ISO/IEC 27001:2022 - Information security management systems

Connectors

AWS

Expected check: eq []

AWSIAM1 {...AssetFragment}

Connectors

AWS

Expected check: eq []

{iamRoles(where:{iamPolicies_SOME: {iamPolicyStatements_SOME: {effect:"Allow",actions_INCLUDES: "*", resources_INCLUDES: "*"}}}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

iamUsers(where:{iamPolicies_SOME: {iamPolicyStatements_SOME: {effect:"Allow",actions_INCLUDES: "*", resources_INCLUDES: "*"}}}){...AssetFragment}

Connectors

AWS

Expected check: eq []

iamGroups(where:{iamPolicies_SOME: {iamPolicyStatements_SOME: {effect:"Allow",actions_INCLUDES: "*", resources_INCLUDES: "*"}}}){...AssetFragment}

Connectors

AWS

Expected check: eq []

iamUsers(where: { cloudProvider: "aws", iamPolicies_NOT: null }) {...AssetFragment}

Connectors

AWS

Expected check: eq []

iamPasswordPolicies(where:{minimumPasswordLength_LT:14}){...AssetFragment}

Connectors

AWS

Expected check: eq []

iamUsers(where:{hasIAMUserCredentials:{OR:[{accessKey1Active:true,accessKey1LastUsedDate:null}{accessKey2Active:true,accessKey2LastUsedDate: null }]}}){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSIAM4{...AssetFragment}

Connectors

AWS

Expected check: eq []

{
  AWSIAM16 {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

AWS140IAM20{...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSLogging5{...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?ConsoleLogin[\"]?\\s*\\)\\s*\\&\\&\\s*\\(\\s*\\$\\.additionalEventData\\.MFAUsed\\s*!=\\s*[\"]?Yes[\"]?\\s*\\)\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteGroupPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteRolePolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteUserPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutGroupPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutRolePolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutUserPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreatePolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeletePolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreatePolicyVersion[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeletePolicyVersion[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?AttachRolePolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DetachRolePolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?AttachUserPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DetachUserPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?AttachGroupPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DetachGroupPolicy[\"]?\\s*\\)\\s*\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?ConsoleLogin[\"]?\\s*\\)\\s*\\&\\&\\s*\\(\\s*\\$\\.errorMessage\\s*=\\s*[\"]?Failed authentication[\"]?\\s*\\)\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventSource\\s*=\\s*[\"]?kms\\.amazonaws\\.com[\"]?\\s*\\)\\s*\\&\\&\\s*\\(\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DisableKey[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?ScheduleKeyDeletion[\"]?\\s*\\)\\s*\\)\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventSource\\s*=\\s*[\"]?s3\\.amazonaws\\.com[\"]?\\s*\\)\\s*\\&\\&\\s*\\(\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutBucketAcl[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutBucketPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutBucketCors[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutBucketLifecycle[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutBucketReplication[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteBucketPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteBucketCors[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteBucketLifecycle[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteBucketReplication[\"]?\\s*\\)\\s*\\)\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventSource\\s*=\\s*[\"]?config\\.amazonaws\\.com[\"]?\\s*\\)\\s*\\&\\&\\s*\\(\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?StopConfigurationRecorder[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteDeliveryChannel[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutDeliveryChannel[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutConfigurationRecorder[\"]?\\s*\\)\\s*\\)\\s*.*"){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{iamServiceAccounts(where:{hasIAMServiceAccountKeys_SOME:{keyType: "USER_MANAGED"}}){...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

{
  iamServiceAccounts(
    where: {
      hasIAMRole_SOME: {
        OR: [
          { name: "roles/owner" }
          { name: "roles/editor" }
          { name_CONTAINS: "admin" }
        ]
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

GCP110IAM6{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPIAM5{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{
  iamUsers(
    where: {
      AND: [
        {
          hasIAMRole_SOME: {
            name: "roles/iam.serviceAccountAdmin"
          }
        }
        {
          hasIAMRole_SOME: {
            name: "roles/iam.serviceAccountUser"
          }
        }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

GCP110IAM10{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{
  iamUsers(
    where: {
      AND: [
        {
          hasIAMRole_SOME: {
            OR: [
              { name: "roles/cloudkms.admin" }
              { name: "roles/owner" }
              { name: "roles/editor" }
            ]
          }
        }
        {
          hasIAMRole_SOME: {
            OR: [
              { name: "roles/cloudkms.cryptoKeyEncrypterDecrypter" }
              { name: "roles/cloudkms.cryptoKeyEncrypter" }
              { name: "roles/cloudkms.cryptoKeyDecrypter" }
            ]
          }
        }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

vms(where: {serviceAccountEmail_CONTAINS: "[email protected]"}) {...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPVM1{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

vms(where:{hasVMMetadataItem_SOME:{key:"block-project-ssh-keys" value:"false"}}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

projects(where:{hasCommonInstanceMetadataItem_SOME:{key:"os-login",value:"false"}}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{
  projects(
    where: { NOT: { enabledServices_INCLUDES: "cloudasset.googleapis.com" } }
  ) {
    ...AssetFragment
  }
}

Connectors

Alibaba Cloud

Expected check: eq []

AlibabaIAM6 {...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

iamPasswordPolicies( where: { requireUppercaseCharacters: false}) {...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

iamPasswordPolicies( where: { requireLowercaseCharacters: false}) {...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

iamPasswordPolicies( where: { requireSymbols: false}) {...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

iamPasswordPolicies( where: { requireNumbers: false}) {...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

iamPasswordPolicies( where: { minimumPasswordLength_LT: 14}) {...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

iamPasswordPolicies( where: { maxPasswordAge_GT: 90 }) {...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

iamPasswordPolicies( where: { maxLoginAttempts_LT: 5 }) {...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

iamUsers(where: { iamPolicies_SOME: { idFromProvider_NOT: null } }) {...AssetFragment}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  iamRoles(
    where: {
      type: "CustomRole"
      permissions_INCLUDES: "*"
      assignableScopes_INCLUDES: $subscriptionResourceId
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  storageAccounts(where: { NOT: { networkRuleSetDefaultAction: "Deny" } }) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  kmsSecrets(where: { expires: "0000-01-01T00:00:00.000Z" }) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{aksClusters(where:{enableRBAC_NOT:true}){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

{
  sites(where: { authSettings: { enabled: true } }) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{sites(where:{clientCertEnabled_NOT:true}){...AssetFragment}}

Connectors

Microsoft Entra ID

Expected check: eq []

{
  connectors(
    where: {
      authorizationPolicy: {
        NOT: { guestUserRoleId: "2af84b1e-32c8-42b7-82bc-daa82404023b" }
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  sites(where: { httpsOnly: false }) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  sites(where: { siteConfig: { NOT: { minTlsVersion_IN: ["1.2", "1.3"] } } }) {
    ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

