-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathcases.csv
More file actions
We can make this file beautiful and searchable if this error is corrected: It looks like row 2 should actually have 3 columns, instead of 1 in line 1.
228 lines (228 loc) · 8.12 KB
/
Copy pathcases.csv
File metadata and controls
228 lines (228 loc) · 8.12 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
cloud,check_id,resource
# CloudSecReview - review mode cases template
#
# How to use:
# 1. Copy/edit this file, replacing the EXAMPLE resources with your own
# (run `python3 run.py scan --cloud <provider>` once to get exact
# resource identifiers from reports/scan_*/findings_<cloud>.csv).
# 2. Run review mode against ONE cloud per run (review is single-provider):
# python3 run.py review --cases cases.csv --cloud aws --profile my-readonly
# python3 run.py review --cases cases.csv --cloud azure --tenant-id ... --client-id ... --client-secret ...
# python3 run.py review --cases cases.csv --cloud gcp --project-id my-proj --service-account-file key.json
# python3 run.py review --cases cases.csv --cloud oci --oci-config ~/.oci/config --oci-profile DEFAULT --compartment <ocid>
# 3. Each case is classified FIXED / STILL_VULNERABLE / NOT_VERIFIED /
# INVALID_CHECK / ERROR and written to reports/scan_*/review.csv.
#
# Columns: cloud, check_id, resource (aliases accepted: check/control, target)
# Comment rows (lines starting with #) are ignored. Only rows with a check_id
# or resource are treated as cases.
# ---- AWS (example cases; replace resources with your own) ----
aws,AWS-IAM-001,root-account
aws,AWS-IAM-003,user:ci-bot/key:AKIASTALE98765
aws,AWS-IAM-004,user:bob
aws,AWS-S3-001,s3-buckets
aws,AWS-S3-002,s3://backups
aws,AWS-S3-004,s3://legacy-public
aws,AWS-EC2-001,sg:sg-web
aws,AWS-EC2-002,vol:02
aws,AWS-RDS-001,rds:prod-db
aws,AWS-CT-001,cloudtrail
aws,AWS-KMS-001,kms:legacy
aws,AWS-S3-005,s3-block-public
aws,AWS-VPC-001,vpc:vpc-default
aws,AWS-VPC-002,vpc:vpc-default
aws,AWS-VPC-004,default-security-group
aws,AWS-EC2-005,account-ebs
aws,AWS-EC2-006,i-01
aws,AWS-CW-003,cloudwatch-alarms
aws,AWS-CW-009,cloudwatch-alarms
aws,AWS-GD-001,guardduty
aws,AWS-SM-001,secret:legacy-api-key
aws,AWS-ACM-001,cert:arn:aws:acm:us-east-1:111122223333:cert/expiring
aws,AWS-SQS-001,https://sqs.us-east-1.amazonaws.com/111122223333/alerts
aws,AWS-DDB-001,ddb:legacy-log
aws,AWS-RSH-001,redshift:analytics
aws,AWS-EFS-001,efs:fs-legacy
aws,AWS-EC-001,elasticache:cache-legacy
aws,AWS-RDS-004,rds:stage-db
aws,AWS-ELB-001,elb:legacy-elb
aws,AWS-EKS-001,eks:legacy-eks
aws,AWS-R53-001,route53
aws,AWS-CF-001,cf:E2LEGACY
aws,AWS-ELB-003,elb:legacy-elb
aws,AWS-ELB-004,elb:legacy-elb
aws,AWS-RDS-006,rds:stage-db
aws,AWS-EKS-002,eks:legacy-eks
aws,AWS-CWG-001,loggroup:/aws/lambda/old-etl
aws,AWS-BACK-001,aws-backup
aws,AWS-SM-002,secret:legacy-api-key
aws,AWS-EC2-009,snapshot:snap-leaked
