Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement Rego check for Common Controls early access app control #479

Merged
merged 6 commits into from
Oct 24, 2024
Merged

Implement Rego check for Common Controls early access app control #479

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1b92a5a
write logic for noncompliant OUs and initial rule sets for common con…
mitchelbaker-cisa Oct 16, 2024
d173907
add non-compliant groups, make required changes in rule sets to accom…
mitchelbaker-cisa Oct 16, 2024
f59928b
add unit tests to check correct/incorrect OU/Group settings
mitchelbaker-cisa Oct 17, 2024
dd78162
fix linter
mitchelbaker-cisa Oct 17, 2024
fa68247
cleanup comments
mitchelbaker-cisa Oct 17, 2024
0604825
add count(Events) > 0 condition to ensure correct execution of rulesets
mitchelbaker-cisa Oct 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
310 changes: 310 additions & 0 deletions Testing/RegoTests/commoncontrols/commoncontrols16_test.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,4 +128,314 @@ test_Unlisted_Incorrect_V2 if {
"is non-compliant; manual check recommended."
])
}
#--

#
# GWS.COMMONCONTROLS.16.2v0.3
#--

test_EarlyAccessApps_OUs_Correct_V1 if {
# Test 1 correct event
PolicyId := "GWS.COMMONCONTROLS.16.2v0.3"
Output := tests with input as {
"commoncontrols_logs": {"items": [
{
"id": {"time": "2024-10-15T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "false"},
{"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
]
}]
}
]},
"tenant_info": {
"topLevelOU": "Test Top-Level OU"
}
}

RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
count(RuleOutput) == 1
RuleOutput[0].RequirementMet
not RuleOutput[0].NoSuchEvent
RuleOutput[0].ReportDetails == "Requirement met in all OUs and groups."
}

test_EarlyAccessApps_OUs_Correct_V2 if {
# Test inheritance with root and sub OUs
PolicyId := "GWS.COMMONCONTROLS.16.2v0.3"
Output := tests with input as {
"commoncontrols_logs": {"items": [
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "false"},
{"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
]
}]
},
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "INHERIT_FROM_PARENT"},
{"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
]
}]
}
]},
"tenant_info": {
"topLevelOU": "Test Top-Level OU"
}
}

RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
count(RuleOutput) == 1
RuleOutput[0].RequirementMet
not RuleOutput[0].NoSuchEvent
RuleOutput[0].ReportDetails == "Requirement met in all OUs and groups."
}

test_EarlyAccessApps_OUs_Incorrect_V1 if {
# Test incorrect root OU
PolicyId := "GWS.COMMONCONTROLS.16.2v0.3"
Output := tests with input as {
"commoncontrols_logs": {"items": [
{
"id": {"time": "2024-05-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "true"},
{"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
]
}]
}
]},
"tenant_info": {
"topLevelOU": "Test Top-Level OU"
}
}

RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
count(RuleOutput) == 1
not RuleOutput[0].RequirementMet
not RuleOutput[0].NoSuchEvent
RuleOutput[0].ReportDetails == concat("", [
"The following OUs are non-compliant:<ul>",
"<li>Test Top-Level OU: Service status is ON</li>",
"</ul>"
])
}

test_EarlyAccessApps_OUs_Incorrect_V2 if {
# Test incorrect second-level OU
PolicyId := "GWS.COMMONCONTROLS.16.2v0.3"
Output := tests with input as {
"commoncontrols_logs": {"items": [
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "false"},
{"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
]
}]
},
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "true"},
{"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
]
}]
}
]},
"tenant_info": {
"topLevelOU": "Test Top-Level OU"
}
}

RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
count(RuleOutput) == 1
not RuleOutput[0].RequirementMet
not RuleOutput[0].NoSuchEvent
RuleOutput[0].ReportDetails == concat("", [
"The following OUs are non-compliant:<ul>",
"<li>Test Second-Level OU: Service status is ON</li>",
"</ul>"
])
}

test_EarlyAccessApps_OUs_Correct_Groups_Incorrect_V1 if {
# Test for correct root OU but with an incorrect group event
PolicyId := "GWS.COMMONCONTROLS.16.2v0.3"
Output := tests with input as {
"commoncontrols_logs": {"items": [
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "false"},
{"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
]
}]
},
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "true"},
{"name": "GROUP_EMAIL", "value": "Test Group 1"},
]
}]
}
]},
"tenant_info": {
"topLevelOU": "Test Top-Level OU"
}
}

RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
count(RuleOutput) == 1
not RuleOutput[0].RequirementMet
not RuleOutput[0].NoSuchEvent
RuleOutput[0].ReportDetails == concat("", [
"The following groups are non-compliant:<ul>",
"<li>Test Group 1: Service status is ON</li>",
"</ul>"
])
}

test_EarlyAccessApps_OUs_Correct_Groups_Incorrect_V2 if {
# Test for correct root OU but with incorrect group events
PolicyId := "GWS.COMMONCONTROLS.16.2v0.3"
Output := tests with input as {
"commoncontrols_logs": {"items": [
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "false"},
{"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
]
}]
},
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "true"},
{"name": "GROUP_EMAIL", "value": "Test Group 1"},
]
}]
},
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "true"},
{"name": "GROUP_EMAIL", "value": "Test Group 2"},
]
}]
}
]},
"tenant_info": {
"topLevelOU": "Test Top-Level OU"
}
}

RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
count(RuleOutput) == 1
not RuleOutput[0].RequirementMet
not RuleOutput[0].NoSuchEvent
RuleOutput[0].ReportDetails == concat("", [
"The following groups are non-compliant:<ul>",
"<li>Test Group 1: Service status is ON</li>",
"<li>Test Group 2: Service status is ON</li>",
"</ul>"
])
}

test_EarlyAccessApps_OUs_Groups_Incorrect_V1 if {
# Test for both incorrect OUs and group events
PolicyId := "GWS.COMMONCONTROLS.16.2v0.3"
Output := tests with input as {
"commoncontrols_logs": {"items": [
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "true"},
{"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
]
}]
},
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "true"},
{"name": "GROUP_EMAIL", "value": "Test Group 1"},
]
}]
},
{
"id": {"time": "2022-12-20T00:02:28.672Z"},
"events": [{
"name": "TOGGLE_SERVICE_ENABLED",
"parameters": [
{"name": "SERVICE_NAME", "value": "Early Access Apps"},
{"name": "NEW_VALUE", "value": "true"},
{"name": "GROUP_EMAIL", "value": "Test Group 2"},
]
}]
}
]},
"tenant_info": {
"topLevelOU": "Test Top-Level OU"
}
}

RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
count(RuleOutput) == 1
not RuleOutput[0].RequirementMet
not RuleOutput[0].NoSuchEvent
RuleOutput[0].ReportDetails == concat("", [
"The following OUs are non-compliant:<ul>",
"<li>Test Top-Level OU: Service status is ON</li>",
"</ul><br>",
"The following groups are non-compliant:<ul>",
"<li>Test Group 1: Service status is ON</li>",
"<li>Test Group 2: Service status is ON</li>",
"</ul>"
])
}
#--
Loading
Loading