AWS130IAM19 {...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{
  loadBalancers(
    where: {OR: [
      {httpsProxies_SOME: {OR: [
        {sslPolicy: ""},
        {hasSSLPolicy: {OR: [
          {profile: "COMPATIBLE"},
          {AND: [{profile: "MODERN"}, {NOT: {minTlsVersion: "TLS_1_2"}}]},
          {AND: [
            {profile: "CUSTOM"}, 
            {OR: [
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_AES_128_GCM_SHA256"},
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_AES_256_GCM_SHA38"},
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_AES_128_CBC_SHA"},
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_AES_256_CBC_SHA"},
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_3DES_EDE_CBC_SHA"}
                ]
            }
          ]}
        ]}
        }
      ]}},
      {sslProxies_SOME: {OR: [
        {sslPolicy: ""},
        {hasSSLPolicy: {OR: [
          {profile: "COMPATIBLE"},
          {AND: [{profile: "MODERN"}, {NOT: {minTlsVersion: "TLS_1_2"}}]},
          {AND: [
            {profile: "CUSTOM"}, 
            {OR: [
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_AES_128_GCM_SHA256"},
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_AES_256_GCM_SHA38"},
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_AES_128_CBC_SHA"},
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_AES_256_CBC_SHA"},
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_3DES_EDE_CBC_SHA"}
                ]
            }
          ]}
        ]}
        }
      ]}},
    ]}){
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

disks(where:{encryptedWithCustomerSuppliedKey: false }){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{
  vms(
    where: {
      OR: [
        { shieldedInstanceConfigEnableVtpm: false }
        { shieldedInstanceConfigEnableSecureBoot: false }
        { shieldedInstanceConfigEnableIntegrityMonitoring: false }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  vms(
    where: {
      networkInterfaces_SOME: { NOT: { accessConfigs_SOME: null } }
      NOT: { name_STARTS_WITH: "gke-" }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{ cloudSqlInstances( where: { engine: "mysql" cloudProvider: "gcp" OR: [ { dbFlags_NONE: { name: "local_infile" } } { dbFlags_SOME: { name: "local_infile", value: "on" } } ] } ) { ...AssetFragment }}

Connectors

Google Cloud

Expected check: eq []

cloudSqlInstances(where:{settingsIPConfigurationRequireSsl:false}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      cloudProvider: "gcp"
      networkSettings_SOME: {
        authorizedNetworks_SOME: {
        OR: [{ cidrValue: "0.0.0.0/0" }, { cidrValue: "::/0" }]
      }
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{cloudSqlInstances(where:{instanceType:"CLOUD_SQL_INSTANCE",backendType:"SECOND_GEN",ipAddresses_SOME:{type:"PRIMARY"}}){...AssetFragment}}

Connectors

Alibaba Cloud

Expected check: eq []

buckets(where: { OR:[{encryptionKeyIDFromProvider: "" },{encryptionKeyIDFromProvider: null }, {encryptionKey:null}]}){...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

buckets(where: { OR:[{encryptionKeyIDFromProvider: "" },{encryptionKeyIDFromProvider: null }, {encryptionKey:{managementType:"ProviderManaged"}}]}){...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

AlibabaRDS2{...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

dbInstances(where: { netInfo_SOME: { ipAddress: "0.0.0.0" } }) {...AssetFragment}

Connectors

Microsoft Azure

Expected check: eq []

{
  vms(where: { diskAttachments_SOME: { NOT: { vhdURI: "" } } }) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  kmsVaults(
    where: 
    { 
      OR: [ 
        {enableSoftDelete_NOT: true } 
        {enablePurgeProtection_NOT: true } 
      ]  }
    ) {...AssetFragment}
}

Connectors

Microsoft Azure

Expected check: eq []

{
  functionApps(
    where: {
      applicationConfig: {
        settings_SOME: {
          type: "AppService"
          key_MATCHES: "(.*)(_*?)(key|pass|secret|salt|connectionstring|connection_string)(.*)"
        }
      }
    }
  ) {...AssetFragment}
}

Connectors

Microsoft Azure

Expected check: eq []

{
  sites(
    where: {
      applicationConfig: {
        settings_SOME: {
          type: "AppService"
          key_MATCHES: "(.*)(_*?)(key|pass|secret|salt|connectionstring|connection_string)(.*)"
        }
      }
    }
  ) {...AssetFragment}
}

Connectors

Google Cloud

Expected check: eq []

gkeClusters(where:{tags:null}){...AssetFragment}

Connectors

AWS

Expected check: eq []

{amis(where:{isPublic:true}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

{ dbInstances(where: {securityGroups_SOME: {rules_SOME: {direction: "Inbound", OR: [{destToPort_NOT_IN: [3306, 5432, 1521, 1433, 27017]}, {OR: [{sources_INCLUDES: "cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]}]}}}) {...AssetFragment}}

Connectors

AWS

Expected check: eq []

{vms(where:{OR:[{vpcID:null},{vpcID:""}]}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

{dbInstances(where:{publicAccessBlocked:false}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

{buckets(where:{AND:[{policyDocument_CONTAINS:"\"Effect\":\"Allow\""},{policyDocument_CONTAINS:"\"Principal\":\"*\""}]}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

{securityGroups(where: {rules_SOME: {direction: "Inbound", destFromPort_LTE: 389, destToPort_GTE: 389, OR: [{sources_INCLUDES: "cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]}}) {...AssetFragment}}

Connectors

AWS

Expected check: eq []

{ securityGroups(where: {vms_NOT: null, rules_SOME: {direction: "Inbound", AND: [{OR: [{sources_INCLUDES: "cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]}, {OR: [{destFromPort_LTE: 9200, destToPort_GTE: 9200}, {destFromPort_LTE: 9300, destToPort_GTE: 9300}]}]}}) {...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

{firewalls(where: {rules_SOME: {direction: "Inbound", destFromPort_LTE: 1521, destToPort_GTE: 1521, OR: [{sources_INCLUDES: "cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]}}) {...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

{firewalls(where: {rules_SOME: {direction: "Inbound", destFromPort_LTE: 27017, destToPort_GTE: 27017, OR: [{sources_INCLUDES: "cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]}}) {...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

{firewalls(where: {rules_SOME: {direction: "Inbound", destFromPort_LTE: 3306, destToPort_GTE: 3306, OR: [{sources_INCLUDES: "cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]}}) {...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

{firewalls(where: {rules_SOME: {direction: "Inbound", destFromPort_LTE: 5432, destToPort_GTE: 5432, OR: [{sources_INCLUDES: "cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]}}) {...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

{firewalls(where: {rules_SOME: {direction: "Inbound", destFromPort_LTE: 80, destToPort_GTE: 80, OR: [{sources_INCLUDES: "cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]}}) {...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

{firewalls(where: {rules_SOME: {direction: "Inbound", destFromPort_LTE: 0, destToPort_GTE: 65535, OR: [{sources_INCLUDES: "cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]}}) {...AssetFragment}}

