NIST 800-53 - NIST Special Publication 800-53

Connectors

Alibaba CloudAWSMicrosoft Azure

Expected check: eq []

{
  securityGroups(
    where: {
      rules_SOME: {
        direction: "Inbound"
        action: "Allow"
        AND: [
          {
            OR: [
              { sources_INCLUDES: "cidr:0.0.0.0/0" }
              { sources_INCLUDES: "cidr:::/0" }
              { sources_INCLUDES: "tag:Internet" }
              { sources: [] }
            ]
          }
          { 
            OR: [
                { destFromPort_LTE: 22, destToPort_GTE: 22 }
                { destFromPort_LTE: 3389, destToPort_GTE: 3389 }
              ]
          }
        ]
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  firewalls(
    where: {
      rules_SOME: {
        direction: "Inbound"
        AND: [
          {
            OR: [
              { sources_INCLUDES: "cidr:0.0.0.0/0" }
              { sources_INCLUDES: "cidr:::/0" }
              { sources: [] }
            ]
          }
          {
            OR: [
              { destFromPort_LTE: 22, destToPort_GTE: 22 }
              { destFromPort_LTE: 3389, destToPort_GTE: 3389 }
            ]
          }
        ]
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

AWSIAM1 {...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSIAM3(days: 45){...AssetFragment}

Connectors

AWS

Expected check: eq []

{
  rootUsers(
    where: {
      hasIAMUserCredentials: {
        OR: [{ accessKey1Active: true }, { accessKey2Active: true }]
      }
    }
  ) {
    connector {...AssetFragment}
  }
}

Connectors

AWS

Expected check: eq []

{
  AWSIAM16 {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{buckets( where: { trails_NOT: null publicAccessBlocked: false OR: [ { hasBucketACLGrant_SOME: { OR: [ { granteeURI: "http://acs.amazonaws.com/groups/global/AllUsers" } { granteeURI: "http://acs.amazonaws.com/groups/global/AuthenticatedUsers" } ] } } { AND: [ { policyDocument_MATCHES: ".+\"Effect\":\"Allow\".+" } { policyDocument_MATCHES: ".+\"Principal\":\"*\".+" } ] } ] } ) {...AssetFragment}}

Connectors

AWS

Expected check: eq []

{buckets(where:{trails_NOT: null, loggingEnabled:false}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.errorCode\\s*=\\s*[\"]?\\*UnauthorizedOperation[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.errorCode\\s*=\\s*[\"]?AccessDenied\\*[\"]?\\s*\\)\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\$\\.userIdentity\\.type\\s*=\\s*[\"]?Root[\"]?\\s*\\&\\&\\s*\\s*\\$\\.userIdentity\\.invokedBy\\s*NOT\\s*EXISTS\\s*\\&\\&\\s*\\$\\.eventType\\s*!=\\s*[\"]?AwsServiceEvent\\s*[\"]?\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

{
  securityGroups(where: { groupName: "default", NOT: { rules_SOME: null } }) {
    ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

iamUsers(where:{hasIAMUserCredentials:{OR:[{accessKey1Active:true,accessKey1LastUsedDate:null}{accessKey2Active:true,accessKey2LastUsedDate: null }]}}){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWS130IAM13 {...AssetFragment}

Connectors

AWS

Expected check: eq []

iamUsers(where: { cloudProvider: "aws", iamPolicies_NOT: null }) {...AssetFragment}

Connectors

AWS

Expected check: eq []

{iamRoles(where:{iamPolicies_SOME: {iamPolicyStatements_SOME: {effect:"Allow",actions_INCLUDES: "*", resources_INCLUDES: "*"}}}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

iamUsers(where:{iamPolicies_SOME: {iamPolicyStatements_SOME: {effect:"Allow",actions_INCLUDES: "*", resources_INCLUDES: "*"}}}){...AssetFragment}

Connectors

AWS

Expected check: eq []

iamGroups(where:{iamPolicies_SOME: {iamPolicyStatements_SOME: {effect:"Allow",actions_INCLUDES: "*", resources_INCLUDES: "*"}}}){...AssetFragment}

Connectors

AWS

Expected check: eq []

buckets(where: { publicAccessBlocked: false }) {...AssetFragment}

Connectors

AWS

Expected check: eq []

AWS140IAM20{...AssetFragment}

Connectors

AWS

Expected check: eq []

buckets(where: {OR: [{policyDocument_MATCHES: "^((?!(?i)\"effect\":\"deny\").)*$"},{policyDocument_MATCHES: "^((?!(?i)\"Bool|aws:SecureTransport|false\").)*$"}]}) {...AssetFragment}

Connectors

AWS

Expected check: eq []

networkAcls(where:{rules_SOME:{AND:[{direction:"Inbound"},{action:"Allow"},{OR:[{sources_INCLUDES:"cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]},{OR:[{destFromPort_LTE: 22, destToPort_GTE: 22}, {destFromPort_LTE: 3389, destToPort_GTE: 3389}]}]}}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCP110IAM6{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPVM1{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

buckets(where:{loggingLogBucket_NOT:""}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

gkeClusters(where:{loggingService_NOT:"logging.googleapis.com"}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

gkeClusters(where:{monitoringService_NOT:"monitoring.googleapis.com"}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

gkeClusters(where:{legacyAbacEnabled_NOT:false}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

gkeClusters(where:{tags:null}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{gkeClusters(where:{nodePools_SOME:{nodeConfig:{serviceAccount:"default"}}}){...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

{
  apiKeys(
    where: {
      clientRestrictions: []
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  apiKeys(
    where: {
       apiRestrictions: []
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

vms(where: {serviceAccountEmail_CONTAINS: "[email protected]"}) {...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{
  vms(
    where: {
      networkInterfaces_SOME: { NOT: { accessConfigs_SOME: null } }
      NOT: { name_STARTS_WITH: "gke-" }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

buckets(where:{iamConfigurationUniformBucketLevelAccessEnabled:false}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{cloudSqlInstances(where:{instanceType:"CLOUD_SQL_INSTANCE",backendType:"SECOND_GEN",ipAddresses_SOME:{type:"PRIMARY"}}){...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

bigQueryTables(where:{OR:[{policyDocument_CONTAINS:"AllUsers"},{policyDocument_CONTAINS:"allAuthenticatedUsers"}]}){...AssetFragment}

Connectors

Microsoft Azure

Expected check: eq []

{
  sqlServers(
    where: {
      NOT: { entraAdministrator: { administratorType: "ActiveDirectory" } }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{sqlDatabases(where: {encrypted: false}){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  iamRoles(
    where: {
      type: "CustomRole"
      permissions_INCLUDES: "*"
      assignableScopes_INCLUDES: $subscriptionResourceId
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{sqlServers(where:{firewallRules_SOME:{startIpAddress_CONTAINS:"0.0.0.0"}}){...AssetFragment}}

Connectors

Okta

Expected check: eq []

Okta1{...AssetFragment}

Connectors

Okta

Expected check: eq []

users(where: { applicationsConnection_SOME: {edge: {scope_NOT: "GROUP"}}}) {...AssetFragment}

Connectors

Okta

Expected check: eq []

oktaPolicies(where: { type: "MFA_ENROLL", OR:[{allowedFactors_INCLUDES: "phone_number"}, {allowedFactors_INCLUDES: "security_question"}, {allowedFactors_INCLUDES: "okta_email"}]}) {...AssetFragment}

Connectors

Okta

Expected check: eq []

passwordPolicies(where: { OR:[{minLength_LT: 14}, {minLowerCase_LT: 1}, {minUpperCase_LT: 1}, {minNumber_LT: 1}, {minSymbol_LT: 1}, {reuseCount_LT: 1}]}) {...AssetFragment}

Connectors

AWS

Expected check: eq []

{
  ecsTaskDefinitions(
    where: { 
      networkMode: "host", task_NOT: null, 
      OR:[
        {containerSpecs_SOME: { privileged: true }},
        {containerSpecs_SOME: { user_CONTAINS: "root" }}
     ] }
  ) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{
  ecsServices(where: {hasECSServiceNetworkConfigurations_SOME: { assignPublicIP: true}}) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{
  ecsTaskDefinitions(where: {AND: [
      {
        task_NOT: null
      },
      {
        containerSpecs_SOME: {
          privileged: true
        }
      }
    ]}) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{
  ecsTaskDefinitions(where: {task_NOT: null, containerSpecs_SOME: { readOnlyRootFS: false }}) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{iamRoles(where:{hasIAMAssumeRolePolicyStatement_SOME:{hasIAMAssumeRolePolicyPrincipal_SOME:{value:"*"}}}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

