Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement Rego check for Common Controls early access app control #479

Merged
merged 6 commits into from
Oct 24, 2024
Prev Previous commit
Next Next commit
add unit tests to check correct/incorrect OU/Group settings
mitchelbaker-cisa committed Oct 17, 2024
commit f59928b8b5c3f5b1ddfd94a965b32cb2a0b03323
315 changes: 314 additions & 1 deletion Testing/RegoTests/commoncontrols/commoncontrols16_test.rego
Original file line number Diff line number Diff line change
@@ -128,4 +128,317 @@
"is non-compliant; manual check recommended."
])
}
#--
#--

#
# GWS.COMMONCONTROLS.16.2v0.3
#--

test_EarlyAccessApps_OUs_Correct_V1 if {
# Test 1 correct event
PolicyId := "GWS.COMMONCONTROLS.16.2v0.3"
Output := tests with input as {
"commoncontrols_logs": {"items": [
{
"id": {"time": "2024-10-15T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "false"},
{"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
]
}]
}
]},
"tenant_info": {
"topLevelOU": "Test Top-Level OU"
}
}

RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
count(RuleOutput) == 1
RuleOutput[0].RequirementMet
not RuleOutput[0].NoSuchEvent
RuleOutput[0].ReportDetails == "Requirement met in all OUs and groups."
}

test_EarlyAccessApps_OUs_Correct_V2 if {
# Test inheritance
PolicyId := "GWS.COMMONCONTROLS.16.2v0.3"
Output := tests with input as {
"commoncontrols_logs": {"items": [
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "false"},
{"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
]
}]
},
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "INHERIT_FROM_PARENT"},
{"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
]
}]
}
]},
"tenant_info": {
"topLevelOU": "Test Top-Level OU"
}
}

RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
count(RuleOutput) == 1
RuleOutput[0].RequirementMet
not RuleOutput[0].NoSuchEvent
RuleOutput[0].ReportDetails == "Requirement met in all OUs and groups."
}

test_EarlyAccessApps_OUs_Incorrect_V1 if {
# Test 1 incorrect event
PolicyId := "GWS.COMMONCONTROLS.16.2v0.3"
Output := tests with input as {
"commoncontrols_logs": {"items": [
{
"id": {"time": "2024-05-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "true"},
{"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
]
}]
}
]},
"tenant_info": {
"topLevelOU": "Test Top-Level OU"
}
}

RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
count(RuleOutput) == 1
not RuleOutput[0].RequirementMet
not RuleOutput[0].NoSuchEvent
RuleOutput[0].ReportDetails == concat("", [
"The following OUs are non-compliant:<ul>",
"<li>Test Top-Level OU: Service status is ON</li>",
"</ul>"
])
}

test_EarlyAccessApps_OUs_Incorrect_V2 if {
# Test incorrect second-level OU
PolicyId := "GWS.COMMONCONTROLS.16.2v0.3"
Output := tests with input as {
"commoncontrols_logs": {"items": [
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "false"},
{"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
]
}]
},
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "true"},
{"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
]
}]
}
]},
"tenant_info": {
"topLevelOU": "Test Top-Level OU"
}
}

RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
count(RuleOutput) == 1
not RuleOutput[0].RequirementMet
not RuleOutput[0].NoSuchEvent
RuleOutput[0].ReportDetails == concat("", [
"The following OUs are non-compliant:<ul>",
"<li>Test Second-Level OU: Service status is ON</li>",
"</ul>"
])
}

test_EarlyAccessApps_OUs_Correct_Groups_Incorrect_V3 if {
# Test for correct OUs but with an incorrect group event
PolicyId := "GWS.COMMONCONTROLS.16.2v0.3"
Output := tests with input as {
"commoncontrols_logs": {"items": [
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "false"},
{"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
]
}]
},
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "true"},
{"name": "GROUP_EMAIL", "value": "Test Group 1"},
]
}]
}
]},
"tenant_info": {
"topLevelOU": "Test Top-Level OU"
}
}

RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
count(RuleOutput) == 1
not RuleOutput[0].RequirementMet
not RuleOutput[0].NoSuchEvent
RuleOutput[0].ReportDetails == concat("", [
"The following groups are non-compliant:<ul>",
"<li>Test Group 1: Service status is ON</li>",
"</ul>"
])
}

test_EarlyAccessApps_OUs_Correct_Groups_Incorrect_V3 if {

Check failure on line 327 in Testing/RegoTests/commoncontrols/commoncontrols16_test.rego

GitHub Actions / Run-OPA-Tests

Multiple tests with same name. To learn more, see: https://docs.styra.com/regal/rules/testing/identically-named-tests
# Test for correct OUs but with incorrect group events
PolicyId := "GWS.COMMONCONTROLS.16.2v0.3"
Output := tests with input as {
"commoncontrols_logs": {"items": [
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "false"},
{"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
]
}]
},
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "true"},
{"name": "GROUP_EMAIL", "value": "Test Group 1"},
]
}]
},
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "true"},
{"name": "GROUP_EMAIL", "value": "Test Group 2"},
]
}]
}
]},
"tenant_info": {
"topLevelOU": "Test Top-Level OU"
}
}

RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
count(RuleOutput) == 1
not RuleOutput[0].RequirementMet
not RuleOutput[0].NoSuchEvent
RuleOutput[0].ReportDetails == concat("", [
"The following groups are non-compliant:<ul>",
"<li>Test Group 1: Service status is ON</li>",
"<li>Test Group 2: Service status is ON</li>",
"</ul>"
])
}

test_EarlyAccessApps_OUs_Groups_Incorrect_V3 if {
# Test for both incorrect OUs and group events
PolicyId := "GWS.COMMONCONTROLS.16.2v0.3"
Output := tests with input as {
"commoncontrols_logs": {"items": [
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "true"},
{"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
]
}]
},
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "true"},
{"name": "GROUP_EMAIL", "value": "Test Group 1"},
]
}]
},
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "true"},
{"name": "GROUP_EMAIL", "value": "Test Group 2"},
]
}]
}
]},
"tenant_info": {
"topLevelOU": "Test Top-Level OU"
}
}

RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
count(RuleOutput) == 1
not RuleOutput[0].RequirementMet
not RuleOutput[0].NoSuchEvent
RuleOutput[0].ReportDetails == concat("", [
"The following OUs are non-compliant:<ul>",
"<li>Test Top-Level OU: Service status is ON</li>",
#"<li>Test Second-Level OU: Service status is ON</li>",
"</ul><br>",
"The following groups are non-compliant:<ul>",
"<li>Test Group 1: Service status is ON</li>",
"<li>Test Group 2: Service status is ON</li>",
"</ul>"
])
}
#--

#"The following OUs are non-compliant:<ul><li>DHS-CISA: Service status is ON</li></ul><br>The following groups are non-compliant:<ul><li>Test Google Services: Service status is ON</li><li>Test Group: Service status is ON</li></ul>"

Check failure on line 444 in Testing/RegoTests/commoncontrols/commoncontrols16_test.rego

GitHub Actions / Run-OPA-Tests

Line too long. To learn more, see: https://docs.styra.com/regal/rules/style/line-length