527 docs tagged with "policy"

- Contextual name: 📝 [LEGACY] VHDs are not encrypted 🟢

- Contextual name: 📝 Access Approval is not enabled 🟢

- Contextual name: 📝 Access Key Rotation Reminders are not enabled 🟢

- Contextual name: 📝 Access Keys are not regenerated periodically 🟢

- Contextual name: 📝 Account Has No IAM Users 🔴🟠

- Contextual name: 📝 Account has zero Total Request Units 🟢

- Contextual name: 📝 Account Lockout Duration is not set 60 seconds or more 🟢

- Contextual name: 📝 Account Lockout Threshold is not set to 10 or less 🟢

- Contextual name: 📝 Account Root User Hardware MFA is not enabled. 🟢

- Contextual name: 📝 Account Root User has active access keys 🟢

- Contextual name: 📝 Account Root User MFA is not enabled. 🟢

- Contextual name: 📝 Activity Log Alert for Create or Update Network Security Group does not exist 🟢

- Contextual name: 📝 Activity Log Alert for Create or Update Public IP Address Rule does not exist 🟢

- Contextual name: 📝 Activity Log Alert for Create or Update Security Solution does not exist 🟢

- Contextual name: 📝 Activity Log Alert for Create or Update SQL Server Firewall Rule does not exist 🟢

- Contextual name: 📝 Activity Log Alert for Create Policy Assignment does not exist 🟢

- Contextual name: 📝 Activity Log Alert for Delete Network Security Group does not exist 🟢

- Contextual name: 📝 Activity Log Alert for Delete Policy Assignment does not exist 🟢

- Contextual name: 📝 Activity Log Alert for Delete Public IP Address Rule does not exist 🟢

- Contextual name: 📝 Activity Log Alert for Delete Security Solution does not exist 🟢

- Contextual name: 📝 Activity Log Alert for Delete SQL Server Firewall Rule does not exist 🟢

- Contextual name: 📝 Activity Log Alert for Service Health does not exist 🟢

- Contextual name: 📝 Admin accounts are not used for daily operations 🟢

- Contextual name: 📝 Agentless Container Vulnerability Assessment Component is not enabled 🟢

- Contextual name: 📝 Agentless Discovery for Kubernetes Component is not enabled 🟢

- Contextual name: 📝 Agentless Scanning for Machines Component is not enabled 🟢

- Contextual name: 📝 Allow Blob Anonymous Access is enabled 🟢

- Contextual name: 📝 Allow Users To Remember MFA On Devices They Trust is enabled 🟢

- Contextual name: 📝 Alternate Contact Information is not current 🔴🟢

- Contextual name: 📝 AND 🟢

- Contextual name: 📝 API Access Logging in CloudWatch is not enabled 🟢

- Contextual name: 📝 API Execution Logging in CloudWatch is not enabled 🟢

- Contextual name: 📝 API Key is not restricted for unspecified hosts and apps 🟢

- Contextual name: 📝 API Key is not restricted for unused APIs 🟢

- Contextual name: 📝 API Key is not rotated every 90 days 🟢

- Contextual name: 📝 API Route Authorization Type is not configured 🟢

- Contextual name: 📝 App Service does not run the latest HTTP version 🟢

- Contextual name: 📝 App Service does not run the latest Java version 🟢

- Contextual name: 📝 App Service does not run the latest PHP version 🟢

- Contextual name: 📝 App Service does not run the latest Python version 🟢

- Contextual name: 📝 App Service does not use Azure Key Vaults to store secrets 🟢

- Contextual name: 📝 App Service is not registered with Microsoft Entra ID 🟢

- Contextual name: 📝 App Service Plan has no Apps assigned 🟢

- Contextual name: 📝 Application HTTPS Connection is not enforced 🟢

- Contextual name: 📝 Application Insights are not configured 🟢

- Contextual name: 📝 Asset Inventory API is not enabled 🟢

- Contextual name: 📝 Aurora Cluster access is not consistent 🟢

- Contextual name: 📝 Authentication is disabled and Basic Authentication is enabled 🟢

- Contextual name: 📝 Auto Scaling Group and Classic Load Balancer AZs are inconsistent 🟠🟢

- Contextual name: 📝 Auto Scaling Group behind ELB assigns public IP to instances 🟢

- Contextual name: 📝 Auto Scaling Group behind ELB doesn't use ELB health check 🟢

- Contextual name: 📝 Auto Scaling Group Launch Template is not configured to require IMDSv2 🟢

- Contextual name: 📝 Auto Scaling Group uses Launch Configuration instead of Launch Template 🟢

- Contextual name: 📝 Automatic Key Rotation is not enabled 🟢

- Contextual name: 📝 AWS EC2 Instance Should Have Breeze Agent Installed 🟢

- Contextual name: 📝 AWS EKS Cluster Should Have Breeze Agent Installed 🟢

- Contextual name: 📝 AWS IAM User is not managed centrally in multi-account environments 🟢

- Contextual name: 📝 AWS Organizations Changes Monitoring is not enabled 🟢

- Contextual name: 📝 AWS Support Role is not created 🟢

- Contextual name: 📝 AWSCloudShellFullAccess Policy is attached 🟢

- Contextual name: 📝 Azure Active Directory Device Should Have Breeze Agent Installed 🟢

- Contextual name: 📝 Azure AKS Cluster Should Have Breeze Agent Installed 🟢

- Contextual name: 📝 Azure Virtual Machine Should Have Breeze Agent Installed 🟢

- Contextual name: 📝 Azure VM Scale Set Instance Should Have Breeze Agent Installed 🟢