{AWSIAM20{...AssetFragment}}

Connectors

AWS

Expected check: eq []

{AWSIAM8{...AssetFragment}}

Connectors

Alibaba Cloud

Expected check: eq []

iamUsers(where: { iamPolicies_SOME: { idFromProvider_NOT: null } }) {...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

iamPolicies(where: { policyType: "Custom", iamPolicyStatements_SOME: { effect: "Allow", actions_INCLUDES: "*" } }) {...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{
  iamUsers(
    where: {
      hasIAMRole_SOME: {
        name_IN: ["roles/viewer", "roles/editor", "roles/owner"]
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  iamUsers(
    where: {
      AND: [
        {
          hasIAMRole_SOME: {
            OR: [
              { name: "roles/cloudkms.admin" }
              { name: "roles/owner" }
              { name: "roles/editor" }
            ]
          }
        }
        {
          hasIAMRole_SOME: {
            OR: [
              { name: "roles/cloudkms.cryptoKeyEncrypterDecrypter" }
              { name: "roles/cloudkms.cryptoKeyEncrypter" }
              { name: "roles/cloudkms.cryptoKeyDecrypter" }
            ]
          }
        }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  iamUsers(
    where: {
      AND: [
        {
          hasIAMRole_SOME: {
            name: "roles/iam.serviceAccountAdmin"
          }
        }
        {
          hasIAMRole_SOME: {
            name: "roles/iam.serviceAccountUser"
          }
        }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  iamServiceAccounts(
    where: {
      hasIAMRole_SOME: {
        OR: [
          { name: "roles/owner" }
          { name: "roles/editor" }
          { name_CONTAINS: "admin" }
        ]
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Alibaba Cloud

Expected check: eq []

AlibabaIAM5 {...AssetFragment}

Connectors

AWS

Expected check: eq []

{
  vms(
    where: { NOT: { metadataOptionHTTPTokens: "required" } }
  ) {...AssetFragment}
}

Connectors

Microsoft Azure

Expected check: eq []

{aksClusters(where:{enableRBAC_NOT:true}){...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

{gkeClusters(where:{OR:[{masterAuthUsername_NOT:"" masterAuthPassword_NOT:""}]}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

{
  functions(
    where: {
      OR: [
      {
        securityRules_SOME: {
          direction: "Inbound"
          action: "Allow"
          AND: [
            {
              OR: [
                { sources_INCLUDES: "cidr:0.0.0.0/0" }
                { sources_INCLUDES: "cidr:::/0" }
              ]
            }
            {
              OR: [
                { destFromPort_LTE: 22, destToPort_GTE: 22 }
                { destFromPort_LTE: 3389, destToPort_GTE: 3389 }
              ]
            }
          ]
        }
      },
      {
        securityGroups_SOME: {
          rules_SOME: {
            direction: "Inbound"
            action: "Allow"
            AND: [
              {
                OR: [
                  { sources_INCLUDES: "cidr:0.0.0.0/0" }
                  { sources_INCLUDES: "cidr:::/0" }
                ]
              }
              {
                OR: [
                  { destFromPort_LTE: 22, destToPort_GTE: 22 }
                  { destFromPort_LTE: 3389, destToPort_GTE: 3389 }
                ]
              }
            ]
          }
        }
      }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  functions(where: {
    bindings_SOME: {
      direction: "in",
      type: "httpTrigger"
    }
  }) {
    ...AssetFragment
  }
}

Connectors

Alibaba Cloud

Expected check: eq []

{
  functions(where: {
    triggers_SOME: {
      triggerType: "http"
    }
  }) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  functions(
    where: {
      NOT: {
        httpsRequired: true
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

gkeClusters(where:{privateClusterConfig:null}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

gkeClusters(where:{subnetworks_SOME:{privateIpGoogleAccess:false}}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{gkeClusters(where: {nodePools_SOME: {nodeConfig: { oauthScopes_INCLUDES:"https://www.googleapis.com/auth/cloud-platform"}}}) {...AssetFragment}}

Connectors

Alibaba CloudAWS

Expected check: eq []

{
  vms(
    where: {
      publicIpAddress_NOT: null
      securityGroups_SOME: {
        rules_SOME: {
          direction: "Inbound"
          action: "Allow"
          AND: [
            {
              OR: [
                { sources_INCLUDES: "cidr:0.0.0.0/0" }
                { sources_INCLUDES: "cidr:::/0" }
              ]
            }
            {
              OR: [
                { destFromPort_LTE: 22, destToPort_GTE: 22 }
                { destFromPort_LTE: 3389, destToPort_GTE: 3389 }
              ]
            }
          ]
        }
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  vms(
    where: {
      networkInterfaces_SOME: {
        publicIp_NOT: null
        securityGroups_SOME: {
          rules_SOME: {
            direction: "Inbound"
            action: "Allow"
            AND: [
              {
                OR: [
                  { sources_INCLUDES: "cidr:0.0.0.0/0" }
                  { sources_INCLUDES: "cidr:::/0" }
                  { sources_INCLUDES: "tag:Internet" }
                  { sources: [] }
                ]
              }
              {
                OR: [
                  { destFromPort_LTE: 22, destToPort_GTE: 22 }
                  { destFromPort_LTE: 3389, destToPort_GTE: 3389 }
                ]
              }
            ]
          }
        }
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  vms(
    where: {
      networkInterfaces_SOME: { NOT: { accessConfigs_SOME: null } }
      NOT: { name_STARTS_WITH: "gke-" }
      firewalls_SOME: {
        rules_SOME: {
          direction: "Inbound"
          AND: [
            {
              OR: [
                { sources_INCLUDES: "cidr:0.0.0.0/0" }
                { sources_INCLUDES: "cidr:::/0" }
              ]
            }
            {
              OR: [
                { destFromPort_LTE: 22, destToPort_GTE: 22 }
                { destFromPort_LTE: 3389, destToPort_GTE: 3389 }
              ]
            }
          ]
        }
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

{AWSIAM21{...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

{
  storageAccounts(
    where: {
      OR: [
        { AND: [{ networkRuleSetDefaultAction_CONTAINS: "Allow" }] }
        {
          AND: [
            { networkRuleSetDefaultAction_CONTAINS: "Deny" }
            { NOT: { networkRuleSetBypass_CONTAINS: "AzureServices" } }
          ]
        }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

{buckets(where:{hasBucketACLGrant_SOME: {granteeType_NOT:"CanonicalUser"}}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

{buckets(where:{AND:[{policyDocument_CONTAINS:"\"Effect\":\"Allow\""},{policyDocument_CONTAINS:"\"Principal\":\"*\""}]}){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

{
  storageAccounts(where: { NOT: { networkRuleSetDefaultAction: "Deny" } }) {
    ...AssetFragment
  }
}

Connectors

Alibaba CloudAWS

Expected check: eq []

{
  vms(
    where: {
      publicIpAddress_NOT: null
      securityGroups_SOME: {
        rules_SOME: {
          direction: "Inbound"
          action: "Allow"
          AND: [
            {
              OR: [
                { sources_INCLUDES: "cidr:0.0.0.0/0" }
                { sources_INCLUDES: "cidr:::/0" }
              ]
            }
            {
              OR: [
                { destFromPort_LTE: 22, destToPort_GTE: 22 }
                { destFromPort_LTE: 3389, destToPort_GTE: 3389 }
              ]
            }
          ]
        }
      }
    }
  ) {
    diskAttachments {
      disk {...AssetFragment}
    }
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  vms(
    where: {
      networkInterfaces_SOME: {
        publicIp_NOT: null
        securityGroups_SOME: {
          rules_SOME: {
            direction: "Inbound"
            action: "Allow"
            AND: [
              {
                OR: [
                  { sources_INCLUDES: "cidr:0.0.0.0/0" }
                  { sources_INCLUDES: "cidr:::/0" }
                  { sources_INCLUDES: "tag:Internet" }
                  { sources: [] }
                ]
              }
              {
                OR: [
                  { destFromPort_LTE: 22, destToPort_GTE: 22 }
                  { destFromPort_LTE: 3389, destToPort_GTE: 3389 }
                ]
              }
            ]
          }
        }
      }
    }
  ) {
    diskAttachments {
      disk {...AssetFragment}
    }
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  vms(
    where: {
      networkInterfaces_SOME: { NOT: { accessConfigs_SOME: null } }
      NOT: { name_STARTS_WITH: "gke-" }
      firewalls_SOME: {
        rules_SOME: {
          direction: "Inbound"
          AND: [
            {
              OR: [
                { sources_INCLUDES: "cidr:0.0.0.0/0" }
                { sources_INCLUDES: "cidr:::/0" }
              ]
            }
            {
              OR: [
                { destFromPort_LTE: 22, destToPort_GTE: 22 }
                { destFromPort_LTE: 3389, destToPort_GTE: 3389 }
              ]
            }
          ]
        }
      }
    }
  ) {
    diskAttachments {
      disk {
        ...AssetFragment
      }
    }
  }
}