Connectors

AWS

Expected check: eq []

{
  buckets(
    where: {
      cloudProvider: "aws"
      publicAccessBlocked: false
      OR: [
        {
          hasBucketACLGrant_SOME: {
            OR: [
              { granteeURI: "http://acs.amazonaws.com/groups/global/AllUsers" }
              {
                granteeURI: "http://acs.amazonaws.com/groups/global/AuthenticatedUsers"
              }
            ]
            permission_IN: ["READ", "WRITE", "WRITE_ACP", "FULL_CONTROL"]
          }
        }
        {
          bucketPolicy: {
            statements_SOME: {
              effect: "Allow"
              OR: [
                { actions_INCLUDES: "s3:GetObject" }
                { actions_INCLUDES: "s3:ListObjects" }
                { actions_INCLUDES: "s3:ListObjectsV2" }
                { actions_INCLUDES: "s3:PutObject" }
                { actions_INCLUDES: "s3:PutObjectAcl" }
                { actions_INCLUDES: "s3:CreateMultipartUpload" }
                { actions_INCLUDES: "s3:UploadPart" }
                { actions_INCLUDES: "s3:DeleteObject" }
                { actions_INCLUDES: "s3:DeleteObjects" }
                { actions_INCLUDES: "s3:*" }
                { actions_INCLUDES: "*" }
              ]
              principals_INCLUDES: "AWS|*"
            }
          }
        }
      ]
    }
  ) {...AssetFragment}
}

Connectors

Microsoft Azure

Expected check: eq []

{
  blobContainers(
    where: {
      cloudProvider: "azure"
      publicAccessBlocked: false
      publicAccess_IN: ["Blob", "Container"]
    }
  ) {...AssetFragment}
}

Connectors

Google Cloud

Expected check: eq []

{
  buckets(
    where: {
      cloudProvider: "gcp"
      publicAccessBlocked: false
        iamBindings_SOME: {
          OR: [
            { members_INCLUDES: "allUsers" }
            { members_INCLUDES: "allAuthenticatedUsers" }
          ]
          role: {
            OR: [
              { permissions_INCLUDES: "storage.objects.get" }
              { permissions_INCLUDES: "storage.objects.list" }
              { permissions_INCLUDES: "storage.objects.create" }
              { permissions_INCLUDES: "storage.objects.delete" }
              { permissions_INCLUDES: "storage.objects.update" }
              { permissions_INCLUDES: "storage.objects.*" }
              { permissions_INCLUDES: "storage.objects.setIamPolicy" }
              {
                permissions_INCLUDES: "storage.multipartUploads.create"
              }
              { permissions_INCLUDES: "storage.multipartUploads.*" }
            ]
          }
      }
    }
  ) {...AssetFragment}
}

Connectors

Alibaba Cloud

Expected check: eq []

{
  buckets(
    where: {
      cloudProvider: "alibaba"
      publicAccessBlocked: false
      OR: [
        { acl_IN: ["public-read", "public-read-write"] }
        {
          bucketPolicy: {
            statements_SOME: {
              effect: "Allow"
              OR: [
                { actions_INCLUDES: "oss:GetObject" }
                { actions_INCLUDES: "oss:PutObject" }
                { actions_INCLUDES: "oss:PutObjectAcl" }
                { actions_INCLUDES: "oss:ListObjects" }
                { actions_INCLUDES: "oss:GetObjectVersion" }
                { actions_INCLUDES: "oss:*" }
                { actions_INCLUDES: "*" }
              ]
              principals_INCLUDES: "*"
            }
          }
        }
      ]
    }
  ) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{ sqsQueues(where: { policyDocument: { statements_SOME: { AND: [ { effect: "Allow" }, { OR: [ { principals_INCLUDES: "" }, { principals_INCLUDES: "*" }, { principals_INCLUDES: "AWS|*" }, ] } ] } } }) {...AssetFragment} }

Connectors

Google Cloud

Expected check: eq []

{ pubSubSubscriptions( where: { iamBindings_SOME: { OR: [ { members_INCLUDES: "allAuthenticatedUsers" } { members_INCLUDES: "allUsers" } ] } } ) {...AssetFragment} } 

Connectors

Google Cloud

Expected check: eq []

{ pubSubTopics( where: { iamBindings_SOME: { OR: [ { members_INCLUDES: "allAuthenticatedUsers" } { members_INCLUDES: "allUsers" } ] } } ) {...AssetFragment} } 

Connectors

AWS

Expected check: eq []

buckets(where: { publicAccessBlocked: false }) {...AssetFragment}

Connectors

AWS

Expected check: eq []

{buckets( where: { trails_NOT: null publicAccessBlocked: false OR: [ { hasBucketACLGrant_SOME: { OR: [ { granteeURI: "http://acs.amazonaws.com/groups/global/AllUsers" } { granteeURI: "http://acs.amazonaws.com/groups/global/AuthenticatedUsers" } ] } } { AND: [ { policyDocument_MATCHES: ".+\"Effect\":\"Allow\".+" } { policyDocument_MATCHES: ".+\"Principal\":\"*\".+" } ] } ] } ) {...AssetFragment}}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?AuthorizeSecurityGroupIngress[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?AuthorizeSecurityGroupEgress[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?RevokeSecurityGroupIngress[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?RevokeSecurityGroupEgress[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateSecurityGroup[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteSecurityGroup[\"]?\\s*\\)\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventSource\\s*=\\s*[\"]?organizations\\.amazonaws\\.com[\"]?\\s*\\)\\s*\\&\\&\\s*\\(\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?AcceptHandshake[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?AttachPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateAccount[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateOrganizationalUnit[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreatePolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeclineHandshake[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteOrganization[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteOrganizationalUnit[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeletePolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DetachPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DisablePolicyType[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?EnablePolicyType[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?InviteAccountToOrganization[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?LeaveOrganization[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?MoveAccount[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?RemoveAccountFromOrganization[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?UpdatePolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?UpdateOrganizationalUnit[\"]?\\s*\\)\\s*\\)\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

{
  securityGroups(where: { groupName: "default", NOT: { rules_SOME: null } }) {
    ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

{AWSIAM20{...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

kmsKeys(where:{OR:[{policyDocument_CONTAINS:"allUsers"},{policyDocument_CONTAINS:"allAuthenticatedUsers"}]}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

buckets(where:{iamConfigurationUniformBucketLevelAccessEnabled:false}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{ cloudSqlInstances( where: { engine: "sqlserver" cloudProvider: "gcp" OR: [ { dbFlags_NONE: { name: "cross db ownership chaining" } } { dbFlags_SOME: { name: "cross db ownership chaining", value: "on" } } ] } ) { ...AssetFragment }}

Connectors

Google Cloud

Expected check: eq []