- Contextual name: 📝 Basic Authentication is enabled 🟢

- Contextual name: 📝 Bastion Host does not exist 🟢

- Contextual name: 📝 Blob Containers Soft Delete is not enabled 🟢

- Contextual name: 📝 Blob Logging is not enabled for Read, Write, and Delete requests 🟢

- Contextual name: 📝 Blob Service Versioning is not enabled 🟢

- Contextual name: 📝 BOOLEAN_FROM 🔴🟢

- Contextual name: 📝 BooleanType 🔴🟢

- Contextual name: 📝 BooleanType 🟢

- Contextual name: 📝 Bucket is anonymously or publicly accessible 🟢

- Contextual name: 📝 Bucket is not configured to block public access 🟢

- Contextual name: 📝 Bucket Lifecycle Configuration is not enabled 🟢

- Contextual name: 📝 Bucket MFA Delete is not enabled 🟠🟢

- Contextual name: 📝 Bucket Object Lock is not enabled 🟠🟢

- Contextual name: 📝 Bucket Policy is not set to deny HTTP requests 🟢

- Contextual name: 📝 Bucket sensitive data is not discovered, classified, and secured 🟢

- Contextual name: 📝 Bucket Server Access Logging is not enabled 🟢

- Contextual name: 📝 Bucket Uniform Bucket-Level Access is not enabled 🟢

- Contextual name: 📝 Bucket Versioning is not enabled 🟢

- Contextual name: 📝 Bytes Items 🟢

- Contextual name: 📝 Bytes Items 🟢

- Contextual name: 📝 Bytes Items 🟢

- Contextual name: 📝 Bytes Items 🟢

- Contextual name: 📝 BytesType 🟢

- Contextual name: 📝 BytesType 🟢

- Contextual name: 📝 Certificate Expired 🟢

- Contextual name: 📝 Certificate expires in the next 7 days 🟢

- Contextual name: 📝 Certificate with Wildcard Domain Name 🟢

- Contextual name: 📝 Cloud Access Transparency is not enabled 🟢

- Contextual name: 📝 Cloud Audit Logging is not configured properly 🟢

- Contextual name: 📝 Cloud Function Environment Variables store confidential data 🟢

- Contextual name: 📝 CloudTrail is not encrypted with KMS CMK 🟢

- Contextual name: 📝 Cluster allows unrestricted public traffic 🟢

- Contextual name: 📝 Cluster has node IAM role with AmazonEKSCNIPolicy attached 🔴🟢

- Contextual name: 📝 Cluster IAM OIDC provider is not created 🟢

- Contextual name: 📝 Cluster is not encrypted using Customer-Managed Encryption Key 🟢

- Contextual name: 📝 Cluster Logging is not enabled for all control plane logs types 🟢

- Contextual name: 📝 Cluster Server-Side Encryption is not enabled 🟢

- Contextual name: 📝 COLLECTION_SIZE 🟢

- Contextual name: 📝 CollectionType 🟢

- Contextual name: 📝 CollectionType 🟢

- Contextual name: 📝 CollectionType 🟢

- Contextual name: 📝 Conditional Access By Location is not defined 🟢

- Contextual name: 📝 Config Configuration Changes Monitoring is not enabled 🟢

- Contextual name: 📝 Config is not enabled in all regions 🟢

- Contextual name: 📝 Configuration Changes Monitoring is not enabled 🟢

- Contextual name: 📝 Consumer Google Accounts are used 🟢

- Contextual name: 📝 Critical Data is not encrypted with customer managed key 🟢

- Contextual name: 📝 Cross Tenant Replication is enabled 🟢

- Contextual name: 📝 Crypto Key is anonymously or publicly accessible 🟠🟢

- Contextual name: 📝 Crypto Key is not rotated every 90 days 🟢

- Contextual name: 📝 Custom Banned Password List is not enforced 🟢

- Contextual name: 📝 Custom Subscription Administrator Roles exist 🟢

- Contextual name: 📝 Database allows ingress from 0.0.0.0/0 (ANY IP) 🟢

- Contextual name: 📝 Database Transparent Data Encryption is not enabled 🟢

- Contextual name: 📝 Databricks Diagnostic Log Delivery is not configured 🟢

- Contextual name: 📝 Databricks network security groups are not configured 🟢

- Contextual name: 📝 Databricks Personal Access Tokens (PATs) are not restricted and expirable 🟢

- Contextual name: 📝 Databricks Unity Catalog is not configured 🟢

- Contextual name: 📝 Databricks users and groups are not synced from Microsoft Entra ID 🟢

- Contextual name: 📝 Dataset is anonymously or publicly accessible 🟢

- Contextual name: 📝 Dataset is not encrypted with Customer-Managed Encryption Key (CMEK) 🟢

- Contextual name: 📝 DATETIMEFROM 🟢

- Contextual name: 📝 DateTimeType 🟢

- Contextual name: 📝 DateTimeType 🟢

- Contextual name: 📝 Default Network Access Rule is not set to Deny 🟢

- Contextual name: 📝 Default Role is ACCOUNTADMIN 🟢

- Contextual name: 📝 Default Role is not set 🟢

- Contextual name: 📝 Default Security Group does not restrict all traffic 🟢

- Contextual name: 📝 Default To OAuth Authentication is not set to Yes 🟢

- Contextual name: 📝 Default User Role can create tenants 🟢

- Contextual name: 📝 Device Code Authentication Flow is not restricted 🟢

- Contextual name: 📝 Diagnostic Setting captures Administrative, Alert, Policy, and Security categories 🟢