Connectors

AWS

Expected check: eq []

{
  buckets(
    where: {
      cloudProvider: "aws"
      publicAccessBlocked: false
      OR: [
        {
          hasBucketACLGrant_SOME: {
            OR: [
              { granteeURI: "http://acs.amazonaws.com/groups/global/AllUsers" }
              {
                granteeURI: "http://acs.amazonaws.com/groups/global/AuthenticatedUsers"
              }
            ]
            permission_IN: ["READ", "WRITE", "WRITE_ACP", "FULL_CONTROL"]
          }
        }
        {
          bucketPolicy: {
            statements_SOME: {
              effect: "Allow"
              OR: [
                { actions_INCLUDES: "s3:GetObject" }
                { actions_INCLUDES: "s3:ListObjects" }
                { actions_INCLUDES: "s3:ListObjectsV2" }
                { actions_INCLUDES: "s3:PutObject" }
                { actions_INCLUDES: "s3:PutObjectAcl" }
                { actions_INCLUDES: "s3:CreateMultipartUpload" }
                { actions_INCLUDES: "s3:UploadPart" }
                { actions_INCLUDES: "s3:DeleteObject" }
                { actions_INCLUDES: "s3:DeleteObjects" }
                { actions_INCLUDES: "s3:*" }
                { actions_INCLUDES: "*" }
              ]
              principals_INCLUDES: "AWS|*"
            }
          }
        }
      ]
    }
  ) {...AssetFragment}
}

Connectors

Microsoft Azure

Expected check: eq []

{
  blobContainers(
    where: {
      cloudProvider: "azure"
      publicAccessBlocked: false
      publicAccess_IN: ["Blob", "Container"]
    }
  ) {...AssetFragment}
}

Connectors

Google Cloud

Expected check: eq []

{
  buckets(
    where: {
      cloudProvider: "gcp"
      publicAccessBlocked: false
        iamBindings_SOME: {
          OR: [
            { members_INCLUDES: "allUsers" }
            { members_INCLUDES: "allAuthenticatedUsers" }
          ]
          role: {
            OR: [
              { permissions_INCLUDES: "storage.objects.get" }
              { permissions_INCLUDES: "storage.objects.list" }
              { permissions_INCLUDES: "storage.objects.create" }
              { permissions_INCLUDES: "storage.objects.delete" }
              { permissions_INCLUDES: "storage.objects.update" }
              { permissions_INCLUDES: "storage.objects.*" }
              { permissions_INCLUDES: "storage.objects.setIamPolicy" }
              {
                permissions_INCLUDES: "storage.multipartUploads.create"
              }
              { permissions_INCLUDES: "storage.multipartUploads.*" }
            ]
          }
      }
    }
  ) {...AssetFragment}
}

Connectors

Alibaba Cloud

Expected check: eq []

{
  buckets(
    where: {
      cloudProvider: "alibaba"
      publicAccessBlocked: false
      OR: [
        { acl_IN: ["public-read", "public-read-write"] }
        {
          bucketPolicy: {
            statements_SOME: {
              effect: "Allow"
              OR: [
                { actions_INCLUDES: "oss:GetObject" }
                { actions_INCLUDES: "oss:PutObject" }
                { actions_INCLUDES: "oss:PutObjectAcl" }
                { actions_INCLUDES: "oss:ListObjects" }
                { actions_INCLUDES: "oss:GetObjectVersion" }
                { actions_INCLUDES: "oss:*" }
                { actions_INCLUDES: "*" }
              ]
              principals_INCLUDES: "*"
            }
          }
        }
      ]
    }
  ) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{
  accessibleBucketsFromAWSFunctions {...AssetFragment}
}

Connectors

Google Cloud

Expected check: eq []

{
  accessibleBucketsFromGCPFunctions {...AssetFragment}
}

Connectors

Microsoft Azure

Expected check: eq []

{
  accessibleBlobContainersFromAzureFunctions {...AssetFragment}
}

Connectors

Alibaba Cloud

Expected check: eq []

{
  accessibleBucketsFromAlibabaFunctionsWithSystemPolicy {...AssetFragment}
}

Connectors

Alibaba Cloud

Expected check: eq []

{
  accessibleBucketsFromAlibabaFunctionsWithCustomPolicy {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{
  buckets(
    where: {
      OR: [
        { policyDocument_MATCHES: ".*arn:aws:iam::[0-9]+:root.*" }
        {
          bucketPolicy: {
            statements_SOME: { effect: "Allow", principals_INCLUDES: "AWS|*" }
          }
        }
        { hasBucketACLGrant_SOME: {
            OR: [
              { granteeURI: "http://acs.amazonaws.com/groups/global/AllUsers" }
              { granteeURI: "http://acs.amazonaws.com/groups/global/AuthenticatedUsers" }
            ]
       }}]
    }
  ) {...AssetFragment}
}

Connectors

Google Cloud

Expected check: eq []

{
  buckets(
    where: {
      OR: [
        { iamPolicyDocument_MATCHES: ".*domain:.*" }
        {
          iamBindings_SOME: {
              OR: [
                { members_INCLUDES: "allAuthenticatedUsers" }
                { members_INCLUDES: "allUsers" }
              ]
            }
        }
      ]
    }
  ) {...AssetFragment}
}

Connectors

Alibaba Cloud

Expected check: eq []

{buckets(where: {OR: [ {acl: "public-read"}, {acl: "public-read-write"}], trails_NOT: null}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

vms( where: { securityGroups_SOME: { rules_SOME: { direction: "Inbound" action: "Allow" AND: [ { OR: [ { sources_INCLUDES: "cidr:0.0.0.0/0" } { sources_INCLUDES: "cidr:::/0" } ] } { destFromPort_LTE: 22, destToPort_GTE: 22 } ] } } iamRoles_SOME: { iamPolicies_SOME: { iamPolicyStatements_SOME: { effect: "Allow" } } } } ) { iamRoles { iamPolicies { iamPolicyStatements { permissions { isOwnedByIAMAssetType { includesKMSKey {...AssetFragment} } } } } } }

Connectors

Google Cloud

Expected check: eq []

vms( where: { firewalls_SOME: { rules_SOME: { direction: "Inbound" action: "Allow" AND: [ { OR: [ { sources_INCLUDES: "cidr:0.0.0.0/0" } { sources_INCLUDES: "cidr:::/0" } ] } { destFromPort_LTE: 22, destToPort_GTE: 22 } ] } } } ) { serviceAccount { serviceAccountRoles { hasIAMPermissions { isOwnedByIAMAssetType { includesKMSKey {...AssetFragment} } } } } }

Connectors

Alibaba Cloud

Expected check: eq []

{
  alibabaKMSKeysExposedThroughVMs {...AssetFragment}
}

Connectors

Microsoft Azure

Expected check: eq []

{ vms( where: { networkInterfaces_SOME: { securityGroups_SOME: { rules_SOME: { direction: "Inbound" action: "Allow" AND: [ { OR: [ { sources_INCLUDES: "cidr:0.0.0.0/0" } { sources_INCLUDES: "cidr:::/0" } { sources_INCLUDES: "tag:Internet" } { sources: [] } ] } { destFromPort_LTE: 22, destToPort_GTE: 22 } ] } } } } ) { vmRoles { hasIAMPermissions { isOwnedByIAMAssetType { includesKMSKey {...AssetFragment} } } } } }

Connectors

AWS

Expected check: eq []

{ kmsKeys( where: { keyPolicy: { statements_SOME: { effect: "Allow" conditions: [] principals_INCLUDES: "AWS|*" } } } ) {...AssetFragment} } 

Connectors

Google Cloud

Expected check: eq []

{kmsKeys( where: { iamBindings_SOME: { OR: [{ members_INCLUDES: "allAuthenticatedUsers"}, { members_INCLUDES: "allUsers" }] } } ) {...AssetFragment}}

Connectors

AWS

Expected check: eq []

{kmsKeys( where: { OR: [ { AND: {policyDocument_MATCHES: ".*arn:aws:iam::[0-9*]+:root.*", managementType: "CustomerManaged"} } { keyPolicy: { statements_SOME: { effect: "Allow" conditions: [] principals_INCLUDES: "AWS|*" } } } ] } ) {...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

