Skip to content

Commit e137e26

Browse files
acx1729acx1729
committed
updating to integrations
1 parent 4d1ece0 commit e137e26

File tree

2,705 files changed

+237015
-35047
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

2,705 files changed

+237015
-35047
lines changed

‎queries/1-aws_insight_lambda_function_not_cmk_encrypted.yaml‎

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,16 @@
1+
Description: List of lambda functions which are not encrypted with CMK
12
ID: aws_insight_lambda_function_not_cmk_encrypted
2-
Title: "Unencrypted Lambda"
3-
Description: "List of lambda functions which are not encrypted with CMK"
43
IntegrationTypeName:
5-
- aws
4+
- aws_cloud
65
Query:
76
Engine: CloudQL-v0.0.1
8-
QueryToExecute: |-
9-
select
10-
name,
11-
kms_key_arn, account_id, og_account_id, og_resource_id
12-
from
13-
aws_lambda_function
14-
where
15-
kms_key_arn is null;
16-
PrimaryTable: aws_lambda_function
177
ListOfTables:
188
- aws_lambda_function
199
Parameters: []
10+
PrimaryTable: aws_lambda_function
11+
QueryToExecute: "select\n name,\n kms_key_arn, account_id, og_account_id, og_resource_id\n\
12+
from\n aws_lambda_function\nwhere\n kms_key_arn is null;"
2013
Tags:
2114
category:
2215
- Security
16+
Title: Unencrypted Lambda

‎queries/10-aws_insight_acm_certificate_transparency_logging_disabled.yaml‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,19 @@
1+
Description: List certificates for which transparency logging is disabled
12
ID: aws_insight_acm_certificate_transparency_logging_disabled
2-
Title: "Certificates with no Logging"
3-
Description: "List certificates for which transparency logging is disabled"
43
IntegrationTypeName:
5-
- aws
4+
- aws_cloud
65
Query:
76
Engine: CloudQL-v0.0.1
8-
QueryToExecute: |-
9-
select certificate_arn, domain_name, status, account_id, og_account_id, og_resource_id from
10-
aws_acm_certificate
11-
where
12-
certificate_transparency_logging_preference <> 'ENABLED';
13-
PrimaryTable: aws_acm_certificate
147
ListOfTables:
158
- aws_acm_certificate
169
Parameters: []
10+
PrimaryTable: aws_acm_certificate
11+
QueryToExecute: "select certificate_arn, domain_name, status, account_id, og_account_id,\
12+
\ og_resource_id from\n aws_acm_certificate\nwhere\n certificate_transparency_logging_preference\
13+
\ <> 'ENABLED';"
1714
Tags:
1815
category:
1916
- Security
2017
- Technical Debt
2118
- Resiliency
19+
Title: Certificates with no Logging

‎queries/11-aws_insight_acm_certificate_expired.yaml‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,19 @@
1+
Description: List of expired certificates
12
ID: aws_insight_acm_certificate_expired
2-
Title: "Expired Certificates"
3-
Description: "List of expired certificates"
43
IntegrationTypeName:
5-
- aws
4+
- aws_cloud
65
Query:
76
Engine: CloudQL-v0.0.1
8-
QueryToExecute: |-
9-
select certificate_arn, domain_name, status, account_id, og_account_id, og_resource_id from
10-
aws_acm_certificate
11-
where
12-
status = 'EXPIRED';
13-
PrimaryTable: aws_acm_certificate
147
ListOfTables:
158
- aws_acm_certificate
169
Parameters: []
10+
PrimaryTable: aws_acm_certificate
11+
QueryToExecute: "select certificate_arn, domain_name, status, account_id, og_account_id,\
12+
\ og_resource_id from\n aws_acm_certificate\nwhere\n status = 'EXPIRED';"
1713
Tags:
1814
category:
1915
- Security
2016
- Technical Debt
2117
- Resiliency
2218
- Cost Management
19+
Title: Expired Certificates