- Contextual name: 📝 Diagnostic Setting does not capture Microsoft Entra activity logs 🟢

- Contextual name: 📝 Diagnostic Setting does not capture Microsoft Graph activity logs 🟢

- Contextual name: 📝 Diagnostic Setting exists for Subscription Activity Logs 🟢

- Contextual name: 📝 Diagnostic Setting for Azure AppService HTTP logs is not enabled 🟢

- Contextual name: 📝 Diagnostic Setting for Azure Key Vault is not enabled 🟢

- Contextual name: 📝 Diagnostic Setting is not enabled for all services that support it 🟢

- Contextual name: 📝 Diagnostic Setting Logs export to Storage Account not encrypted with Customer-managed key 🟢

- Contextual name: 📝 Disable or Schedule Deletion CMK Events Monitoring is not enabled 🟢

- Contextual name: 📝 Disk for critical VMs is not encrypted with Customer-Supplied Encryption Key (CSEK) 🟢

- Contextual name: 📝 Distribution Logging is not enabled 🟢

- Contextual name: 📝 DURATION_FROM 🟢

- Contextual name: 📝 EBS Attached Volume is not encrypted 🟢

- Contextual name: 📝 EBS Snapshot is publicly accessible 🟢

- Contextual name: 📝 EBS Volume Encryption Attribute is not enabled in all regions 🟢

- Contextual name: 📝 Endpoint doesn't use SSL 🟢

- Contextual name: 📝 Endpoint Protection is not installed 🟢

- Contextual name: 📝 ENDS_WITH 🟢

- Contextual name: 📝 Entra ID Client Authentication is not used 🟢

- Contextual name: 📝 External Attack Surface Monitoring (EASM) is not enabled 🟢

- Contextual name: 📝 File Integrity Monitoring Component is not enabled 🟢

- Contextual name: 📝 File Shares SMB Channel Encryption is not set to AES-256-GCM or higher 🟢

- Contextual name: 📝 File Shares SMB Protocol Version is not set to SMB 3.1.1 or higher 🟢

- Contextual name: 📝 File Shares Soft Delete is not enabled 🟢

- Contextual name: 📝 File System encryption is not enabled 🟢

- Contextual name: 📝 Flexible Server auditlogenabled Parameter is not set to ON 🟢

- Contextual name: 📝 Flexible Server auditlogevents Parameter is not set with the CONNECTION event 🟢

- Contextual name: 📝 Flexible Server connection_throttle.enable Parameter is not set to ON 🟢

- Contextual name: 📝 Flexible Server Firewall Rules allow access to Azure services 🟢

- Contextual name: 📝 Flexible Server log_checkpoints Parameter is not set to ON 🟢

- Contextual name: 📝 Flexible Server logretentiondays Parameter is less than 4 days 🟢

- Contextual name: 📝 Flexible Server requiresecuretransport Parameter is not set to ON 🟢

- Contextual name: 📝 Flexible Server requiresecuretransport Parameter is not set to ON 🟢

- Contextual name: 📝 Flexible Server TLS Version is not set to TLS 1.2 🟢

- Contextual name: 📝 Flow Logs are not enabled 🟢

- Contextual name: 📝 FTP deployments are not disabled 🟢

- Contextual name: 📝 GCE Network DNS Policy Logging is not enabled 🟢

- Contextual name: 📝 GCE Network has Firewall Rules which allow unrestricted RDP access from the Internet 🟢

- Contextual name: 📝 GCE Network has Firewall Rules which allow unrestricted SSH access from the Internet 🟢

- Contextual name: 📝 GCE Subnetwork Flow Logs are not enabled 🟢

- Contextual name: 📝 Global Administrator Role assigned to more than 4 users 🟢

- Contextual name: 📝 Google Accounts are not configured with MFA 🟢

- Contextual name: 📝 Google GCE Instance Should Have Breeze Agent Installed 🟢

- Contextual name: 📝 Google Project has API Keys 🟢

- Contextual name: 📝 GREATER_THAN 🟢

- Contextual name: 📝 GREATERTHANEQUAL 🟢

- Contextual name: 📝 Guest Invite Settings is not set to Only Users Assigned To Specific Admin Roles Can Invite Guest Users 🟢

- Contextual name: 📝 Guest Users are not reviewed on a regular basis 🟢

- Contextual name: 📝 Guest Users restricted to their own directory objects 🟢

- Contextual name: 📝 HTTP(S) Load Balancer Logging is not enabled 🟢

- Contextual name: 📝 HTTPS Only configuration is not enabled 🟢

- Contextual name: 📝 HTTPS or SSL Proxy Load Balancer permits SSL policies with weak cipher suites 🟢

- Contextual name: 📝 IAM Access Analyzer is not enabled for all regions 🟢

- Contextual name: 📝 IAM Password Policy minimum password length is 14 characters or less 🟢

- Contextual name: 📝 IAM Password Policy Number of passwords to remember is not set to 24 🟢

- Contextual name: 📝 IAM Policy Changes Monitoring is not enabled 🟢

- Contextual name: 📝 IAM Role Unused 🟢

- Contextual name: 📝 IAM Users are assigned the Service Account User or Service Account Token Creator roles at Project level 🟢

- Contextual name: 📝 Identity Aware Proxy (IAP) is not used to enforce access controls 🟢