{ kmsKeys( where: { OR: [ { policyDocument_MATCHES: ".*domain:.*" } { iamBindings_SOME: { OR: [ { members_INCLUDES: "allAuthenticatedUsers" } { members_INCLUDES: "allUsers" } ] } } ] } ) {...AssetFragment} } 

Connectors

AWS

Expected check: eq []

{
  vms(
    where: {
      securityGroups_SOME: {
        rules_SOME: {
          direction: "Inbound"
          action: "Allow"
          AND: [
            {
              OR: [
                { sources_INCLUDES: "cidr:0.0.0.0/0" }
                { sources_INCLUDES: "cidr:::/0" }
              ]
            }
            { destFromPort_LTE: 22, destToPort_GTE: 22 }
          ]
        }
      }
      iamRoles_SOME: {
        iamPolicies_SOME: { 
          iamPolicyStatements_SOME: { 
            AND: [
              { effect: "Allow" }
              {
                permissions_SOME: {
                  isOwnedByIAMAssetType_SOME: {
                    includesKMSKey_ALL: {
                      dataStores_NOT: null
                    }
                  }
                }
              }
            ]
          } 
        }
      }
    }
  ) {
    iamRoles {
      iamPolicies {
        iamPolicyStatements {
          permissions {
            isOwnedByIAMAssetType {
              includesKMSKey {
                ...AssetFragment
              }
            }
          }
        }
      }
    }
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  vms(
    where: {
      iamRoles_SOME: {
        hasIAMPermissions_SOME: {
          isOwnedByIAMAssetType_SOME: {
            includesKMSKey_SOME: { dataStores_NOT: null }
          }
        }
      }
      networkInterfaces_SOME: {
        securityGroups_SOME: {
          rules_SOME: {
            direction: "Inbound"
            action: "Allow"
            AND: [
              {
                OR: [
                  { sources_INCLUDES: "cidr:0.0.0.0/0" }
                  { sources_INCLUDES: "cidr:::/0" }
                  { sources_INCLUDES: "tag:Internet" }
                  { sources: [] }
                ]
              }
              { destFromPort_LTE: 22, destToPort_GTE: 22 }
            ]
          }
        }
      }
    }
  ) {
    vmRoles {
      hasIAMPermissions {
        isOwnedByIAMAssetType {
          includesKMSKey {
            ...AssetFragment
          }
        }
      }
    }
  }
}

Connectors

Alibaba Cloud

Expected check: eq []

{
  alibabaUsedKMSKeysExposedThroughVMs {...AssetFragment}
}

Connectors

Google Cloud

Expected check: eq []

{
  gcpUsedKMSKeysExposedThroughVMs {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

kmsKeys(where:{OR:[{policyDocument_CONTAINS:"allUsers"},{policyDocument_CONTAINS:"allAuthenticatedUsers"}]}){...AssetFragment}

Connectors

Microsoft Azure

Expected check: eq []

{
  securityGroups(
    where: {
      rules_SOME: {
        direction: "Inbound"
        action: "Allow"
        protocol: "UDP"
        AND: [
          {
            OR: [
              { sources_INCLUDES: "cidr:0.0.0.0/0" }
              { sources_INCLUDES: "cidr:::/0" }
              { sources_INCLUDES: "tag:Internet" }
              { sources: [] }
            ]
          }
          {
            OR: [
              { destFromPort_LTE: 53, destToPort_GTE: 53 }
              { destFromPort_LTE: 123, destToPort_GTE: 123 }
              { destFromPort_LTE: 161, destToPort_GTE: 161 }
              { destFromPort_LTE: 389, destToPort_GTE: 389 }
              { destFromPort_LTE: 1900, destToPort_GTE: 1900 }
            ]
          }
        ]
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{firewalls(where: {rules_SOME: {direction: "Inbound", destFromPort_LTE: 1521, destToPort_GTE: 1521, OR: [{sources_INCLUDES: "cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]}}) {...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

{firewalls(where: {rules_SOME: {direction: "Inbound", destFromPort_LTE: 27017, destToPort_GTE: 27017, OR: [{sources_INCLUDES: "cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]}}) {...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

{firewalls(where: {rules_SOME: {direction: "Inbound", destFromPort_LTE: 3306, destToPort_GTE: 3306, OR: [{sources_INCLUDES: "cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]}}) {...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

{firewalls(where: {rules_SOME: {direction: "Inbound", destFromPort_LTE: 5432, destToPort_GTE: 5432, OR: [{sources_INCLUDES: "cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]}}) {...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

{firewalls(where: {rules_SOME: {direction: "Inbound", destFromPort_LTE: 80, destToPort_GTE: 80, OR: [{sources_INCLUDES: "cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]}}) {...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

{firewalls(where: {rules_SOME: {direction: "Inbound", destFromPort_LTE: 0, destToPort_GTE: 65535, OR: [{sources_INCLUDES: "cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]}}) {...AssetFragment}}

Connectors

AWS

Expected check: eq []

{securityGroups(where: {rules_SOME: {direction: "Inbound", destFromPort_LTE: 389, destToPort_GTE: 389, OR: [{sources_INCLUDES: "cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]}}) {...AssetFragment}}

Connectors

AWS

Expected check: eq []

{ securityGroups(where: {vms_NOT: null, rules_SOME: {direction: "Inbound", AND: [{OR: [{sources_INCLUDES: "cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]}, {OR: [{destFromPort_LTE: 9200, destToPort_GTE: 9200}, {destFromPort_LTE: 9300, destToPort_GTE: 9300}]}]}}) {...AssetFragment}}

Connectors

Alibaba CloudAWSMicrosoft Azure

Expected check: eq []

{
  securityGroups(where: {
    rules_SOME: {
      direction: "Inbound",
      action: "Allow",
      OR: [
        {sources_INCLUDES: "cidr:0.0.0.0/0"},
        {sources_INCLUDES: "cidr:::/0"},
        {sources_INCLUDES: "tag:Internet"},
        {sources: []}
      ]
    }
  }) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  firewalls(
    where: {
      rules_SOME: {
        direction: "Inbound"
        OR: [
          { sources_INCLUDES: "cidr:0.0.0.0/0" }
          { sources_INCLUDES: "cidr:::/0" }
        ]
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  AzureConnectorsWithoutCustomLockRoles{
    ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

{ sqsQueues(where: { policyDocument: { statements_SOME: { AND: [ { effect: "Allow" }, { OR: [ { principals_INCLUDES: "" }, { principals_INCLUDES: "*" }, { principals_INCLUDES: "AWS|*" }, ] } ] } } }) {...AssetFragment} }

Connectors

Google Cloud

Expected check: eq []

{ pubSubSubscriptions( where: { iamBindings_SOME: { OR: [ { members_INCLUDES: "allAuthenticatedUsers" } { members_INCLUDES: "allUsers" } ] } } ) {...AssetFragment} } 

Connectors

Google Cloud

Expected check: eq []

{ pubSubTopics( where: { iamBindings_SOME: { OR: [ { members_INCLUDES: "allAuthenticatedUsers" } { members_INCLUDES: "allUsers" } ] } } ) {...AssetFragment} } 

Connectors

AWS

Expected check: eq []

{
  sageMakerNoteBooks(
    where: {
     NOT: { minimumInstanceMetadataServiceVersion: "2" } 
    }
  ) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{
  sageMakerNoteBooks(
    where: {
     NOT: { rootAccess: "Disabled" } 
    }
  ) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{dbInstances(where:{publicAccessBlocked:false}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

{ dbInstances(where: {securityGroups_SOME: {rules_SOME: {direction: "Inbound", OR: [{destToPort_NOT_IN: [3306, 5432, 1521, 1433, 27017]}, {OR: [{sources_INCLUDES: "cidr:0.0.0.0/0"}, {sources_INCLUDES: "cidr:::/0"}]}]}}}) {...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      ipAddresses_SOME: { type: "PRIMARY" }
      networkSettings_SOME: {
        authorizedNetworks_SOME: { cidrValue: "0.0.0.0/0" }
      }
    }
  ) {
    ...AssetFragment
  }
} 

Connectors

Microsoft Azure

Expected check: eq []

{ mySqlServers( where: { publicAccessBlocked: false firewallRules_SOME: { startIPAddress: "0.0.0.0" endIPAddress: "255.255.255.255" } } ) {...AssetFragment} } 

Connectors

Microsoft Azure

Expected check: eq []

{ mySqlFlexibleServers( where: { publicAccessBlocked: false firewallRules_SOME: { startIPAddress: "0.0.0.0" endIPAddress: "255.255.255.255" } } ) {...AssetFragment} } 