{ cloudSqlInstances( where: { engine: "sqlserver" cloudProvider: "gcp" OR: [ { dbFlags_NONE: { name: "contained database authentication" } } { dbFlags_SOME: { name: "contained database authentication" value: "on" } } ] } ) { ...AssetFragment }}

Connectors

Google Cloud

Expected check: eq []

bigQueryTables(where:{OR:[{policyDocument_CONTAINS:"AllUsers"},{policyDocument_CONTAINS:"allAuthenticatedUsers"}]}){...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

{buckets(where: {OR: [ {acl: "public-read"}, {acl: "public-read-write"}], trails_NOT: null}){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

{
  AzureConnectorsWithoutCustomLockRoles{
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  storageAccounts(where: { allowBlobPublicAccess: true }) {
    ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

{
  ecsTaskDefinitions(
    where: { 
      networkMode: "host", task_NOT: null, 
      OR:[
        {containerSpecs_SOME: { privileged: true }},
        {containerSpecs_SOME: { user_CONTAINS: "root" }}
     ] }
  ) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{
  ecsServices(where: {hasECSServiceNetworkConfigurations_SOME: { assignPublicIP: true}}) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{
  ecsTaskDefinitions(where: {AND: [
      {
        task_NOT: null
      },
      {
        containerSpecs_SOME: {
          privileged: true
        }
      }
    ]}) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{
  ecsTaskDefinitions(where: {task_NOT: null, containerSpecs_SOME: { readOnlyRootFS: false }}) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{
  ecsTaskDefinitions(
    where: {
      task_NOT: null,
      containerSpecs_SOME: {
        envEntries_SOME: {
          key_IN: [
            "AWS_ACCESS_KEY_ID"
            "AWS_SECRET_ACCESS_KEY"
            "ECS_ENGINE_AUTH_DATA"
          ]
        }
      }
    }
  ) {...AssetFragment}
}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      cloudProvider: "gcp"
      ipAddresses_SOME: { NOT: { type: "PRIVATE" } }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

{AWSIAM8{...AssetFragment}}

Connectors

AWS

Expected check: eq []

{iamRoles(where:{hasIAMAssumeRolePolicyStatement_SOME:{hasIAMAssumeRolePolicyPrincipal_SOME:{value:"*"}}}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

{AWSIAM21{...AssetFragment}}

Connectors

AWS

Expected check: eq []

AWSIAM13{...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSIAM14{...AssetFragment}

Connectors

AWS

Expected check: eq []

iamPasswordPolicies(where:{passwordReusePrevention_LT:24}){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWS130IAM13 {...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

iamPolicies(where: { policyType: "Custom", iamPolicyStatements_SOME: { effect: "Allow", actions_INCLUDES: "*" } }) {...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{
cloudSqlInstances(
   where: {
      engine: "mysql"
      cloudProvider: "gcp"
      OR: [
        { dbFlags_NONE: { name: "skip_show_database" } }
        { dbFlags_SOME: { name: "skip_show_database", value: "off" } }
      ]
    }
  ) {
     ...AssetFragment
  }}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      engine: "sqlserver"
      cloudProvider: "gcp"
      dbFlags_SOME: { name: "user options" }
    }
  ) {
     ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

{snsTopics(where:{hasSNSTopicAttribute_NONE:{key:"KmsMasterKeyId",OR:[{value_NOT:null},{value_NOT:""}]}}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

{vms(where:{diskAttachments_SOME:{disk:{encrypted:false}},OR:[{name_MATCHES:"(?i).*database.*"},{name_MATCHES:"(?i).*db.*"},{name_MATCHES:"(?i).*mariadb.*"},{name_MATCHES:"(?i).*postgres.*"},{name_MATCHES:"(?i).*oracle.*"},{name_MATCHES:"(?i).*sql.*"}]}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

{kinesisDataStreams(where:{encryptionType:"NONE"}){...AssetFragment}}

Connectors

Alibaba CloudAWSGoogle CloudMicrosoft Azure

Expected check: eq []

{ objectContainers (where: {versioningEnabled: false}) {...AssetFragment} } 

Connectors

AWS

Expected check: eq []

{buckets(where:{bucketVersioningMFADelete:false}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

{buckets(where:{hasBucketACLGrant_SOME: {granteeType_NOT:"CanonicalUser"}}){...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

{GCPNetworking7{...AssetFragment}}

Connectors

AWS

Expected check: eq []

{
  rootUsers(
    where: {
      hasIAMUserCredentials: {
        OR: [{ accessKey1Active: true }, { accessKey2Active: true }]
      }
    }
  ) {
    connector {...AssetFragment}
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  iamUsers(
    where: {
      hasIAMRole_SOME: {
        name_IN: ["roles/viewer", "roles/editor", "roles/owner"]
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Alibaba Cloud

Expected check: eq []

AlibabaIAM1{...AssetFragment}

Connectors

Microsoft Entra ID

Expected check: eq []

{
  connectors(
    where: {
      authorizationPolicy: {
        NOT: { allowInvitesFrom: "adminsAndGuestInviters" }
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: {
      OR: [
        { securityContacts_SOME: null }
        { securityContacts_SOME: { email: null } }
        { securityContacts_SOME: { email: "" } }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: {
      OR: [
        { securityContacts_SOME: null }
        { securityContacts_SOME: { notificationByRoleState: "Off" } }
        {
          NOT: {
            securityContacts_SOME: { notificationRoles_INCLUDES: "Owner" }
          }
        }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

{
  ecsTaskDefinitions(where:  {pidMode_MATCHES: "host", task_NOT: null}) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\$\\.userIdentity\\.type\\s*=\\s*[\"]?Root[\"]?\\s*\\&\\&\\s*\\s*\\$\\.userIdentity\\.invokedBy\\s*NOT\\s*EXISTS\\s*\\&\\&\\s*\\$\\.eventType\\s*!=\\s*[\"]?AwsServiceEvent\\s*[\"]?\\s*.*"){...AssetFragment}

Connectors

Microsoft Azure

Expected check: eq []

{sqlServers(where:{firewallRules_SOME:{startIpAddress_CONTAINS:"0.0.0.0"}}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

iamUsers(where:{hasIAMUserCredentials:{passwordEnabled:true,mfaActive:false}}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{
  iamUsers(where: { NOT: { user: { isEnrolledIn2Sv: true } } }) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  users(where: { mfaActive: false, NOT: { iamRoleAssignments_SOME: null } }) {
    ...AssetFragment
  }
}

Connectors

Alibaba Cloud

Expected check: eq []

iamUsers(where:{hasIAMUserLoginProfile_SOME:{mfaBindRequired:false}}){...AssetFragment}

Connectors

Microsoft Entra ID

Expected check: eq []

{
  users(where: { mfaActive: false }) {
    ...AssetFragment
  }
}

Connectors

Okta

Expected check: eq []

oktaPolicies(where: { type: "MFA_ENROLL", OR:[{allowedFactors_INCLUDES: "phone_number"}, {allowedFactors_INCLUDES: "security_question"}, {allowedFactors_INCLUDES: "okta_email"}]}) {...AssetFragment}