- Contextual name: 📝 Instance allows public access to all ports 🟢

- Contextual name: 📝 Instance allows public access to CIFS port 🟢

- Contextual name: 📝 Instance allows public access to DNS port 🟢

- Contextual name: 📝 Instance allows public access to FTP ports 🟢

- Contextual name: 📝 Instance allows public access to HTTP(S) ports 🟢

- Contextual name: 📝 Instance allows public access to MongoDB ports 🟢

- Contextual name: 📝 Instance allows public access to MSSQL port 🟢

- Contextual name: 📝 Instance allows public access to MySQL port 🟢

- Contextual name: 📝 Instance allows public access to NetBIOS ports 🟢

- Contextual name: 📝 Instance allows public access to Oracle DBMS ports 🟢

- Contextual name: 📝 Instance allows public access to PostgreSQL port 🟢

- Contextual name: 📝 Instance allows public access to RDP port 🟢

- Contextual name: 📝 Instance allows public access to RPC port 🟢

- Contextual name: 📝 Instance allows public access to SMTP port 🟢

- Contextual name: 📝 Instance allows public access to SSH port 🟢

- Contextual name: 📝 Instance allows public access to Telnet port 🟢

- Contextual name: 📝 Instance allows public UDP access 🟢

- Contextual name: 📝 Instance Auto Minor Version Upgrade is not enabled 🟠🟢

- Contextual name: 📝 Instance Block Project-Wide SSH Keys is not enabled 🟢

- Contextual name: 📝 Instance Confidential Compute is not enabled 🟢

- Contextual name: 📝 Instance Detailed Monitoring is not enabled 🟢

- Contextual name: 📝 Instance doesn't have the latest operating system updates installed 🟢

- Contextual name: 📝 Instance Enable Connecting to Serial Ports is not disabled 🟢

- Contextual name: 📝 Instance Encryption is not enabled 🟢

- Contextual name: 📝 Instance flow logs are not enabled 🟢

- Contextual name: 📝 Instance has a public IP address 🟢

- Contextual name: 📝 Instance IAM role is not attached 🟢

- Contextual name: 📝 Instance IMDSv2 is not enabled 🟢

- Contextual name: 📝 Instance IP Forwarding is not disabled. 🟢

- Contextual name: 📝 Instance is configured to use the Default Service Account 🟢

- Contextual name: 📝 Instance is configured to use the Default Service Account with full access to all Cloud APIs 🟢

- Contextual name: 📝 Instance is idle 🟢

- Contextual name: 📝 Instance is launched without Shielded VM enabled 🟢

- Contextual name: 📝 Instance is overutilized 🟢

- Contextual name: 📝 Instance is publicly accessible and in an unrestricted public subnet 🟢

- Contextual name: 📝 Instance is underutilized 🟢

- Contextual name: 📝 Instance Multi-AZ Deployment is not enabled 🟢

- Contextual name: 📝 Instance OS Login is not enabled 🟢

- Contextual name: 📝 Instance uses default endpoint port 🟢

- Contextual name: 📝 Instance uses paravirtual Virtualization Type 🟢

- Contextual name: 📝 Instance with an auto-assigned public IP address is in a default subnet 🟢

- Contextual name: 📝 Instance without a public IP address is in a public subnet 🟢

- Contextual name: 📝 Integration With Microsoft Defender For Cloud Apps is not enabled 🟢

- Contextual name: 📝 Integration With Microsoft Defender For Endpoint is not enabled 🟢

- Contextual name: 📝 Intune logs are not captured and sent to Log Analytics 🟢

- Contextual name: 📝 ISAFTERTODAY 🟢

- Contextual name: 📝 ISBEFORETODAY 🟢

- Contextual name: 📝 ISBEYONDLAST_DAYS 🟢

- Contextual name: 📝 ISBEYONDNEXT_DAYS 🟢

- Contextual name: 📝 ISWITHINLAST_DAYS 🟢

- Contextual name: 📝 ISWITHINNEXT_DAYS 🟢

- Contextual name: 📝 JsonType 🟢

- Contextual name: 📝 JsonType 🟢

- Contextual name: 📝 Key Vault Managed HSM is used 🟢

- Contextual name: 📝 LESS_THAN 🟢

- Contextual name: 📝 LESSTHANEQUAL 🟢

- Contextual name: 📝 Log Analytics Agent is not auto provisioned 🟢

- Contextual name: 📝 Log File Validation is not enabled 🟢

- Contextual name: 📝 Log Metric Filter and Alerts Cloud Storage IAM Permission Changes do not exist 🟢

- Contextual name: 📝 Log Metric Filter and Alerts for Audit Configuration Changes do not exist 🟢

- Contextual name: 📝 Log Metric Filter and Alerts for Custom Role Changes do not exist 🟢

- Contextual name: 📝 Log Metric Filter and Alerts for Project Ownership Assignments Changes do not exist 🟢

- Contextual name: 📝 Log Metric Filter and Alerts for SQL Instance Configuration Changes do not exist 🟢

- Contextual name: 📝 Log Metric Filter and Alerts for VPC Network Changes do not exist 🟢

- Contextual name: 📝 Log Metric Filter and Alerts for VPC Network Firewall Rule Changes do not exist 🟢

- Contextual name: 📝 Log Metric Filter and Alerts for VPC Network Route Changes do not exist 🟢

- Contextual name: 📝 Log Sink for All Log Entries is not configured 🟢

- Contextual name: 📝 Managed Disk Data Access Auth Mode is not set to Azure Active Directory 🟢

- Contextual name: 📝 Managed Disk is not attached to any Virtual Machine 🟢

- Contextual name: 📝 Managed Disk Public Network Access is not disabled 🟢

- Contextual name: 📝 Managed Disk Snapshot is 90 days old or more 🟢

- Contextual name: 📝 Managed Disk Snapshot is stored on Premium SSDs Managed Disk storage 🟢