Connectors

Microsoft Azure

Expected check: eq []

{ postgreSqlServers( where: { publicAccessBlocked: false firewallRules_SOME: { startIPAddress: "0.0.0.0" endIPAddress: "255.255.255.255" } } ) {...AssetFragment} } 

Connectors

Microsoft Azure

Expected check: eq []

{ postgreSqlFlexibleServers( where: { publicAccessBlocked: false firewallRules_SOME: { startIPAddress: "0.0.0.0" endIPAddress: "255.255.255.255" } } ) {...AssetFragment} } 

Connectors

Alibaba Cloud

Expected check: eq []

{ dbInstances( where: { publicAccessBlocked: false whitelist: { rules_SOME: { sources_INCLUDES: "cidr:0.0.0.0/0" } } } ) {...AssetFragment} } 

Connectors

Microsoft Azure

Expected check: eq []

{
  sqlDatabases(
    where: {
      sqlServer: {
        firewallRules_SOME: {
          startIpAddress: "0.0.0.0"
          endIpAddress: "255.255.255.255"
        }
      }
    }
  ) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{
  dbClusters(
    where: {
      dbInstances_SOME: {
        publicAccessBlocked: false
        securityGroups_SOME: {
          rules_SOME: {
            direction: "Inbound"
            OR: [
              { sources_INCLUDES: "cidr:0.0.0.0/0" }
              { sources_INCLUDES: "cidr:::/0" }
            ]
          }
        }
      }
    }
  ) {...AssetFragment}
}

Connectors

Microsoft Azure

Expected check: eq []

{
  mariaDbServers(
    where: {
      publicAccessBlocked: false
      firewallRules_SOME: {
        startIPAddress: "0.0.0.0"
        endIPAddress: "255.255.255.255"
      }
    }
  ) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{
  dbInstances(
    where: {
      publicAccessBlocked: false
      dbCluster: null
      securityGroups_SOME: {
        rules_SOME: {
          direction: "Inbound"
          OR: [
            { sources_INCLUDES: "cidr:0.0.0.0/0" }
            { sources_INCLUDES: "cidr:::/0" }
          ]
        }
      }
    }
  ) {...AssetFragment}
}

Connectors

Alibaba Cloud

Expected check: eq []

AlibabaRDS2{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{
cloudSqlInstances(
   where: {
      engine: "mysql"
      cloudProvider: "gcp"
      OR: [
        { dbFlags_NONE: { name: "skip_show_database" } }
        { dbFlags_SOME: { name: "skip_show_database", value: "off" } }
      ]
    }
  ) {
     ...AssetFragment
  }}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      cloudProvider: "gcp"
      ipAddresses_SOME: { NOT: { type: "PRIVATE" } }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      engine: "sqlserver"
      cloudProvider: "gcp"
      OR: [{ dbFlags_NONE: { name: "remote access" }}, {dbFlags_SOME: {name: "remote access", value: "on"}}]
     
    }
  ) {
     ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      cloudProvider: "gcp"
      networkSettings_SOME: {
        authorizedNetworks_SOME: {
        OR: [{ cidrValue: "0.0.0.0/0" }, { cidrValue: "::/0" }]
      }
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

vms(where:{hasVMMetadataItem_SOME:{key:"block-project-ssh-keys" value:"false"}}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

projects(where:{hasCommonInstanceMetadataItem_SOME:{key:"os-login",value:"false"}}){...AssetFragment}

Connectors

AWS

Expected check: eq []

{
  AWSLogging1 {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

trails(where:{logFileValidationEnabled:false}){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSLogging4{...AssetFragment}

Connectors

AWS

Expected check: eq []

trails(where:{kmsKeyID:""}){...AssetFragment}

Connectors

AWS

Expected check: eq []

vpcs(where: {OR: [{hasFlowLog: null}, {hasFlowLog_NONE: {flowLogStatus: "ACTIVE"}}]}){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteGroupPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteRolePolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteUserPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutGroupPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutRolePolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutUserPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreatePolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeletePolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreatePolicyVersion[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeletePolicyVersion[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?AttachRolePolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DetachRolePolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?AttachUserPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DetachUserPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?AttachGroupPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DetachGroupPolicy[\"]?\\s*\\)\\s*\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateTrail[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?UpdateTrail[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteTrail[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?StartLogging[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?StopLogging[\"]?\\s*\\)\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventSource\\s*=\\s*[\"]?kms\\.amazonaws\\.com[\"]?\\s*\\)\\s*\\&\\&\\s*\\(\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DisableKey[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?ScheduleKeyDeletion[\"]?\\s*\\)\\s*\\)\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventSource\\s*=\\s*[\"]?s3\\.amazonaws\\.com[\"]?\\s*\\)\\s*\\&\\&\\s*\\(\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutBucketAcl[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutBucketPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutBucketCors[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutBucketLifecycle[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutBucketReplication[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteBucketPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteBucketCors[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteBucketLifecycle[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteBucketReplication[\"]?\\s*\\)\\s*\\)\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventSource\\s*=\\s*[\"]?config\\.amazonaws\\.com[\"]?\\s*\\)\\s*\\&\\&\\s*\\(\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?StopConfigurationRecorder[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteDeliveryChannel[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutDeliveryChannel[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?PutConfigurationRecorder[\"]?\\s*\\)\\s*\\)\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?AuthorizeSecurityGroupIngress[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?AuthorizeSecurityGroupEgress[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?RevokeSecurityGroupIngress[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?RevokeSecurityGroupEgress[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateSecurityGroup[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteSecurityGroup[\"]?\\s*\\)\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateNetworkAcl[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateNetworkAclEntry[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteNetworkAcl[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteNetworkAclEntry[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?ReplaceNetworkAclEntry[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?ReplaceNetworkAclAssociation[\"]?\\s*\\)\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateCustomerGateway[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteCustomerGateway[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?AttachInternetGateway[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateInternetGateway[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteInternetGateway[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DetachInternetGateway[\"]?\\s*\\)\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateRoute[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateRouteTable[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?ReplaceRoute[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?ReplaceRouteTableAssociation[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteRouteTable[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteRoute[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DisassociateRouteTable[\"]?\\s*\\)\\s*.*"){...AssetFragment}

Connectors

AWS

Expected check: eq []

{buckets( where: { OR: [ { trailEventSelectorDataResources_ALL: { eventSelector: { NOT: { readWriteType_IN: ["All", "WriteOnly"] } } } } { trailEventSelectorDataResources_SOME: null } ] } ) {...AssetFragment}}

Connectors

AWS

Expected check: eq []

{buckets( where: { OR: [ { trailEventSelectorDataResources_ALL: { eventSelector: { NOT: { readWriteType_IN: ["All", "ReadOnly"] } } } } { trailEventSelectorDataResources_SOME: null } ] } ) {...AssetFragment}}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventSource\\s*=\\s*[\"]?organizations\\.amazonaws\\.com[\"]?\\s*\\)\\s*\\&\\&\\s*\\(\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?AcceptHandshake[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?AttachPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateAccount[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateOrganizationalUnit[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreatePolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeclineHandshake[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteOrganization[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteOrganizationalUnit[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeletePolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DetachPolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DisablePolicyType[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?EnablePolicyType[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?InviteAccountToOrganization[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?LeaveOrganization[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?MoveAccount[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?RemoveAccountFromOrganization[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?UpdatePolicy[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?UpdateOrganizationalUnit[\"]?\\s*\\)\\s*\\)\\s*.*"){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

logBuckets(where:{locked:false}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{ cloudSqlInstances( where: { engine: "postgresql" cloudProvider: "gcp" OR: [ { dbFlags_NONE: { name: "log_connections" } } { dbFlags_SOME: { name: "log_connections", value: "off" } } ] } ) { ...AssetFragment }}

Connectors

Google Cloud

Expected check: eq []

{ cloudSqlInstances( where: { engine: "postgresql" cloudProvider: "gcp" OR: [ { dbFlags_NONE: { name: "log_disconnections" } } { dbFlags_SOME: { name: "log_disconnections", value: "off" } } ] } ) { ...AssetFragment }}

Connectors

Google Cloud

Expected check: eq []