aws,AWS-IAM-007,role:delegated-role
aws,AWS-S3-006,s3://legacy-public
aws,AWS-LMB-002,lambda:old-etl
aws,AWS-DDB-003,ddb:legacy-log
# ---- Azure (example cases) ----
azure,AZ-STR-001,storage:legacystore
azure,AZ-STR-002,storage:legacystore
azure,AZ-KV-001,vault:legacy-kv
azure,AZ-NSG-001,nsg:nsg-web
azure,AZ-SQL-001,sql:legacysql
azure,AZ-VM-002,vm:vm-legacy
azure,AZ-RBAC-001,infra-admins@contoso.com
azure,AZ-MON-001,subscription-activity-log
azure,AZ-APP-001,app:legacy-app
azure,AZ-APP-002,app:legacy-app
azure,AZ-APP-006,app:legacy-app
azure,AZ-AKS-001,aks:legacy-aks
azure,AZ-SQL-004,sql:legacysql
azure,AZ-SQL-005,sql:legacysql
azure,AZ-RED-001,redis:cache-legacy
azure,AZ-VM-003,vm:vm-legacy
azure,AZ-NSG-003,nsg:nsg-dangling
azure,AZ-NET-001,bastion
azure,AZ-DEF-001,microsoft-defender
azure,AZ-COS-002,cosmos:legacy-cosmos
azure,AZ-RBAC-002,role:broad-ops
azure,AZ-RBAC-003,entra-id-guests
azure,AZ-POL-001,azure-policy
azure,AZ-APPC-001,appcfg:legacy-appcfg
azure,AZ-NET-002,ddos-protection
azure,AZ-NET-004,network-watcher
azure,AZ-KV-005,vault:legacy-kv
azure,AZ-SQL-007,sql:legacysql
azure,AZ-VM-006,vm:vm-legacy
azure,AZ-APP-007,app:legacy-app
azure,AZ-COS-003,cosmos:legacy-cosmos
azure,AZ-EVH-001,eventhubs:events-legacy
azure,AZ-SB-001,servicebus:bus-legacy
azure,AZ-LOG-001,log-analytics
azure,AZ-SEN-001,sentinel
azure,AZ-IAM-001,user:bob@contoso.com
azure,AZ-IAM-002,user:infra-admin@contoso.com
azure,AZ-IAM-003,conditional-access
# ---- GCP (example cases) ----
gcp,GCP-IAM-001,sa:svc-ci@demo-prod-gcp-123456.iam.gserviceaccount.com
gcp,GCP-IAM-002,user:admin@example.com
gcp,GCP-ST-001,gs://demo-legacy-public
gcp,GCP-ST-003,gs://demo-backups
gcp,GCP-FW-001,fw:allow-https
gcp,GCP-SQL-001,sql:legacy-db
gcp,GCP-GKE-001,gke:legacy-cluster
gcp,GCP-LOG-001,project-audit-config
gcp,GCP-IAM-004,user:vendor@partner.com
gcp,GCP-IAM-005,sa:svc-ci@demo-prod-gcp-123456.iam.gserviceaccount.com
gcp,GCP-CMP-003,instance:web-vm
gcp,GCP-NET-001,subnet:legacy-subnet
gcp,GCP-SQL-005,sql:legacy-db
gcp,GCP-GKE-004,gke:legacy-cluster
gcp,GCP-BQ-001,bq:legacy_exports
gcp,GCP-SM-001,secret:legacy-api-key
gcp,GCP-ORG-001,org-policies
gcp,GCP-LOG-003,project-audit-config
gcp,GCP-CR-001,run:public-api
gcp,GCP-MEM-001,memorystore:cache-legacy
gcp,GCP-CMP-004,instance:legacy-vm
gcp,GCP-ST-007,gs://demo-legacy-public
gcp,GCP-IAM-006,serviceAccount:svc-ci@demo-prod-gcp-123456.iam.gserviceaccount.com
# ---- OCI (example cases) ----
oci,OCI-IAM-002,user:demo.svc
oci,OCI-IAM-003,policy:Network-Admins-Policy
oci,OCI-OS-001,oci://demo-legacy-share
oci,OCI-NET-001,seclist:sl-web
oci,OCI-DB-001,adb:legacy-adb
oci,OCI-CG-001,cloud-guard
oci,OCI-IAM-004,iam-policies
oci,OCI-OS-004,oci://demo-legacy-share
oci,OCI-NET-005,lb:lb-legacy
oci,OCI-BV-002,volume:legacy-block
oci,OCI-BST-001,bastion
oci,OCI-DB-003,adb:legacy-adb
oci,OCI-FS-001,fs:fs-legacy
oci,OCI-OSMS-001,osms