- Contextual name: 📝 Managed Zone DNSSEC is not enabled 🟢

- Contextual name: 📝 Managed Zone DNSSEC Key-Signing Algorithm is RSASHA1 🟢

- Contextual name: 📝 Managed Zone DNSSEC Zone-Signing Algorithm is RSASHA1 🟢

- Contextual name: 📝 Management Console Authentication Failures Monitoring is not enabled 🟢

- Contextual name: 📝 Management Console Sign-In without MFA Monitoring is not enabled 🟢

- Contextual name: 📝 MFA For Administrators is not required 🟢

- Contextual name: 📝 MFA For All Users is not required 🟢

- Contextual name: 📝 MFA For Risky Sign-Ins is not required 🟢

- Contextual name: 📝 MFA For Windows Azure Service Management API is not required 🟢

- Contextual name: 📝 MFA is not enabled 🟢

- Contextual name: 📝 MFA To Access Microsoft Admin Portals is not required 🟢

- Contextual name: 📝 Microsoft Cloud Security Benchmark policies are disabled 🟢

- Contextual name: 📝 Microsoft Defender For (Managed Instance) Azure SQL Databases is not set to On 🟢

- Contextual name: 📝 Microsoft Defender For App Services is not set to On 🟢

- Contextual name: 📝 Microsoft Defender For Azure Cosmos DB is not set to On 🟢

- Contextual name: 📝 Microsoft Defender For Containers is not set to On 🟢

- Contextual name: 📝 Microsoft Defender For IoT Hub is not set to On 🟢

- Contextual name: 📝 Microsoft Defender For Key Vault is not set to On 🟢

- Contextual name: 📝 Microsoft Defender For Open-Source Relational Databases is not set to On 🟢

- Contextual name: 📝 Microsoft Defender For Resource Manager is not set to On 🟢

- Contextual name: 📝 Microsoft Defender For Servers is not set to On 🟢

- Contextual name: 📝 Microsoft Defender For SQL Servers On Machines is not set to On 🟢

- Contextual name: 📝 Microsoft Defender For Storage is not set to On 🟢

- Contextual name: 📝 Migration Task Logging is not enabled 🟢

- Contextual name: 📝 Minimum TLS Version is not set to TLS 1.2 or higher 🟢

- Contextual name: 📝 Minimum TLS Version is not set to TLS 1.2 or higher 🟢

- Contextual name: 📝 Multi-Region CloudTrail is not enabled 🟢

- Contextual name: 📝 MySQL Instance allows anyone to connect with administrative privileges 🟢

- Contextual name: 📝 MySQL Instance Local_infile Database Flag is not set to off 🟢

- Contextual name: 📝 MySQL Instance Skipshowdatabase Database Flag is not set to on 🟢

- Contextual name: 📝 Named Locations are not defined 🟢

- Contextual name: 📝 Network Access Control Lists Changes Monitoring is not enabled 🟢

- Contextual name: 📝 Network ACL exposes admin ports to public internet 🟢

- Contextual name: 📝 Network ACL is unused 🟢

- Contextual name: 📝 Network Gateways Changes Monitoring is not enabled 🟢

- Contextual name: 📝 Network Security Group Flow Logs are not captured and sent to Log Analytics Workspace 🟢

- Contextual name: 📝 Network Watcher is not enabled in every available region 🟢

- Contextual name: 📝 Non-RBAC Key Vault stores Keys without expiration date 🟢

- Contextual name: 📝 Non-RBAC Key Vault stores Secrets without expiration date 🟢

- Contextual name: 📝 Notify All Admins When Other Admins Reset Their Password is set No 🟢

- Contextual name: 📝 Notify Users On Password Resets is set to No 🟢

- Contextual name: 📝 NumberType 🟢

- Contextual name: 📝 NumberType 🟢

- Contextual name: 📝 Object-level CloudTrail Logging for Read Events for S3 Buckets is not enabled 🟢

- Contextual name: 📝 Object-level CloudTrail Logging for Write Events for S3 Buckets is not enabled 🟢

- Contextual name: 📝 og Sink exports logs to a Storage Bucket without Bucket Lock 🟢

- Contextual name: 📝 OR 🟢

- Contextual name: 📝 Organization Administrator Security Key Enforcement is not enabled 🟢

- Contextual name: 📝 Organization Essential Contacts is not configured 🟢

- Contextual name: 📝 OS and Data disks are not encrypted with Customer-managed key 🟢

- Contextual name: 📝 Owners Can Manage Group Membership Requests In The Access Panel is set to Yes 🟢

- Contextual name: 📝 Password is not rotated every 90 days 🟢

- Contextual name: 📝 Physical Server Should Have Breeze Agent Installed 🟢

- Contextual name: 📝 Policy (Customer Managed) Contains Potential Credentials Exposure 🔴🟠

- Contextual name: 📝 Policy allows full administrative privileges 🟢

- Contextual name: 📝 PostgreSQL Instance Logerrorverbosity Database Flag is not set to DEFAULT or stricter 🟢

- Contextual name: 📝 PostgreSQL Instance cloudsql.enable_pgaudit Database Flag is not set to on 🟢

- Contextual name: 📝 PostgreSQL Instance Log_connections Database Flag is not set to On 🟢

- Contextual name: 📝 PostgreSQL Instance Log_disconnections Database Flag is not set to On 🟢

- Contextual name: 📝 PostgreSQL Instance Logminduration_statement Database Flag is not set to -1 (Disabled) 🟢

- Contextual name: 📝 PostgreSQL Instance Logminerror_statement Database Flag is not set to Error or stricter 🟢