Connectors

Okta

Expected check: eq []

passwordPolicies(where: { OR:[{minLength_LT: 14}, {minLowerCase_LT: 1}, {minUpperCase_LT: 1}, {minNumber_LT: 1}, {minSymbol_LT: 1}, {reuseCount_LT: 1}]}) {...AssetFragment}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { pricing_SOME: { name: "VirtualMachines", pricingTier: "Free" } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { pricing_SOME: { name: "AppServices", pricingTier: "Free" } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { pricing_SOME: { name: "SqlServers", pricingTier: "Free" } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: {
      pricing_SOME: { name: "SqlServerVirtualMachines", pricingTier: "Free" }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: {
      pricing_SOME: {
        name: "OpenSourceRelationalDatabases"
        pricingTier: "Free"
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { pricing_SOME: { name: "StorageAccounts", pricingTier: "Free" } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { pricing_SOME: { name: "CosmosDbs", pricingTier: "Free" } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { pricing_SOME: { name: "KeyVaults", pricingTier: "Free" } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { pricing_SOME: { name: "Dns", pricingTier: "Free" } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { pricing_SOME: { name: "Arm", pricingTier: "Free" } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { dataExportSettings_SOME: { name: "WDATP", enabled: false } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { dataExportSettings_SOME: { name: "MCAS", enabled: false } }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      engine: "sqlserver"
      cloudProvider: "gcp"
      dbFlags_SOME: { name: "external scripts enabled",value: "on" }
    }
  ) {
     ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

{vms(where:{inspectorEnabled:false}){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: {
      OR: [
        { securityContacts_SOME: null }
        { securityContacts_SOME: { alertNotifications: false } }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

cloudSqlInstances(where:{settingsBackupConfigurationEnabled:false}){...AssetFragment}

Connectors

Microsoft Azure

Expected check: eq []

{
  storageAccounts(
    where: {
      OR: [
        { blobServiceDeletePolicyEnabled: false }
        { blobServiceDeletePolicyDays: 0 }
        { containerDeleteRetentionPolicyEnabled: false }
        { containerDeleteRetentionPolicyDays: 0 }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

{
  AWSLogging1 {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

trails(where:{logFileValidationEnabled:false}){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSLogging4{...AssetFragment}

Connectors

AWS

Expected check: eq []

{buckets(where:{trails_NOT: null, loggingEnabled:false}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

trails(where:{kmsKeyID:""}){...AssetFragment}

Connectors

AWS

Expected check: eq []

kmsKeys(where:{automaticRotationEnabled:false, managementType:"CustomerManaged"}){...AssetFragment}

Connectors

AWS

Expected check: eq []

vpcs(where: {OR: [{hasFlowLog: null}, {hasFlowLog_NONE: {flowLogStatus: "ACTIVE"}}]}){...AssetFragment}

Connectors

AWS

Expected check: eq []

{buckets( where: { OR: [ { trailEventSelectorDataResources_ALL: { eventSelector: { NOT: { readWriteType_IN: ["All", "WriteOnly"] } } } } { trailEventSelectorDataResources_SOME: null } ] } ) {...AssetFragment}}

Connectors

AWS

Expected check: eq []

{buckets( where: { OR: [ { trailEventSelectorDataResources_ALL: { eventSelector: { NOT: { readWriteType_IN: ["All", "ReadOnly"] } } } } { trailEventSelectorDataResources_SOME: null } ] } ) {...AssetFragment}}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateTrail[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?UpdateTrail[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteTrail[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?StartLogging[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?StopLogging[\"]?\\s*\\)\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateCustomerGateway[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteCustomerGateway[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?AttachInternetGateway[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateInternetGateway[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteInternetGateway[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DetachInternetGateway[\"]?\\s*\\)\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateRoute[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateRouteTable[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?ReplaceRoute[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?ReplaceRouteTableAssociation[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteRouteTable[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteRoute[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DisassociateRouteTable[\"]?\\s*\\)\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

{loadBalancers(where:{type:"application",hasLoadBalancerAttribute_NONE:{key:"access_logs.s3.enabled",value:"true"}}){...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

GCPLogging1{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPLogging2{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

logBuckets(where:{locked:false}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPLogging4{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPLogging5{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPLogging6{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPLogging7{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPLogging8{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPLogging9{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPLogging10{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPLogging11{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

vpcs(where:{hasSubnetwork_SOME:{enableFlowLogs:false}}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{ cloudSqlInstances( where: { engine: "postgresql" cloudProvider: "gcp" OR: [ { dbFlags_NONE: { name: "log_connections" } } { dbFlags_SOME: { name: "log_connections", value: "off" } } ] } ) { ...AssetFragment }}

Connectors

Google Cloud

Expected check: eq []

{ cloudSqlInstances( where: { engine: "postgresql" cloudProvider: "gcp" OR: [ { dbFlags_NONE: { name: "log_disconnections" } } { dbFlags_SOME: { name: "log_disconnections", value: "off" } } ] } ) { ...AssetFragment }}

Connectors

Google Cloud

Expected check: eq []

{ cloudSqlInstances( where: { engine: "postgresql" cloudProvider: "gcp" dbFlags_SOME: { name: "log_min_duration_statement", NOT: { value: "-1" } } } ) { ...AssetFragment }}

Connectors

Alibaba Cloud

Expected check: eq []

buckets(where:{ loggingEnabled: false }){...AssetFragment}

Connectors

Microsoft Azure

Expected check: eq []

{
  storageAccounts(
    where: {
      OR: [
        { isQueueServicesDiagnosticsSettingsEnabled: false }
        {
          AND: [
            {
              diagnosticSettings_NONE: {
                resourceType: "Microsoft.Storage/storageAccounts/queueServices"
                AND: [
                  { logs_SINGLE: { enabled: true, category: "StorageRead" } }
                  { logs_SINGLE: { enabled: true, category: "StorageWrite" } }
                  { logs_SINGLE: { enabled: true, category: "StorageDelete" } }
                ]
              }
            }
            {
              diagnosticSettings_NONE: {
                resourceType: "Microsoft.Storage/storageAccounts/queueServices"
                logs_SOME: {
                  enabled: true
                  categoryGroup_IN: ["audit", "allLogs"]
                }
              }
            }
          ]
        }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  storageAccounts(
    where: {
      OR: [
        { isBlobServicesDiagnosticsSettingsEnabled: false }
        {
          AND: [
            {
              diagnosticSettings_NONE: {
                resourceType: "Microsoft.Storage/storageAccounts/blobServices"
                AND: [
                  { logs_SINGLE: { enabled: true, category: "StorageRead" } }
                  { logs_SINGLE: { enabled: true, category: "StorageWrite" } }
                  { logs_SINGLE: { enabled: true, category: "StorageDelete" } }
                ]
              }
            }
            {
              diagnosticSettings_NONE: {
                resourceType: "Microsoft.Storage/storageAccounts/blobServices"
                logs_SOME: {
                  enabled: true
                  categoryGroup_IN: ["audit", "allLogs"]
                }
              }
            }
          ]
        }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  sqlServers(where: { blobAuditingPolicies_NONE: { state: "Enabled" } }) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  sqlServers(
    where: {
      blobAuditingPolicies_NONE: {
        state: "Enabled"
        OR: [{ retentionDays: 0 }, { retentionDays_GT: 90 }]
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{postgreSqlServers(where:{configurations_NONE:{name:"log_checkpoints",value_MATCHES:"(?i)on"}},){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