{ cloudSqlInstances( where: { engine: "postgresql" cloudProvider: "gcp" dbFlags_SOME: { name: "log_min_messages" NOT: { value_IN: ["error", "log", "fatal", "panic"] } } } ) { ...AssetFragment }}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateVpc[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteVpc[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?ModifyVpcAttribute[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?AcceptVpcPeeringConnection[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?CreateVpcPeeringConnection[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DeleteVpcPeeringConnection[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?RejectVpcPeeringConnection[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?AttachClassicLinkVpc[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DetachClassicLinkVpc[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?DisableVpcClassicLink[\"]?\\s*\\)\\s*\\|\\|\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?EnableVpcClassicLink[\"]?\\s*\\)\\s*.*"){...AssetFragment}

Connectors

Microsoft Azure

Expected check: eq []

{
  sqlServers(where: { blobAuditingPolicies_NONE: { state: "Enabled" } }) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  sqlServers(
    where: {
      blobAuditingPolicies_NONE: {
        state: "Enabled"
        OR: [{ retentionDays: 0 }, { retentionDays_GT: 90 }]
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  kmsVaults(
    where: {
      OR: [
        { loggingEnabled: false }
        {
          diagnosticSettings_SOME: {
            resourceType: "Microsoft.KeyVault/vaults"
            logs_SOME: {
              enabled: false
              categoryGroup_IN: ["audit", "allLogs"]
            }
          }
        }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  AzureRegionsWithoutNetworkWatcher {
    ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

{
  ecsClusters(where: {hasECSSettings_NONE: {
      key: "containerInsights",
      value: "enabled"  
    }}) {...AssetFragment}
}

Connectors

Microsoft Azure

Expected check: eq []

{
  storageAccounts(
    where: {
      OR: [
        { isBlobServicesDiagnosticsSettingsEnabled: false }
        {
          AND: [
            {
              diagnosticSettings_NONE: {
                resourceType: "Microsoft.Storage/storageAccounts/blobServices"
                AND: [
                  { logs_SINGLE: { enabled: true, category: "StorageRead" } }
                  { logs_SINGLE: { enabled: true, category: "StorageWrite" } }
                  { logs_SINGLE: { enabled: true, category: "StorageDelete" } }
                ]
              }
            }
            {
              diagnosticSettings_NONE: {
                resourceType: "Microsoft.Storage/storageAccounts/blobServices"
                logs_SOME: {
                  enabled: true
                  categoryGroup_IN: ["audit", "allLogs"]
                }
              }
            }
          ]
        }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  storageAccounts(
    where: {
      OR: [
        { isQueueServicesDiagnosticsSettingsEnabled: false }
        {
          AND: [
            {
              diagnosticSettings_NONE: {
                resourceType: "Microsoft.Storage/storageAccounts/queueServices"
                AND: [
                  { logs_SINGLE: { enabled: true, category: "StorageRead" } }
                  { logs_SINGLE: { enabled: true, category: "StorageWrite" } }
                  { logs_SINGLE: { enabled: true, category: "StorageDelete" } }
                ]
              }
            }
            {
              diagnosticSettings_NONE: {
                resourceType: "Microsoft.Storage/storageAccounts/queueServices"
                logs_SOME: {
                  enabled: true
                  categoryGroup_IN: ["audit", "allLogs"]
                }
              }
            }
          ]
        }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Alibaba Cloud

Expected check: eq []

buckets(where:{ loggingEnabled: false }){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

vpcs(where:{hasSubnetwork_SOME:{enableFlowLogs:false}}){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?ConsoleLogin[\"]?\\s*\\)\\s*\\&\\&\\s*\\(\\s*\\$\\.errorMessage\\s*=\\s*[\"]?Failed authentication[\"]?\\s*\\)\\s*.*"){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPLogging5{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPLogging10{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPLogging6{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPLogging4{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPLogging7{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPLogging9{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPLogging8{...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

{
  AlibabaLogging1 {...AssetFragment}
}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals:"microsoft.authorization/policyassignments/write"){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals:"microsoft.network/networksecuritygroups/write"){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals: "microsoft.network/publicIPAddresses/write") {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals:"microsoft.sql/servers/firewallrules/write"){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals:"microsoft.security/securitysolutions/write"){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals:"microsoft.network/networksecuritygroups/delete"){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals:"microsoft.authorization/policyassignments/delete"){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals: "microsoft.network/publicIPAddresses/delete") {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals:"microsoft.sql/servers/firewallrules/delete"){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals:"microsoft.security/securitysolutions/delete"){...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

GCPLogging1{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

GCPLogging2{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      engine: "postgresql"
      cloudProvider: "gcp"
      dbFlags_SOME: { name: "log_error_verbosity", value: "verbose" }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      engine: "postgresql"
      cloudProvider: "gcp"
      dbFlags_NONE: { name: "log_statement" }
    }
  ) {
     ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      engine: "postgresql"
      cloudProvider: "gcp"
      dbFlags_SOME: { name: "log_min_error_statement", NOT: {value_IN: ["error", "log", "fatal", "panic"]} }
    }
  ) {
     ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      engine: "postgresql"
      cloudProvider: "gcp"
      OR: [{ dbFlags_NONE: { name: "cloudsql.enable_pgaudit" }}, {dbFlags_SOME: {name: "cloudsql.enable_pgaudit", value: "off"}}]
     
    }
  ) {
     ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      engine: "sqlserver"
      cloudProvider: "gcp"
      OR: [{ dbFlags_NONE: { name: "3625" }}, {dbFlags_SOME: {name: "3625", value: "off"}}]
     
    }
  ) {
     ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  vpcs(where: { dnsPolicy_NONE: { NOT: { enableLogging_IN: ["true"] } } }) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  loadBalancers(
    where: { backendServices_ALL: { NOT: { logConfigEnabled: true } } }
  ) {
    ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

AWSLogging5{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

managedZones(where:{dnsSecConfigState_NOT:"on"}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{
  vms(
    where: {
      OR: [
        { shieldedInstanceConfigEnableVtpm: false }
        { shieldedInstanceConfigEnableSecureBoot: false }
        { shieldedInstanceConfigEnableIntegrityMonitoring: false }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

{
  ecsTaskDefinitions(where:  {pidMode_MATCHES: "host", task_NOT: null}) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{
  ecsTaskDefinitions(
    where: {
      task_NOT: null,
      containerSpecs_SOME: {
        envEntries_SOME: {
          key_IN: [
            "AWS_ACCESS_KEY_ID"
            "AWS_SECRET_ACCESS_KEY"
            "ECS_ENGINE_AUTH_DATA"
          ]
        }
      }
    }
  ) {...AssetFragment}
}

Connectors

Microsoft Azure

Expected check: eq []

{
  sites(where: { siteConfig: { http20Enabled: false } }) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  sites(
    where: { siteConfig: { NOT: { javaVersion: "" }, isDeprecated: true } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  sites(
    where: { siteConfig: { NOT: { phpVersion: "" }, isDeprecated: true } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  sites(
    where: { siteConfig: { NOT: { pythonVersion: "" }, isDeprecated: true } }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

vms(where:{canIPForward:true}){...AssetFragment}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: {
      OR: [
        { securityContacts_SOME: null }
        { securityContacts_SOME: { notificationByRoleState: "Off" } }
        {
          NOT: {
            securityContacts_SOME: { notificationRoles_INCLUDES: "Owner" }
          }
        }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

vpcs(where:{IPv4Range_NOT:"" gatewayIPv4_NOT:""}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{GCPNetworking7{...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

vpcs(where:{name:"default"}){...AssetFragment}

Connectors

Microsoft Azure

Expected check: eq []

{
  mySqlServers
  (
    where: {
      cyscaleEngineIsOutdated: true
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  mySqlFlexibleServers
  (
    where: {
      cyscaleEngineIsOutdated: true
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  postgreSqlServers
  (
    where: {
      cyscaleEngineIsOutdated: true
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  postgreSqlFlexibleServers
  (
    where: {
      cyscaleEngineIsOutdated: true
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Alibaba CloudAWS

Expected check: eq []

{
  dbInstances
  (
    where: {
      cyscaleEngineIsOutdated: true
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances
  (
    where: {
      cyscaleEngineIsOutdated: true
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  mariaDbServers
  (
    where: {
      cyscaleEngineIsOutdated: true
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      cloudProvider: "gcp"
      engine: "sqlserver"
      dbFlags_SOME: { name: "user connections" }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: {
      OR: [
        { securityContacts_SOME: null }
        { securityContacts_SOME: { email: null } }
        { securityContacts_SOME: { email: "" } }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: {
      OR: [
        { securityContacts_SOME: null }
        { securityContacts_SOME: { alertNotifications: false } }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

cloudSqlInstances(where:{settingsBackupConfigurationEnabled:false}){...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