- Contextual name: 📝 PostgreSQL Instance Logminmessages Database Flag is not set at minimum to Warning 🟢

- Contextual name: 📝 PostgreSQL Instance Log_statement Database Flag is not set appropriately 🟢

- Contextual name: 📝 Primary Contact information is not current 🔴🟢

- Contextual name: 📝 Private Endpoints are not used 🟢

- Contextual name: 📝 Private Endpoints are not used 🟢

- Contextual name: 📝 Private Endpoints are not used 🟢

- Contextual name: 📝 Privileged Role Assignments are not periodically reviewed 🟢

- Contextual name: 📝 Privileged Virtual Machine is accessed by identities without MFA 🟢

- Contextual name: 📝 Project Bitbucket Source Location URL contains credentials 🟢

- Contextual name: 📝 Project has a default network 🟢

- Contextual name: 📝 Project has a legacy network 🟢

- Contextual name: 📝 Provisioned Table Auto Scaling is not configured 🟢

- Contextual name: 📝 Public IP Address is not associated with any resource 🟢

- Contextual name: 📝 Public IP Addresses are not evaluated periodically 🟢

- Contextual name: 📝 Public Network Access is enabled 🟢

- Contextual name: 📝 Public Network Access is not disabled 🟢

- Contextual name: 📝 Queue Logging is not enabled for Read, Write, and Delete requests 🟢

- Contextual name: 📝 RBAC Key Vault stores Keys without expiration date 🟢

- Contextual name: 📝 RBAC Key Vault stores Secrets without expiration date 🟢

- Contextual name: 📝 Recommendations for Apply System Updates are not completed 🟢

- Contextual name: 📝 Reconfirm Authentication Information is set to 0 🟢

- Contextual name: 📝 Recovery Point is expired and failed to delete 🟢

- Contextual name: 📝 Remember MFA devices setting is disabled 🟢

- Contextual name: 📝 Remote Debugging is not disabled 🟢

- Contextual name: 📝 Replication Instance Auto Minor Version Upgrade is not enabled 🟢

- Contextual name: 📝 Replication Instance is publicly accessible 🟢

- Contextual name: 📝 Require Infrastructure Encryption is not enabled 🟢

- Contextual name: 📝 Require MFA to register or join devices with Microsoft Entra ID is set to No 🟢

- Contextual name: 📝 Resource Lock Administrator Custom Role does not exist 🟢

- Contextual name: 📝 Resource Lock is not enabled for mission-critical resources 🟢

- Contextual name: 📝 Resources Basic SKU is used for production workloads 🟢

- Contextual name: 📝 REST API Stage is not associated with a WAF Web ACL 🟢

- Contextual name: 📝 REST API Stage is not configured to use an SSL certificate for authentication 🟢

- Contextual name: 📝 REST API Stage X-Ray Tracing is not enabled 🟢

- Contextual name: 📝 Restrict Access To Microsoft Entra Admin Center is set to No 🟢

- Contextual name: 📝 Restrict User Ability To Access Groups Features In The Access Pane is set to No 🟢

- Contextual name: 📝 Role Based Access Control is not enabled 🟢

- Contextual name: 📝 Roles related to KMS are not assigned to separate users 🟢

- Contextual name: 📝 Root Account Usage Monitoring is not enabled 🟢

- Contextual name: 📝 Root User credentials were used is the last 30 days 🟢

- Contextual name: 📝 Route Table Changes Monitoring is not enabled 🟢

- Contextual name: 📝 Route Table for VPC Peering does not follow the least privilege principle 🟢

- Contextual name: 📝 RSA Certificate key length is less than 2048 bits 🟢

- Contextual name: 📝 S3 Bucket Access Logging is not enabled. 🟢

- Contextual name: 📝 S3 Bucket Policy Changes Monitoring is not enabled 🟢

- Contextual name: 📝 Secure Transfer Required is not enabled 🟢

- Contextual name: 📝 Security Alert Notifications additional email address is not configured 🟢

- Contextual name: 📝 Security Alert Notifications for alerts with High or Critical severity is not configured 🟢

- Contextual name: 📝 Security Alert Notifications for attack path with Critical severity is not configured 🟢

- Contextual name: 📝 Security Alert Notifications to subscription owners are not configured 🟢

- Contextual name: 📝 Security Defaults are not enabled 🟢

- Contextual name: 📝 Security Group allows allows public access to DNS port 🟢

- Contextual name: 📝 Security Group allows public access to all ports 🟢

- Contextual name: 📝 Security Group allows public access to CIFS port 🟢

- Contextual name: 📝 Security Group allows public access to FTP ports 🟢

- Contextual name: 📝 Security Group allows public access to HTTP(S) ports 🟢

- Contextual name: 📝 Security Group allows public access to MongoDB ports 🟢

- Contextual name: 📝 Security Group allows public access to MSSQL port 🟢

- Contextual name: 📝 Security Group allows public access to MySQL port 🟢

- Contextual name: 📝 Security Group allows public access to NetBIOS ports 🟢

- Contextual name: 📝 Security Group allows public access to Oracle DBMS ports 🟢

- Contextual name: 📝 Security Group allows public access to PostgreSQL port 🟢

- Contextual name: 📝 Security Group allows public access to RDP port 🟢

- Contextual name: 📝 Security Group allows public access to RPC port 🟢

- Contextual name: 📝 Security Group allows public access to SMTP port 🟢

- Contextual name: 📝 Security Group allows public access to SSH port 🟢

- Contextual name: 📝 Security Group allows public access to Telnet port 🟢

- Contextual name: 📝 Security Group allows public IPv4 (0.0.0.0/0) access to admin ports 🟢