{
  postgreSqlServers(
    where: {
      configurations_SOME: { name: "log_connections", value_MATCHES: "(?i)off" }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  postgreSqlServers(
    where: {
      configurations_SOME: {
        name: "log_disconnections"
        value_MATCHES: "(?i)off"
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{postgreSqlServers(where:{configurations_NONE:{name:"connection_throttling", value_MATCHES:"(?i)on"}}){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

{postgreSqlServers(where:{configurations_SOME:{name:"log_retention_days", value_MATCHES:"[0-3]"}}){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

{subscriptionDiagnosticSettings(where:{logSettings_SOME:{category_IN:["Administrative","Alert","Policy","Security"],enabled:false}},){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

{
  kmsVaults(
    where: {
      OR: [
        { loggingEnabled: false }
        {
          diagnosticSettings_SOME: {
            resourceType: "Microsoft.KeyVault/vaults"
            logs_SOME: {
              enabled: false
              categoryGroup_IN: ["audit", "allLogs"]
            }
          }
        }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals:"microsoft.authorization/policyassignments/write"){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals:"microsoft.authorization/policyassignments/delete"){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals:"microsoft.network/networksecuritygroups/write"){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals:"microsoft.network/networksecuritygroups/delete"){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals:"microsoft.security/securitysolutions/write"){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals:"microsoft.security/securitysolutions/delete"){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals:"microsoft.sql/servers/firewallrules/write"){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals:"microsoft.sql/servers/firewallrules/delete"){...AssetFragment}}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.errorCode\\s*=\\s*[\"]?\\*UnauthorizedOperation[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.errorCode\\s*=\\s*[\"]?AccessDenied\\*[\"]?\\s*\\)\\s*.*"){...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

{
  iamAccountSummaries(
    where: {
      hasIAMAccountSummaryItem_SOME: { key: "antiDDoSHasLogStore", value: 1 }
    }
  ) {
    connector {...AssetFragment}
  }
}

Connectors

Alibaba Cloud

Expected check: eq []

domains(where: { OR: [ {slsLogActive: false}, {wafActive: false} ] }) {...AssetFragment}

Connectors

AWS

Expected check: eq []

{
  ecsClusters(where: {hasECSSettings_NONE: {
      key: "containerInsights",
      value: "enabled"  
    }}) {...AssetFragment}
}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      engine: "postgresql"
      cloudProvider: "gcp"
      dbFlags_SOME: { name: "log_error_verbosity", value: "verbose" }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      engine: "postgresql"
      cloudProvider: "gcp"
      dbFlags_NONE: { name: "log_statement" }
    }
  ) {
     ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      engine: "postgresql"
      cloudProvider: "gcp"
      dbFlags_SOME: { name: "log_min_error_statement", NOT: {value_IN: ["error", "log", "fatal", "panic"]} }
    }
  ) {
     ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      engine: "postgresql"
      cloudProvider: "gcp"
      OR: [{ dbFlags_NONE: { name: "cloudsql.enable_pgaudit" }}, {dbFlags_SOME: {name: "cloudsql.enable_pgaudit", value: "off"}}]
     
    }
  ) {
     ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      engine: "sqlserver"
      cloudProvider: "gcp"
      OR: [{ dbFlags_NONE: { name: "3625" }}, {dbFlags_SOME: {name: "3625", value: "off"}}]
     
    }
  ) {
     ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  vpcs(where: { dnsPolicy_NONE: { NOT: { enableLogging_IN: ["true"] } } }) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  loadBalancers(
    where: { backendServices_ALL: { NOT: { logConfigEnabled: true } } }
  ) {
    ...AssetFragment
  }
}

Connectors

Alibaba Cloud

Expected check: eq []

{ dbInstances( where: { AND: [ { publicAccessBlocked: false } { whitelist: { rules_SOME: { sources_INCLUDES: "cidr:0.0.0.0/0" } } } { OR: [ { tlsStatus: "disabled" } { tlsMinimumVersion_LT: 1.2 } ] } ] } ) {...AssetFragment} } 

Connectors

AWS

Expected check: eq []

{ dbInstances( where: { AND: [ { publicAccessBlocked: false } { securityGroups_SOME: { rules_SOME: { sources_INCLUDES: "cidr:0.0.0.0/0" } } } { OR: [ { tlsStatus: "" } { tlsStatus: "disabled" } { tlsMinimumVersion_LT: 1.2 } ] } ] } ) {...AssetFragment} } 

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      AND: [
        { publicAccessBlocked: false }
        {
          ipAddresses_SOME: { type: "PRIMARY" }
          networkSettings_SOME: {
            authorizedNetworks_SOME: { cidrValue: "0.0.0.0/0" }
          }
        }
        {
          OR: [
            { tlsStatus: "" }
            { tlsStatus: "disabled" }
            { tlsMinimumVersion_LT: 1.2 }
          ]
        }
      ]
    }
  ) {
    ...AssetFragment
  }
} 

Connectors

Microsoft Azure

Expected check: eq []

{ mySqlServers( where: { AND: [ { publicAccessBlocked: false } { firewallRules_SOME: { startIPAddress: "0.0.0.0" endIPAddress: "255.255.255.255" } } { OR: [ { tlsStatus: "disabled" } { tlsMinimumVersion_LT: 1.2 } ] } ] } ) {...AssetFragment} } 

Connectors

Microsoft Azure

Expected check: eq []

{ mySqlFlexibleServers( where: { AND: [ { publicAccessBlocked: false } { firewallRules_SOME: { startIPAddress: "0.0.0.0" endIPAddress: "255.255.255.255" } } { OR: [ { tlsStatus: "disabled" } { tlsMinimumVersion_LT: 1.2 } ] } ] } ) {...AssetFragment} } 

Connectors

Microsoft Azure

Expected check: eq []

{ postgreSqlServers( where: { AND: [ { publicAccessBlocked: false } { firewallRules_SOME: { startIPAddress: "0.0.0.0" endIPAddress: "255.255.255.255" } } { OR: [ { tlsStatus: "disabled" } { tlsMinimumVersion_LT: 1.2 } ] } ] } ) {...AssetFragment} }