oci,OCI-OS-005,oci://demo-legacy-share
oci,OCI-BV-003,volume:legacy-block
oci,OCI-NET-010,routetable:rt-legacy
oci,OCI-NET-011,nat-gateway
# ---- Tranche 3 (new checks) ----
aws,AWS-CF-006,cf:E2LEGACY
aws,AWS-CF-007,cf:E2LEGACY
aws,AWS-CF-008,cf:E2LEGACY
aws,AWS-CW-011,cloudwatch
aws,AWS-CT-006,cloudtrail
aws,AWS-CT-007,cloudtrail
aws,AWS-EC2-010,snapshot:snap-leaked
aws,AWS-EC2-011,i-03
aws,AWS-EC2-012,sg:sg-db
aws,AWS-RDS-007,rds:stage-db
aws,AWS-RDS-008,rds-snapshots
aws,AWS-LMB-003,lambda:old-etl
aws,AWS-LMB-004,lambda:old-etl
aws,AWS-S3-007,s3://legacy-public
aws,AWS-SNS-002,arn:aws:sns:us-east-1:111122223333:alerts
aws,AWS-ECR-002,ecr:legacy
aws,AWS-ECR-003,ecr:legacy
aws,AWS-SQS-003,https://sqs.us-east-1.amazonaws.com/111122223333/alerts
aws,AWS-ELB-006,elb:legacy-elb
aws,AWS-ACM-002,cert:arn:aws:acm:us-east-1:111122223333:cert/expiring
aws,AWS-R53-002,route53
aws,AWS-BACK-002,aws-backup
azure,AZ-SEN-002,sentinel
azure,AZ-POL-002,azure-policy
azure,AZ-KV-006,vault:legacy-kv
azure,AZ-SQL-008,sql:legacysql
azure,AZ-AKS-006,aks:legacy-aks
azure,AZ-LOG-002,log-analytics
azure,AZ-LOG-003,log-analytics
azure,AZ-RBAC-004,deploy-svc
azure,AZ-COS-004,cosmos:legacy-cosmos
azure,AZ-RED-002,redis:cache-legacy
azure,AZ-APP-008,app:legacy-app
azure,AZ-VM-007,vm:vm-legacy
azure,AZ-NSG-004,nsg:nsg-dangling
gcp,GCP-CR-003,run:internal-svc
gcp,GCP-CR-004,run:internal-svc
gcp,GCP-AR-001,artifact:legacy-images
gcp,GCP-AR-002,artifact:legacy-images
gcp,GCP-GKE-008,gke:legacy-cluster
gcp,GCP-GKE-009,gke:legacy-cluster
gcp,GCP-CMP-006,instance:legacy-vm
gcp,GCP-ORG-003,org-policies
gcp,GCP-SQL-006,sql:legacy-db
gcp,GCP-MEM-004,memorystore:cache-legacy
oci,OCI-OSMS-002,osms
oci,OCI-AUDIT-001,audit
oci,OCI-DB-004,adb:legacy-adb
oci,OCI-OS-006,oci://demo-legacy-share
oci,OCI-IAM-006,user:demo.svc
aws,AWS-ECS-001,cluster:prod-api-cluster
aws,AWS-ECS-002,cluster:prod-api-cluster
aws,AWS-ECS-003,cluster:prod-api-cluster
aws,AWS-IOT-001,iot:iot-prod
aws,AWS-IOT-002,iot:iot-prod
aws,AWS-SES-001,ses:example.com
aws,AWS-ELB-007,elb:web-prod-alb
aws,AWS-EFS-003,efs:fs-12345678
aws,AWS-S3-008,bucket:prod-data
aws,AWS-DDB-004,dynamodb:prod-users
aws,AWS-GD-002,guardduty:detector-main
aws,AWS-RDS-009,rds:prod-db
azure,AZ-APIM-001,apim:prod-gw
azure,AZ-APIM-002,apim:prod-gw
azure,AZ-APIM-003,apim:prod-gw
azure,AZ-AGW-001,agw:prod-appgw
azure,AZ-AGW-002,agw:prod-appgw
azure,AZ-VM-005,vm:web-01
azure,AZ-MON-002,monitor:activity-log
azure,AZ-AKS-007,aks:prod-aks
azure,AZ-STR-006,storage:proddata123
gcp,GCP-FUNC-001,function:pdf-gen
gcp,GCP-FUNC-002,function:pdf-gen
gcp,GCP-VPN-001,vpn:tunnel-eu-01
gcp,GCP-WI-001,workload-identity-pool:build-pool
gcp,GCP-NET-003,firewall:allow-lb-health
gcp,GCP-GKE-010,cluster:prod-gke
gcp,GCP-CR-005,service:api-gw
oci,OCI-NOSQL-001,table:users-table
oci,OCI-DNS-001,zone:example.com
oci,OCI-DB-005,db:prod-db
oci,OCI-DB-006,db:prod-db