- Contextual name:/0) access to admin ports 🟢

- Contextual name: 📝 Security Group allows public UDP access 🟢

- Contextual name: 📝 Security Group allows unrestricted CIFS traffic 🟢

- Contextual name: 📝 Security Group allows unrestricted DNS traffic 🟢

- Contextual name: 📝 Security Group allows unrestricted FTP traffic 🟢

- Contextual name: 📝 Security Group allows unrestricted ICMP traffic 🟢

- Contextual name: 📝 Security Group allows unrestricted NetBIOS traffic 🟢

- Contextual name: 📝 Security Group allows unrestricted RPC traffic 🟢

- Contextual name: 📝 Security Group allows unrestricted SMTP traffic 🟢

- Contextual name: 📝 Security Group allows unrestricted Telnet traffic 🟢

- Contextual name: 📝 Security Group allows unrestricted traffic to all ports 🟢

- Contextual name: 📝 Security Group allows unrestricted traffic to MongoDB 🟢

- Contextual name: 📝 Security Group allows unrestricted traffic to MSSQL 🟢

- Contextual name: 📝 Security Group allows unrestricted traffic to MySQL 🟢

- Contextual name: 📝 Security Group allows unrestricted traffic to Oracle DBMS 🟢

- Contextual name: 📝 Security Group allows unrestricted traffic to PostgreSQL 🟢

- Contextual name: 📝 Security Group Changes Monitoring is not enabled 🟢

- Contextual name: 📝 Security Group Flow Logs retention period is less than 90 days 🟢

- Contextual name: 📝 Security Hub is not enabled 🟢

- Contextual name: 📝 Self-Service Password Reset does not require 2 authentication methods 🟢

- Contextual name: 📝 Sensitive Data Protection is not in use 🟢

- Contextual name: 📝 Server Auditing is not enabled 🟢

- Contextual name: 📝 Server Auditing Retention is less than 90 days 🟢

- Contextual name: 📝 Server Certificate is expired 🟢

- Contextual name: 📝 Server Microsoft Entra authentication is not configured 🟢

- Contextual name: 📝 Server Public Network Access is not disabled 🟢

- Contextual name: 📝 Server Transparent Data Encryption Protector is not encrypted with Customer-managed key 🟢

- Contextual name: 📝 Service Account has admin privileges 🟢

- Contextual name: 📝 Service Account has User-Managed Keys 🟢

- Contextual name: 📝 Service Account User-Managed Key is not rotated every 90 days 🟢

- Contextual name: 📝 SetType 🟢

- Contextual name: 📝 Shared Access Signature Tokens do not expire within 1 hour 🟢

- Contextual name: 📝 Shared Key Access is not disabled 🟢

- Contextual name: 📝 Single Server Enforce SSL Connection is not set enabled 🟢

- Contextual name: 📝 Single Server Infrastructure Double Encryption is not enabled 🟢

- Contextual name: 📝 Single Server log_connections Parameter is not set to ON 🟢

- Contextual name: 📝 Single Server log_disconnections Parameter is not set to ON 🟢

- Contextual name: 📝 Snapshot is publicly accessible 🟢

- Contextual name: 📝 Soft Delete and Purge Protection functions are not enabled 🟢

- Contextual name: 📝 SQL Instance Automated Backups are not configured 🟢

- Contextual name: 📝 SQL Instance External Authorized Networks do not whitelist all public IP addresses 🟢

- Contextual name: 📝 SQL Instance has public IP addresses 🟢

- Contextual name: 📝 SQL Instance SSL Connections are not enforced 🟢

- Contextual name: 📝 SQL Server Instance 3625 (trace flag) Database Flag is not set to on 🟢

- Contextual name: 📝 SQL Server Instance contained database authentication Database Flag is set to on 🟢

- Contextual name: 📝 SQL Server Instance cross db ownership chaining Database Flag is not set to off 🟢

- Contextual name: 📝 SQL Server Instance external scripts enabled Database Flag is not set to off 🟢

- Contextual name: 📝 SQL Server Instance remote access Database Flag is not set to off 🟢

- Contextual name: 📝 SQL Server Instance user connections Database Flag is set to a limiting (other than 0) value 🟢

- Contextual name: 📝 SQL Server Instance user options Database Flag is configured 🟢

- Contextual name: 📝 STARTS_WITH 🟢

- Contextual name: 📝 Storage Account uses Delete lock 🟢

- Contextual name: 📝 Storage Account uses Locally Redundant Storage replication option 🟢

- Contextual name: 📝 Storage Account uses ReadOnly lock 🟢

- Contextual name: 📝 Subnet Map Public IP On Launch is enabled 🟢

- Contextual name: 📝 Subscription Leaving Microsoft Entra ID Directory and Subscription Entering Microsoft Entra ID Directory is not set to Permit No One 🟢

- Contextual name: 📝 Symmetric CMK Rotation is not enabled 🟢

- Contextual name: 📝 Table is not encrypted with Customer-Managed Encryption Key (CMEK) 🟢

- Contextual name: 📝 Table Logging is not enabled for Read, Write, and Delete requests 🟢