Connectors

Microsoft Azure

Expected check: eq []

{ postgreSqlFlexibleServers( where: { AND: [ { publicAccessBlocked: false } { firewallRules_SOME: { startIPAddress: "0.0.0.0" endIPAddress: "255.255.255.255" } } { OR: [ { tlsStatus: "disabled" } { tlsMinimumVersion_LT: 1.2 } ] } ] } ) {...AssetFragment} } 

Connectors

Microsoft Azure

Expected check: eq []

{
  mariaDbServers (
    where: {
      AND: [
        { publicAccessBlocked: false }
        {
          firewallRules_SOME: {
            startIPAddress: "0.0.0.0"
            endIPAddress: "255.255.255.255"
          }
        }
        { OR: [{ tlsStatus: "disabled" }, { tlsMinimumVersion_LT: 1.2 }] }
      ]
    }
  ) {...AssetFragment}
}

Connectors

Microsoft Azure

Expected check: eq []

{
  sqlDatabases(
    where: {
      AND: [
        { publicAccessBlocked: false }
        {
          sqlServer: {
            firewallRules_SOME: {
              startIpAddress: "0.0.0.0"
              endIpAddress: "255.255.255.255"
            }
          }
        }
        { OR: [{ tlsStatus: "disabled" }, { tlsMinimumVersion_LT: 1.2 }] }
      ]
    }
  ) {...AssetFragment}
}

Connectors

Alibaba CloudAWSMicrosoft Azure

Expected check: eq []

{
  securityGroups(
    where: {
      rules_SOME: {
        direction: "Inbound"
        action: "Allow"
        AND: [
          {
            OR: [
              { sources_INCLUDES: "cidr:0.0.0.0/0" }
              { sources_INCLUDES: "cidr:::/0" }
              { sources_INCLUDES: "tag:Internet" }
              { sources: [] }
            ]
          }
          { 
            OR: [
                { destFromPort_LTE: 22, destToPort_GTE: 22 }
                { destFromPort_LTE: 3389, destToPort_GTE: 3389 }
              ]
          }
        ]
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  firewalls(
    where: {
      rules_SOME: {
        direction: "Inbound"
        AND: [
          {
            OR: [
              { sources_INCLUDES: "cidr:0.0.0.0/0" }
              { sources_INCLUDES: "cidr:::/0" }
              { sources: [] }
            ]
          }
          {
            OR: [
              { destFromPort_LTE: 22, destToPort_GTE: 22 }
              { destFromPort_LTE: 3389, destToPort_GTE: 3389 }
            ]
          }
        ]
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      ipAddresses_SOME: { type: "PRIMARY" }
      networkSettings_SOME: {
        authorizedNetworks_SOME: { cidrValue: "0.0.0.0/0" }
      }
    }
  ) {
    ...AssetFragment
  }
} 

Connectors

Microsoft Azure

Expected check: eq []

{ mySqlServers( where: { publicAccessBlocked: false firewallRules_SOME: { startIPAddress: "0.0.0.0" endIPAddress: "255.255.255.255" } } ) {...AssetFragment} } 

Connectors

Microsoft Azure

Expected check: eq []

{ mySqlFlexibleServers( where: { publicAccessBlocked: false firewallRules_SOME: { startIPAddress: "0.0.0.0" endIPAddress: "255.255.255.255" } } ) {...AssetFragment} } 

Connectors

Microsoft Azure

Expected check: eq []

{ postgreSqlServers( where: { publicAccessBlocked: false firewallRules_SOME: { startIPAddress: "0.0.0.0" endIPAddress: "255.255.255.255" } } ) {...AssetFragment} } 

Connectors

Microsoft Azure

Expected check: eq []

{ postgreSqlFlexibleServers( where: { publicAccessBlocked: false firewallRules_SOME: { startIPAddress: "0.0.0.0" endIPAddress: "255.255.255.255" } } ) {...AssetFragment} } 

Connectors

Alibaba Cloud

Expected check: eq []

{ dbInstances( where: { publicAccessBlocked: false whitelist: { rules_SOME: { sources_INCLUDES: "cidr:0.0.0.0/0" } } } ) {...AssetFragment} } 

Connectors

Microsoft Azure

Expected check: eq []

{
  sqlDatabases(
    where: {
      sqlServer: {
        firewallRules_SOME: {
          startIpAddress: "0.0.0.0"
          endIpAddress: "255.255.255.255"
        }
      }
    }
  ) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{
  dbClusters(
    where: {
      dbInstances_SOME: {
        publicAccessBlocked: false
        securityGroups_SOME: {
          rules_SOME: {
            direction: "Inbound"
            OR: [
              { sources_INCLUDES: "cidr:0.0.0.0/0" }
              { sources_INCLUDES: "cidr:::/0" }
            ]
          }
        }
      }
    }
  ) {...AssetFragment}
}

Connectors

Microsoft Azure

Expected check: eq []

{
  mariaDbServers(
    where: {
      publicAccessBlocked: false
      firewallRules_SOME: {
        startIPAddress: "0.0.0.0"
        endIPAddress: "255.255.255.255"
      }
    }
  ) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{
  dbInstances(
    where: {
      publicAccessBlocked: false
      dbCluster: null
      securityGroups_SOME: {
        rules_SOME: {
          direction: "Inbound"
          OR: [
            { sources_INCLUDES: "cidr:0.0.0.0/0" }
            { sources_INCLUDES: "cidr:::/0" }
          ]
        }
      }
    }
  ) {...AssetFragment}
}

Connectors

Alibaba CloudAWS

Expected check: eq []

{
  vms(
    where: {
      publicIpAddress_NOT: null
      securityGroups_SOME: {
        rules_SOME: {
          direction: "Inbound"
          action: "Allow"
          AND: [
            {
              OR: [
                { sources_INCLUDES: "cidr:0.0.0.0/0" }
                { sources_INCLUDES: "cidr:::/0" }
              ]
            }
            {
              OR: [
                { destFromPort_LTE: 22, destToPort_GTE: 22 }
                { destFromPort_LTE: 3389, destToPort_GTE: 3389 }
              ]
            }
          ]
        }
      }
    }
  ) {
    diskAttachments {
      disk {...AssetFragment}
    }
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  vms(
    where: {
      networkInterfaces_SOME: {
        publicIp_NOT: null
        securityGroups_SOME: {
          rules_SOME: {
            direction: "Inbound"
            action: "Allow"
            AND: [
              {
                OR: [
                  { sources_INCLUDES: "cidr:0.0.0.0/0" }
                  { sources_INCLUDES: "cidr:::/0" }
                  { sources_INCLUDES: "tag:Internet" }
                  { sources: [] }
                ]
              }
              {
                OR: [
                  { destFromPort_LTE: 22, destToPort_GTE: 22 }
                  { destFromPort_LTE: 3389, destToPort_GTE: 3389 }
                ]
              }
            ]
          }
        }
      }
    }
  ) {
    diskAttachments {
      disk {...AssetFragment}
    }
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  vms(
    where: {
      networkInterfaces_SOME: { NOT: { accessConfigs_SOME: null } }
      NOT: { name_STARTS_WITH: "gke-" }
      firewalls_SOME: {
        rules_SOME: {
          direction: "Inbound"
          AND: [
            {
              OR: [
                { sources_INCLUDES: "cidr:0.0.0.0/0" }
                { sources_INCLUDES: "cidr:::/0" }
              ]
            }
            {
              OR: [
                { destFromPort_LTE: 22, destToPort_GTE: 22 }
                { destFromPort_LTE: 3389, destToPort_GTE: 3389 }
              ]
            }
          ]
        }
      }
    }
  ) {
    diskAttachments {
      disk {
        ...AssetFragment
      }
    }
  }
}