{
  iamAccountSummaries(
    where: {
      hasIAMAccountSummaryItem_SOME: { key: "antiDDoSHasLogStore", value: 1 }
    }
  ) {
    connector {...AssetFragment}
  }
}

Connectors

AWS

Expected check: eq []

iamUsers(where:{hasIAMUserCredentials:{passwordEnabled:true,mfaActive:false}}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{
  iamUsers(where: { NOT: { user: { isEnrolledIn2Sv: true } } }) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  users(where: { mfaActive: false, NOT: { iamRoleAssignments_SOME: null } }) {
    ...AssetFragment
  }
}

Connectors

Alibaba Cloud

Expected check: eq []

iamUsers(where:{hasIAMUserLoginProfile_SOME:{mfaBindRequired:false}}){...AssetFragment}

Connectors

Microsoft Entra ID

Expected check: eq []

{
  users(where: { mfaActive: false }) {
    ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

iamPasswordPolicies(where:{requireUppercaseCharacters:false}){...AssetFragment}

Connectors

AWS

Expected check: eq []

iamPasswordPolicies(where:{requireLowercaseCharacters:false}){...AssetFragment}

Connectors

AWS

Expected check: eq []

iamPasswordPolicies(where:{requireSymbols:false}){...AssetFragment}

Connectors

AWS

Expected check: eq []

iamPasswordPolicies(where:{requireNumbers:false}){...AssetFragment}

Connectors

AWS

Expected check: eq []

iamPasswordPolicies(where:{minimumPasswordLength_LT:14}){...AssetFragment}

Connectors

AWS

Expected check: eq []

iamPasswordPolicies(where:{passwordReusePrevention_LT:24}){...AssetFragment}

Connectors

AWS

Expected check: eq []

{ iamPasswordPolicies( where: { OR: [{ maxPasswordAge: 0 }, { maxPasswordAge_GT: 90 }] } ) {...AssetFragment} } 

Connectors

AWS

Expected check: eq []

AWSIAM13{...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSIAM14{...AssetFragment}

Connectors

AWS

Expected check: eq []

AWSMonitoring(filterPattern:".*\\s*\\(\\s*\\$\\.eventName\\s*=\\s*[\"]?ConsoleLogin[\"]?\\s*\\)\\s*\\&\\&\\s*\\(\\s*\\$\\.additionalEventData\\.MFAUsed\\s*!=\\s*[\"]?Yes[\"]?\\s*\\)\\s*.*"){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

gkeClusters(where:{masterAuthClientKey:""}){...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

iamPasswordPolicies( where: { maxPasswordAge_GT: 90 }) {...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

iamPasswordPolicies( where: { passwordReusePrevention_NOT: 24 }) {...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

iamPasswordPolicies( where: { minimumPasswordLength_LT: 14}) {...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

iamPasswordPolicies( where: { requireLowercaseCharacters: false}) {...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

iamPasswordPolicies( where: { requireNumbers: false}) {...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

iamPasswordPolicies( where: { requireUppercaseCharacters: false}) {...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

iamPasswordPolicies( where: { maxLoginAttempts_LT: 5 }) {...AssetFragment}

Connectors

Alibaba CloudAWS

Expected check: eq []

{
  iamUsers(where: {
    cloudProvider_IN: ["alibaba", "aws"],
    OR: [
      {
        iamPolicies_SOME: {
          OR: [{
            internalName_CONTAINS: "Administrator"  
          }, {
            internalName_CONTAINS: "FullAccess"  
          }]
        }
      },
      {
        hasIAMGroup_SOME: {
          iamPolicies_SOME: {
            OR: [{
              internalName_CONTAINS: "Administrator"  
            }, {
              internalName_CONTAINS: "FullAccess"  
            }]
          }
        }
      }
    ],
    mfaSerialNumbers: []
  }) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  users(
    where: {
      mfaActive: false
      OR: [
        {
          iamRoleAssignments_SOME: {
            OR: [
              { internalName_IN: ["Owner", "Contributor"] }
              { isClassicAdministratorAssignment: true }
            ]
          }
        }
        {
          groups_SOME: {
            iamRoleAssignments_SOME: {
              OR: [
                { internalName_IN: ["Owner", "Contributor"] }
                { isClassicAdministratorAssignment: true }
              ]
            }
          }
        }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Okta

Expected check: eq []

{
  users(
    where: {
      applications_SOME: {
        name: "Okta Admin Console"
        hasPolicy_SOME: { mfaEnabled: false }
      }
      OR: [
        { roles_INCLUDES: "Super Administrator" }
        { roles_INCLUDES: "API Access Management Administrator" }
        { roles_INCLUDES: "Application Administrator" }
        { roles_INCLUDES: "Group Membership Administrator" }
        { roles_INCLUDES: "Help Desk Administrator" }
        { roles_INCLUDES: "Mobile Administrator" }
        { roles_INCLUDES: "Organizational Administrator" }
        { roles_INCLUDES: "Read-only Administrator" }
        { roles_INCLUDES: "Report Administrator" }
        { roles_INCLUDES: "Group Administrator" }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Workspace

Expected check: eq []

{
  users(where: { isAdmin: true, NOT: { isEnrolledIn2Sv: true } }) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  iamUsers(
    where: {
      hasIAMRole_SOME: {
        OR: [
          { name_IN: ["roles/owner", "roles/editor"] }
          { name_CONTAINS: "admin" }
        ]
      }
      NOT: { user: { isEnrolledIn2Sv: true } }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Entra ID

Expected check: eq []

{
  users(where: { cloudProvider: "entra", isAdmin: true, mfaActive: false }) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

GCPIAM1{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{iamServiceAccounts(where:{hasIAMServiceAccountKeys_SOME:{keyType: "USER_MANAGED"}}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

{buckets(where:{bucketVersioningMFADelete:false}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

{
  vms (
    where: {
      networkInterfaces_SOME: {
        sourceDestCheck: false
      }
      metadataOptionHTTPPutResponseHopLimit_GT: 1
    }
  ) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{amis(where:{isPublic:true}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

{
  launchTemplateVersions(
    where: { metadataOptionHTTPPutResponseHopLimit_GT: 1 }
  ) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{
  launchTemplateVersions(
    where: { NOT: { metadataOptionHTTPTokens: "required" } }
  ) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{vms(where:{inspectorEnabled:false}){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { pricing_SOME: { name: "AppServices", pricingTier: "Free" } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { pricing_SOME: { name: "CosmosDbs", pricingTier: "Free" } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { pricing_SOME: { name: "SqlServers", pricingTier: "Free" } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { pricing_SOME: { name: "Containers", pricingTier: "Free" } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { pricing_SOME: { name: "Dns", pricingTier: "Free" } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { pricing_SOME: { name: "KeyVaults", pricingTier: "Free" } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: {
      pricing_SOME: {
        name: "OpenSourceRelationalDatabases"
        pricingTier: "Free"
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { pricing_SOME: { name: "Arm", pricingTier: "Free" } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: {
      pricing_SOME: { name: "SqlServerVirtualMachines", pricingTier: "Free" }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { pricing_SOME: { name: "VirtualMachines", pricingTier: "Free" } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { pricing_SOME: { name: "StorageAccounts", pricingTier: "Free" } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { dataExportSettings_SOME: { name: "MCAS", enabled: false } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  connectors(
    where: { dataExportSettings_SOME: { name: "WDATP", enabled: false } }
  ) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  kmsVaults(
    where: 
    { 
      OR: [ 
        {enableSoftDelete_NOT: true } 
        {enablePurgeProtection_NOT: true } 
      ]  }
    ) {...AssetFragment}
}

Connectors

Microsoft Azure

Expected check: eq []

{
  kmsSecrets(where: { expires: "0000-01-01T00:00:00.000Z" }) {
    ...AssetFragment
  }
}

Connectors

Microsoft Azure

Expected check: eq []

{
  storageAccounts(where: { NOT: { supportsHttpsTrafficOnly: true } }) {
    ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

{
  ecsServices(where: {NOT: { platformVersion_IN: ["LATEST", ""] }}) {...AssetFragment}
}

Connectors

Google Cloud

Expected check: eq []

gkeClusters(where:{nodePools_SOME:{managementAutoRepair_NOT:true}}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

gkeClusters(where:{nodePools_SOME:{managementAutoUpgrade_NOT:true}}){...AssetFragment}

Connectors

Microsoft Azure

Expected check: eq []

{
  storageAccounts(
    where: {
      OR: [
        { blobServiceDeletePolicyEnabled: false }
        { blobServiceDeletePolicyDays: 0 }
        { containerDeleteRetentionPolicyEnabled: false }
        { containerDeleteRetentionPolicyDays: 0 }
      ]
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Alibaba CloudAWSGoogle CloudMicrosoft Azure

