has no collected source range.
    check:
      AND:
        args:
        - IS_EMPTY:
            arg:
              EXTRACT: CA10__sourceAddressPrefix__c
        - IS_EMPTY:
            arg:
              EXTRACT: CA10__sourceAddressPrefixes__c
  - status: INAPPLICABLE
    currentStateMessage: The rule does not permit traffic from all internet addresses.
    check:
      NOT:
        arg:
          OR:
            args:
            - CONTAINS:
                arg:
                  SET:
                    itemType: TEXT
                    items:
                    - '*'
                    - Internet
                    - Any
                    - 0.0.0.0/0
                    - ::/0
                    - 0.0.0.0
                search:
                  EXTRACT: CA10__sourceAddressPrefix__c
            - CONTAINS:
                arg:
                  EXTRACT: CA10__sourceAddressPrefixes__c
                search:
                  TEXT: /0
  - status: INCOMPLIANT
    currentStateMessage: The rule exposes winrm ports to the internet.
    remediationMessage: Restrict the source addresses or remove the exposed winrm ports.
    check:
      OR:
        args:
        - IS_EQUAL:
            left:
              EXTRACT: CA10__destinationPortRange__c
            right:
              TEXT: '*'
        - CONTAINS:
            arg:
              SET:
                itemType: TEXT
                items:
                - '5985'
                - '5986'
            search:
              EXTRACT: CA10__destinationPortRange__c
        - OR:
            args:
            - AND:
                args:
                - LESS_THAN_EQUAL:
                    left:
                      EXTRACT: CA10__destinationPortFrom__c
                    right:
                      NUMBER: 5985
                - GREATER_THAN_EQUAL:
                    left:
                      EXTRACT: CA10__destinationPortTo__c
                    right:
                      NUMBER: 5985
            - AND:
                args:
                - LESS_THAN_EQUAL:
                    left:
                      EXTRACT: CA10__destinationPortFrom__c
                    right:
                      NUMBER: 5986
                - GREATER_THAN_EQUAL:
                    left:
                      EXTRACT: CA10__destinationPortTo__c
                    right:
                      NUMBER: 5986
  - status: UNDETERMINED
    currentStateMessage: The collected destination port range cannot be assessed.
    check:
      OR:
        args:
        - IS_EMPTY:
            arg:
              EXTRACT: CA10__destinationPortFrom__c
        - IS_EMPTY:
            arg:
              EXTRACT: CA10__destinationPortTo__c
  otherwise:
    status: INAPPLICABLE
    currentStateMessage: This rule does not expose the assessed winrm ports.

Uses​

Test Results 🟢​

Generation Bundle​

Available Commands​

Content​

Uses

Test Results 🟢

Generation Bundle

Available Commands

Content