- Contextual name: 📝 Table Point In Time Recovery is not enabled 🟢

- Contextual name: 📝 TAG_EXISTS 🟢

- Contextual name: 📝 TAG_VALUE 🟢

- Contextual name: 📝 Task logging is not enabled 🟢

- Contextual name: 📝 Text Items 🟢

- Contextual name: 📝 Text Items 🟢

- Contextual name: 📝 Text Items 🟢

- Contextual name: 📝 Text Items 🟢

- Contextual name: 📝 TextType 🟢

- Contextual name: 📝 TextType 🟢

- Contextual name: 📝 TextType 🟢

- Contextual name: 📝 TextType 🟢

- Contextual name: 📝 Transit Gateway Auto Accept Shared Attachments is enabled 🟢

- Contextual name: 📝 Trusted Azure Services are not enabled as networking exceptions 🟢

- Contextual name: 📝 Trusted Launch is not enabled 🟢

- Contextual name: 📝 Unapproved Extensions are installed 🟢

- Contextual name: 📝 Unattached Managed Disk is not encrypted with Customer-managed key 🟢

- Contextual name: 📝 Unauthorized API Calls Monitoring is not enabled 🟢

- Contextual name: 📝 Use of the 'User Access Administrator' role is not restricted 🟢

- Contextual name: 📝 User Access Keys are not rotated every 90 days or less 🟢

- Contextual name: 📝 User Consent For Applications is not set to Allow From Verified Publishers 🟢

- Contextual name: 📝 User Consent For Applications is not set to Do Not Allow User Consent 🟢

- Contextual name: 📝 User has both Service Account Admin and Service Account User roles assigned 🟢

- Contextual name: 📝 User has inline or directly attached policies 🟢

- Contextual name: 📝 User has more than one active access key 🟢

- Contextual name: 📝 User MFA is not enabled for all users with console password 🟢

- Contextual name: 📝 User with console and programmatic access set during the initial creation 🟢

- Contextual name: 📝 User with credentials unused for 45 days or more is not disabled 🟢

- Contextual name: 📝 Users Can Create Microsoft 365 Groups In Azure Portals, API Or PowerShell is set to Yes 🟢

- Contextual name: 📝 Users Can Create Security Groups In Azure Portals, API Or PowerShell is set to Yes 🟢

- Contextual name: 📝 Users Can Register Applications is set to Yes 🟢

- Contextual name: 📝 Users Multi-Factor Auth Status is not enabled 🟢

- Contextual name: 📝 Vault contains unencrypted Recovery Points 🟢

- Contextual name: 📝 vCenter Virtual Machine Should Have Breeze Agent Installed 🟢

- Contextual name: 📝 Virtual Machine allows public access to all ports 🟢

- Contextual name: 📝 Virtual Machine allows public access to CIFS port 🟢

- Contextual name: 📝 Virtual Machine allows public access to DNS port 🟢

- Contextual name: 📝 Virtual Machine allows public access to FTP ports 🟢

- Contextual name: 📝 Virtual Machine allows public access to HTTP(S) ports 🟢

- Contextual name: 📝 Virtual Machine allows public access to MongoDB ports 🟢

- Contextual name: 📝 Virtual Machine allows public access to MSSQL port 🟢

- Contextual name: 📝 Virtual Machine allows public access to MySQL port 🟢

- Contextual name: 📝 Virtual Machine allows public access to NetBIOS ports 🟢

- Contextual name: 📝 Virtual Machine allows public access to Oracle DBMS ports 🟢

- Contextual name: 📝 Virtual Machine allows public access to PostgreSQL port 🟢

- Contextual name: 📝 Virtual Machine allows public access to RDP port 🟢

- Contextual name: 📝 Virtual Machine allows public access to RPC port 🟢

- Contextual name: 📝 Virtual Machine allows public access to SMTP port 🟢

- Contextual name: 📝 Virtual Machine allows public access to SSH port 🟢

- Contextual name: 📝 Virtual Machine allows public access to Telnet port 🟢

- Contextual name: 📝 Virtual Machine allows public UDP access 🟢

- Contextual name: 📝 Virtual Machine is idle 🟢

- Contextual name: 📝 Virtual Machine is not utilizing Managed Disks 🟢

- Contextual name: 📝 Virtual Machine is overutilized 🟢

- Contextual name: 📝 Virtual Machine is underutilized 🟢

- Contextual name: 📝 Virtual Network Filter is not enabled 🟢

- Contextual name: 📝 Virtual Network Flow Logs are not captured and sent to Log Analytics Workspace 🟢

- Contextual name: 📝 Virtual Network Flow Logs retention period is less than 90 days 🟢

- Contextual name: 📝 Virtual Network Gateway has no connections 🟢

- Contextual name: 📝 VPC Changes Monitoring is not enabled 🟢

- Contextual name: 📝 VPC is not configured with a VPC Endpoint for Amazon EC2 service 🟢

- Contextual name: 📝 VPN Connection does not have both Tunnels up 🟢

- Contextual name: 📝 Vulnerability Assessment is not auto provisioned 🟢

- Contextual name: 📝 Web Distribution Cache Behaviors allow unencrypted traffic 🟢

- Contextual name: 📝 Web Distribution Default Root Object is not configured 🟢

- Contextual name: 📝 Web Distribution does not encrypt traffic to Custom Origins 🟢

- Contextual name: 📝 Web Distribution uses Dedicated IP for SSL 🟢

- Contextual name: 📝 Web Distribution uses default SSL/TLS certificate 🟢

- Contextual name: 📝 Web Distribution uses outdated SSL protocols with Custom Origins 🟢

- Contextual name: 📝 Workgroup CloudWatch Metrics are not enabled 🟢

- Contextual name: 📝 Workspace is not deployed in a customer-managed virtual network (VNet) 🟢

- Contextual name: 📝 Workspace is not encrypted using customer-managed key (CMK) 🟢

- Contextual name: 📝 Workspace traffic is not encrypted between cluster worker nodes 🟢