‎queries/12-aws_insight_ebs_snapshot_older_than_year.yaml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,18 @@
1+
Description: List Snapshots older than 365 days
12
ID: aws_insight_ebs_snapshot_older_than_year
2-
Title: "Snapshots older than a year"
3-
Description: "List Snapshots older than 365 days"
43
IntegrationTypeName:
5-
- aws
4+
- aws_cloud
65
Query:
76
Engine: CloudQL-v0.0.1
8-
QueryToExecute: SELECT snapshot_id, arn, start_time, account_id, og_account_id, og_resource_id FROM aws_ebs_snapshot WHERE start_time < now() - interval '1 year';
9-
PrimaryTable: aws_ebs_snapshot
107
ListOfTables:
118
- aws_ebs_snapshot
129
Parameters: []
10+
PrimaryTable: aws_ebs_snapshot
11+
QueryToExecute: SELECT snapshot_id, arn, start_time, account_id, og_account_id,
12+
og_resource_id FROM aws_ebs_snapshot WHERE start_time < now() - interval '1 year';
1313
Tags:
1414
category:
1515
- Security
1616
- Technical Debt
1717
- Cost Management
18+
Title: Snapshots older than a year

‎queries/13-aws_insight_ec2_classic_load_balancer.yaml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
1+
Description: List all Classic Load Balancer. Link here.
12
ID: aws_insight_ec2_classic_load_balancer
2-
Title: "Classic Load Balancers"
3-
Description: "List all Classic Load Balancer. Link here."
43
IntegrationTypeName:
5-
- aws
4+
- aws_cloud
65
Query:
76
Engine: CloudQL-v0.0.1
8-
QueryToExecute: SELECT name, arn, account_id, og_account_id, og_resource_id FROM aws_ec2_classic_load_balancer
9-
PrimaryTable: aws_ec2_classic_load_balancer
107
ListOfTables:
118
- aws_ec2_classic_load_balancer
129
Parameters: []
10+
PrimaryTable: aws_ec2_classic_load_balancer
11+
QueryToExecute: SELECT name, arn, account_id, og_account_id, og_resource_id FROM
12+
aws_ec2_classic_load_balancer
1313
Tags:
1414
category:
1515
- Security
@@ -19,3 +19,4 @@ Tags:
1919
- Executive
2020
- Product
2121
- FinOps
22+
Title: Classic Load Balancers

‎queries/14-aws_insight_elb_classic_lb_use_ssl_certificate.yaml‎

Lines changed: 18 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,29 @@
1+
Description: List all Load Balancers with out SSL
12
ID: aws_insight_elb_classic_lb_use_ssl_certificate
2-
Title: "Load Balancers with no SSL"
3-
Description: "List all Load Balancers with out SSL"
43
IntegrationTypeName:
5-
- aws
4+
- aws_cloud
65
Query:
76
Engine: CloudQL-v0.0.1
8-
QueryToExecute: |-
9-
with detailed_classic_listeners as (
10-
select
11-
name
12-
from
13-
aws_ec2_classic_load_balancer,
14-
jsonb_array_elements(listener_descriptions) as listener_description
15-
where
16-
listener_description -> 'Listener' ->> 'Protocol' in ('HTTPS', 'SSL', 'TLS')
17-
and listener_description -> 'Listener' ->> 'SSLCertificateId' like 'arn:aws:acm%'
18-
)
19-
select
20-
-- Required Columns
21-
'arn:' || a.partition || ':elasticloadbalancing:' || a.region || ':' || a.account_id || ':loadbalancer/' || a.name as resource,
22-
case
23-
when a.listener_descriptions is null then 'skip'
24-
when b.name is not null then 'alarm'
25-
else 'ok'
26-
end as status,
27-
case
28-
when a.listener_descriptions is null then a.title || ' has no listener.'
29-
when b.name is not null then a.title || ' does not use certificates provided by ACM.'
30-
else a.title || ' uses certificates provided by ACM.'
31-
end as reason,
32-
-- Additional Dimensions
33-
region,
34-
account_id, og_account_id, og_resource_id
35-
from
36-
aws_ec2_classic_load_balancer as a
37-
left join detailed_classic_listeners as b on a.name = b.name;
38-
PrimaryTable: aws_ec2_classic_load_balancer
397
ListOfTables:
408
- aws_ec2_classic_load_balancer
419
Parameters: []
10+
PrimaryTable: aws_ec2_classic_load_balancer
11+
QueryToExecute: "with detailed_classic_listeners as (\n select\n name\n from\n\
12+
\ aws_ec2_classic_load_balancer,\n jsonb_array_elements(listener_descriptions)\
13+
\ as listener_description\n where\n listener_description -> 'Listener' ->>\
14+
\ 'Protocol' in ('HTTPS', 'SSL', 'TLS')\n and listener_description -> 'Listener'\
15+
\ ->> 'SSLCertificateId' like 'arn:aws:acm%'\n)\nselect\n -- Required Columns\n\
16+
\ 'arn:' || a.partition || ':elasticloadbalancing:' || a.region || ':' || a.account_id\
17+
\ || ':loadbalancer/' || a.name as resource,\n case\n when a.listener_descriptions\
18+
\ is null then 'skip'\n when b.name is not null then 'alarm'\n else 'ok'\n\
19+
\ end as status,\n case\n when a.listener_descriptions is null then a.title\
20+
\ || ' has no listener.'\n when b.name is not null then a.title || ' does not\
21+
\ use certificates provided by ACM.'\n else a.title || ' uses certificates\
22+
\ provided by ACM.'\n end as reason,\n -- Additional Dimensions\n region,\n\
23+
\ account_id, og_account_id, og_resource_id\nfrom\n aws_ec2_classic_load_balancer\
24+
\ as a\n left join detailed_classic_listeners as b on a.name = b.name;"
4225
Tags:
4326
category:
4427
- Security
4528
- Technical Debt
29+
Title: Load Balancers with no SSL