Expected check: eq []

{ objectContainers (where: {versioningEnabled: false}) {...AssetFragment} } 

Connectors

Google Cloud

Expected check: eq []

GCPLogging3{...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{ kmsKeys(where: {scheduleForDeletion: true, dataStores_SOME: { identifier_NOT: null }}) {...AssetFragment} }

Connectors

Microsoft Azure

Expected check: eq []

{ databases(where: { deletionPrevention: "disabled" }) {...AssetFragment} } 

Connectors

Google Cloud

Expected check: eq []

{ cloudSqlInstances (where: {deletionPrevention: "disabled"}) {...AssetFragment} }

Connectors

Alibaba Cloud

Expected check: eq []

{ dbInstances(where: { AND: [ {deletionPrevention: "disabled" } {OR: [{ dbCluster: null }{ dbCluster: { deletionProtection: false }}]}]}) {...AssetFragment} }

Connectors

Google Cloud

Expected check: eq []

{
  cloudSqlInstances(
    where: {
      engine: "sqlserver"
      cloudProvider: "gcp"
      dbFlags_SOME: { name: "external scripts enabled",value: "on" }
    }
  ) {
     ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

AWSIAM4{...AssetFragment}

Connectors

AWS

Expected check: eq []

kmsKeys(where:{automaticRotationEnabled:false, managementType:"CustomerManaged"}){...AssetFragment}

Connectors

AWS

Expected check: eq []

AWS130IAM19 {...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

vms(where:{hasVMMetadataItem_SOME:{key:"serial-port-enable",value:"true"}}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

disks(where:{encryptedWithCustomerSuppliedKey: false }){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

cloudSqlInstances(where:{settingsIPConfigurationRequireSsl:false}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

gkeClusters(where:{masterAuthorizedNetworksConfigEnabled_NOT:true}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

gkeClusters(where:{kubernetesDashboardDisabled:false}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

gkeClusters(where:{networkPolicyEnabled:false}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

gkeClusters(where:{ipAllocationPolicy_SOME:{useIPAliases:false}}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

managedZones(where:{hasDNSKeySpec_SOME:{keyType:"keySigning",algorithm_MATCHES:"(?i)rsasha1"}}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

managedZones(where:{hasDNSKeySpec_SOME:{keyType:"zoneSigning",algorithm_MATCHES:"(?i)rsasha1"}}){...AssetFragment}

Connectors

Google Cloud

Expected check: eq []

{
  loadBalancers(
    where: {OR: [
      {httpsProxies_SOME: {OR: [
        {sslPolicy: ""},
        {hasSSLPolicy: {OR: [
          {profile: "COMPATIBLE"},
          {AND: [{profile: "MODERN"}, {NOT: {minTlsVersion: "TLS_1_2"}}]},
          {AND: [
            {profile: "CUSTOM"}, 
            {OR: [
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_AES_128_GCM_SHA256"},
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_AES_256_GCM_SHA38"},
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_AES_128_CBC_SHA"},
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_AES_256_CBC_SHA"},
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_3DES_EDE_CBC_SHA"}
                ]
            }
          ]}
        ]}
        }
      ]}},
      {sslProxies_SOME: {OR: [
        {sslPolicy: ""},
        {hasSSLPolicy: {OR: [
          {profile: "COMPATIBLE"},
          {AND: [{profile: "MODERN"}, {NOT: {minTlsVersion: "TLS_1_2"}}]},
          {AND: [
            {profile: "CUSTOM"}, 
            {OR: [
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_AES_128_GCM_SHA256"},
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_AES_256_GCM_SHA38"},
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_AES_128_CBC_SHA"},
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_AES_256_CBC_SHA"},
                  {enabledFeatures_INCLUDES: "TLS_RSA_WITH_3DES_EDE_CBC_SHA"}
                ]
            }
          ]}
        ]}
        }
      ]}},
    ]}){
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

{
  appEngineServices(
    where: {
      serviceVersions_NONE: {
        urlHandlers_SOME: {
          urlRegex_IN: ["/.*", ".*"]
          securityLevel_IN: ["SECURE_ALWAYS"]
        }
      }
    }
  ) {
    ...AssetFragment
  }
}

Connectors

Google Cloud

Expected check: eq []

GCPIAM5{...AssetFragment}

Connectors

Microsoft Azure

Expected check: eq []

{
  functionApps(
    where: {
      applicationConfig: {
        settings_SOME: {
          type: "AppService"
          key_MATCHES: "(.*)(_*?)(key|pass|secret|salt|connectionstring|connection_string)(.*)"
        }
      }
    }
  ) {...AssetFragment}
}

Connectors

Microsoft Azure

Expected check: eq []

{
  sites(
    where: {
      applicationConfig: {
        settings_SOME: {
          type: "AppService"
          key_MATCHES: "(.*)(_*?)(key|pass|secret|salt|connectionstring|connection_string)(.*)"
        }
      }
    }
  ) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{vms(where:{OR:[{vpcID:null},{vpcID:""}]}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

{
  sageMakerNoteBooks(
    where: {
      kmsKey: null
    }
  ) {...AssetFragment}
}

Connectors

Google Cloud

Expected check: eq []

{gkeClusters(where: {nodePools_SOME: {nodeConfig_NOT: { imageType_MATCHES: "(?i).*cos.*" }}}) {...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

{
  vms(where: { diskAttachments_SOME: { NOT: { vhdURI: "" } } }) {
    ...AssetFragment
  }
}

Connectors

AWS

Expected check: eq []

{vms(where:{diskAttachments_SOME:{disk:{encrypted:false}},OR:[{name_MATCHES:"(?i).*database.*"},{name_MATCHES:"(?i).*db.*"},{name_MATCHES:"(?i).*mariadb.*"},{name_MATCHES:"(?i).*postgres.*"},{name_MATCHES:"(?i).*oracle.*"},{name_MATCHES:"(?i).*sql.*"}]}){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

{vms(where:{diskAttachments_SOME:{disk:{,encryptionKey:null}}}){...AssetFragment}}

Connectors

Alibaba Cloud

Expected check: eq []

vms(where:{diskAttachments_SOME:{disk: {encrypted:false}}}) {...AssetFragment}

Connectors

AWS

Expected check: eq []

buckets(where: { encrypted: false}) {...AssetFragment}

Connectors

Alibaba Cloud

Expected check: eq []

buckets(where: { OR:[{encryptionKeyIDFromProvider: "" },{encryptionKeyIDFromProvider: null }, {encryptionKey:null}]}){...AssetFragment}

Connectors

Microsoft Azure

Expected check: eq []

{storageAccounts(where:{byokEncrypted_NOT:true}){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

{disks(where:{diskState_MATCHES:"(?i)unattached",encryptionKey:null}){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

{StorageAccountsWithOldKeys{...AssetFragment}}

Connectors

Google Cloud

Expected check: eq []

GCP110IAM10{...AssetFragment}

Connectors

Alibaba CloudAWSGoogle CloudMicrosoft Azure

Expected check: eq []

{ EncryptionKeysExpiration(days: 14) {...AssetFragment} }

Connectors

AWS

Expected check: eq []

{
  EncryptionKeysRotationAWS(days: 90) {...AssetFragment}
}

Connectors

Google Cloud

Expected check: eq []

{
  EncryptionKeysRotation(days: 90) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{
  launchTemplateVersions(
    where: { blockDeviceMappings_SOME: { encrypted: "false" } }
  ) {...AssetFragment}
}

Connectors

AWS

Expected check: eq []

{ebsSettings(where: { encryptedByDefault: false }) {...AssetFragment}}

Connectors

AWS

Expected check: eq []

{snsTopics(where:{hasSNSTopicAttribute_NONE:{key:"KmsMasterKeyId",OR:[{value_NOT:null},{value_NOT:""}]}}){...AssetFragment}}

Connectors

AWS

Expected check: eq []

{dbInstances(where:{encrypted:false}){...AssetFragment}}

Connectors

Microsoft Azure

Expected check: eq []

{ mySqlServers (where: {encrypted: false}) {...AssetFragment} }

Connectors

Microsoft Azure

Expected check: eq []

{ mySqlFlexibleServers (where: {encrypted: false}) {...AssetFragment} }

Connectors

Microsoft Azure

Expected check: eq []

{ postgreSqlServers (where: {encrypted: false}) {...AssetFragment} }

Connectors

Microsoft Azure

Expected check: eq []

{ postgreSqlFlexibleServers (where: {encrypted: false}) {...AssetFragment} }