Connectors

AWS

Expected check: eq []

buckets(where: {OR: [{policyDocument_MATCHES: "^((?!(?i)\"effect\":\"deny\").)*$"},{policyDocument_MATCHES: "^((?!(?i)\"Bool|aws:SecureTransport|false\").)*$"}]}) {...AssetFragment}

Connectors

AWS

Expected check: eq []

networkAcls(where:{rules_SOME:{AND:[{direction:"Inbound"},{action:"Allow"},{OR:[{sources_INCLUDES:"cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]},{OR:[{destFromPort_LTE: 22, destToPort_GTE: 22}, {destFromPort_LTE: 3389, destToPort_GTE: 3389}]}]}}){...AssetFragment}

Connectors

AWS

Expected check: eq []

{loadBalancers(where:{type:"application",listensOnHTTPListener_NONE:{hasCertificate:true}}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

{loadBalancers(where:{type:"network",listensOnHTTPListener_NONE:{hasCertificate:true}}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

{loadBalancers( where: { scheme: "internet-facing", listensOnHTTPListener_SOME: { sslPolicy_IN: ["ELBSecurityPolicy-2016-08", "ELBSecurityPolicy-TLS-1-0-2015-04", "ELBSecurityPolicy-TLS-1-1-2017-01", "ELBSecurityPolicy-TLS13-1-0-2021-06", "ELBSecurityPolicy-TLS13-1-1-2021-06", "ELBSecurityPolicy-FS-1-1-2019-08", "ELBSecurityPolicy-FS-2018-06", "ELBSecurityPolicy-2015-05", "ELBSecurityPolicy-2015-03", "ELBSecurityPolicy-2015-02"] } } ) {...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

{
  storageAccounts(where: { NOT: { supportsHttpsTrafficOnly: true } }) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{postgreSqlServers(where:{firewallRules_SOME:,{OR:[{name_MATCHES:"(?i)allowallwindowsazureips"},{name_MATCHES:"(?i)allowallazureips"},{AND:[{startIPAddress:"0.0.0.0"},{endIPAddress:"0.0.0.0"}]}]}}){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

{
  postgreSqlFlexibleServers (where: {
      firewallRules_SOME: {
        OR: [
          { name_MATCHES: "(?i)allowallwindowsazureips" }
          { name_MATCHES: "(?i)allowallazureips" }
          { AND: [{ startIPAddress: "0.0.0.0" }, { endIPAddress: "0.0.0.0" }] }
        ]
      }
    }) {...AssetFragment}
}

Connectors

Microsoft Azure

Expected check: eq []

{
  sites(where: { siteConfig: { http20Enabled: false } }) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  appEngineServices(
    where: {
      serviceVersions_NONE: {
        urlHandlers_SOME: {
          urlRegex_IN: ["/.*", ".*"]
          securityLevel_IN: ["SECURE_ALWAYS"]
        }
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

vms(where:{hasVMMetadataItem_SOME:{key:"serial-port-enable",value:"true"}}){...AssetFragment}

Connectors

Microsoft Azure

Expected check: eq []

{
  storageAccounts(
    where: {
      OR: [
        { AND: [{ networkRuleSetDefaultAction_CONTAINS: "Allow" }] }
        {
          AND: [
            { networkRuleSetDefaultAction_CONTAINS: "Deny" }
            { NOT: { networkRuleSetBypass_CONTAINS: "AzureServices" } }
          ]
        }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  securityGroups(
    where: {
      rules_SOME: {
        direction: "Inbound"
        action: "Allow"
        protocol: "UDP"
        AND: [
          {
            OR: [
              { sources_INCLUDES: "cidr:0.0.0.0/0" }
              { sources_INCLUDES: "cidr:::/0" }
              { sources_INCLUDES: "tag:Internet" }
              { sources: [] }
            ]
          }
          {
            OR: [
              { destFromPort_LTE: 53, destToPort_GTE: 53 }
              { destFromPort_LTE: 123, destToPort_GTE: 123 }
              { destFromPort_LTE: 161, destToPort_GTE: 161 }
              { destFromPort_LTE: 389, destToPort_GTE: 389 }
              { destFromPort_LTE: 1900, destToPort_GTE: 1900 }
            ]
          }
        ]
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

buckets(where: { encrypted: false}) {...AssetFragment}

Connectors

AWS

Expected check: eq []

{ebsSettings(where: { encryptedByDefault: false }) {...AssetFragment}}

Connectors

AWS

Expected check: eq []

{dbInstances(where:{encrypted:false}){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

{ mySqlServers (where: {encrypted: false}) {...AssetFragment} }

Connectors

Microsoft Azure

Expected check: eq []

{ mySqlFlexibleServers (where: {encrypted: false}) {...AssetFragment} }

Connectors

Microsoft Azure

Expected check: eq []

{ postgreSqlServers (where: {encrypted: false}) {...AssetFragment} }

Connectors

Microsoft Azure

Expected check: eq []

{ postgreSqlFlexibleServers (where: {encrypted: false}) {...AssetFragment} }

Connectors

AWS

Expected check: eq []

{ dbInstances (where: { cloudProvider: "aws" encrypted: false }) {...AssetFragment} }

Connectors

Alibaba Cloud

Expected check: eq []

{ dbInstances (where: { cloudProvider: "alibaba", encrypted: false }) {...AssetFragment} }

Connectors

Google Cloud

Expected check: eq []

{ cloudSqlInstances (where: { encrypted: false }) {...AssetFragment} }

Connectors

Microsoft Azure

Expected check: eq []

{
  mariaDbServers(where: { encrypted: false }) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{kmsKeys( where: { OR: [ { AND: {policyDocument_MATCHES: ".*arn:aws:iam::[0-9*]+:root.*", managementType: "CustomerManaged"} } { keyPolicy: { statements_SOME: { effect: "Allow" conditions: [] principals_INCLUDES: "AWS|*" } } } ] } ) {...AssetFragment}}