‎queries/15-aws_insight_elb_application_lb_waf_enabled.yaml‎

Lines changed: 11 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,22 @@
1+
Description: List all ELB with no WAF.
12
ID: aws_insight_elb_application_lb_waf_enabled
2-
Title: "Load Balancers with no WAF"
3-
Description: "List all ELB with no WAF."
43
IntegrationTypeName:
5-
- aws
4+
- aws_cloud
65
Query:
76
Engine: CloudQL-v0.0.1
8-
QueryToExecute: |-
9-
select
10-
-- Required Columns
11-
arn as resource, account_id, og_account_id, og_resource_id,
12-
case
13-
when load_balancer_attributes @> '[{"Key":"waf.fail_open.enabled","Value":"true"}]' then 'ok'
14-
else 'alarm'
15-
end as status,
16-
case
17-
when load_balancer_attributes @> '[{"Key":"waf.fail_open.enabled","Value":"true"}]' then title || ' WAF enabled.'
18-
else title || ' WAF disabled.'
19-
end as reason,
20-
-- Additional Dimensions
21-
region
22-
from
23-
aws_ec2_application_load_balancer;
24-
PrimaryTable: aws_ec2_application_load_balancer
257
ListOfTables:
268
- aws_ec2_application_load_balancer
279
Parameters: []
10+
PrimaryTable: aws_ec2_application_load_balancer
11+
QueryToExecute: "select\n -- Required Columns\n arn as resource, account_id, og_account_id,\
12+
\ og_resource_id,\n case\n when load_balancer_attributes @> '[{\"Key\":\"\
13+
waf.fail_open.enabled\",\"Value\":\"true\"}]' then 'ok'\n else 'alarm'\n end\
14+
\ as status,\n case\n when load_balancer_attributes @> '[{\"Key\":\"waf.fail_open.enabled\"\
15+
,\"Value\":\"true\"}]' then title || ' WAF enabled.'\n else title || ' WAF\
16+
\ disabled.'\n end as reason,\n -- Additional Dimensions\n region \nfrom\n\
17+
\ aws_ec2_application_load_balancer;"
2818
Tags:
2919
category:
3020
- Security
3121
- Technical Debt
22+
Title: Load Balancers with no WAF

‎queries/16-aws_insight_vpc_with_public_cidr.yaml‎

Lines changed: 8 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,21 @@
1+
Description: List VPCs with public CIDR blocks
12
ID: aws_insight_vpc_with_public_cidr
2-
Title: "VPCs with Public IP Range"
3-
Description: "List VPCs with public CIDR blocks"
43
IntegrationTypeName:
5-
- aws
4+
- aws_cloud
65
Query:
76
Engine: CloudQL-v0.0.1
8-
QueryToExecute: |-
9-
select
10-
vpc_id,
11-
cidr_block,
12-
state,
13-
region, account_id, og_account_id, og_resource_id
14-
from
15-
aws_vpc
16-
where
17-
(not cidr_block <<= '10.0.0.0/8'
18-
and not cidr_block <<= '192.168.0.0/16'
19-
and not cidr_block <<= '172.16.0.0/12');
20-
PrimaryTable: aws_vpc
217
ListOfTables:
228
- aws_vpc
239
Parameters: []
10+
PrimaryTable: aws_vpc
11+
QueryToExecute: "select\n vpc_id,\n cidr_block,\n state,\n region, account_id,\
12+
\ og_account_id, og_resource_id\nfrom\n aws_vpc\nwhere\n (not cidr_block <<=\
13+
\ '10.0.0.0/8'\n and not cidr_block <<= '192.168.0.0/16'\n and not cidr_block\
14+
\ <<= '172.16.0.0/12');"
2415
Tags:
2516
category:
2617
- Security
2718
- Technical Debt
2819
- Resiliency
2920
- Cost Management
21+
Title: VPCs with Public IP Range

‎queries/17-azure_insight_compute_disk_unattached.yaml‎

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,17 @@
1+
Description: List of unattached Disks
12
ID: azure_insight_compute_disk_unattached
2-
Title: "Unused Azure Disks"
3-
Description: "List of unattached Disks"
43
IntegrationTypeName:
5-
- azure
4+
- azure_subscription
65
Query:
76
Engine: CloudQL-v0.0.1
8-
QueryToExecute: |-
9-
select
10-
name,
11-
disk_state, subscription_id, og_account_id, og_resource_id
12-
from
13-
azure_compute_disk
14-
where
15-
disk_state = 'Unattached';
16-
PrimaryTable: azure_compute_disk
177
ListOfTables:
188
- azure_compute_disk
199
Parameters: []
10+
PrimaryTable: azure_compute_disk
11+
QueryToExecute: "select\n name,\n disk_state, subscription_id, og_account_id,\
12+
\ og_resource_id\nfrom\n azure_compute_disk\nwhere\n disk_state = 'Unattached';"
2013
Tags:
2114
category:
2215
- Technical Debt
2316
- Cost Management
17+
Title: Unused Azure Disks

‎queries/18-azure_insight_compute_disk_unavailable_in_multiple_az.yaml‎

Lines changed: 7 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,19 @@
1+
Description: List of compute disks which are not available in multiple az
12
ID: azure_insight_compute_disk_unavailable_in_multiple_az
2-
Title: "Non-Resiliency Azure Disks"
3-
Description: "List of compute disks which are not available in multiple az"
43
IntegrationTypeName:
5-
- azure
4+
- azure_subscription
65
Query:
76
Engine: CloudQL-v0.0.1
8-
QueryToExecute: |-
9-
select
10-
name,
11-
az,
12-
region, subscription_id, og_account_id, og_resource_id
13-
from
14-
azure_compute_disk
15-
cross join jsonb_array_elements(zones) az
16-
where
17-
zones is not null;
18-
PrimaryTable: azure_compute_disk
197
ListOfTables:
208
- azure_compute_disk
219
Parameters: []
10+
PrimaryTable: azure_compute_disk
11+
QueryToExecute: "select\n name,\n az,\n region, subscription_id, og_account_id,\
12+
\ og_resource_id\nfrom\n azure_compute_disk\n cross join jsonb_array_elements(zones)\
13+
\ az\nwhere\n zones is not null;"
2214
Tags:
2315
category:
2416
- Security
2517
- Technical Debt
2618
- Resiliency
19+
Title: Non-Resiliency Azure Disks

0 commit comments

Comments
 (0)