Implement CIS 1.3.7 - Third-party storage services restriction - #312
Implement CIS 1.3.7 - Third-party storage services restriction#312UmerA3653 wants to merge 2 commits into
Conversation
- metadata.json incorrectly mapped 1.3.7 to the OWA mailbox policy collector (which actually powers 6.5.3). Confirmed via CIS benchmark audit text that 1.3.7 checks the 'Third Party Storage Services' service principal in Entra ID instead. - Add new Graph-based collector (entra.applications.third_party_storage_services) - Add Rego policy + unit tests (4 cases, all passing) - Update metadata.json: automation_status=ready, correct collector, policy_file, and requires_permissions - Verified end-to-end via structural pytest suite (438 passed) and a live scan against the sandbox tenant
Preview EnvironmentA preview environment can be spun up on demand for this PR.
|
CI: Engine
One or more checks failed. View logs |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 664b49c06f
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| except Exception as exc: | ||
| collector_error = str(exc) |
There was a problem hiding this comment.
When the /servicePrincipals request raises (for example because Application.Read.All was not consented, Graph throttles, or the network times out), this handler only records collector_error and leaves service_principal as None; the return below therefore sends service_principal_exists: false, and the new policy reports the control as a normal non-compliant tenant rather than letting evaluate_control retry or mark an error (engine/worker/tasks.py:299-310). That produces false compliance failures and misleading evidence for collection failures, so propagate the exception or model an explicit unknown/error state.
Useful? React with 👍 / 👎.
…arty-storage # Please enter a commit message to explain why this merge is necessary, # especially if it merges an updated upstream into a topic branch. # # Lines starting with '#' will be ignored, and an empty message aborts # the commit.
1 participant
Implements CIS control 1.3.7 (restrict third-party storage services in Microsoft 365 on the web).
While working on this, I found that metadata.json had 1.3.7 pointing to the wrong collector — it was set to the same collector used by control 6.5.3, but 1.3.7 actually needs to check something different (a service principal setting in Entra ID, not an Exchange setting). Confirmed this against the official CIS benchmark documentation.
What this PR adds:
Tested and confirmed working:
Summary
Implements control 1.3.7, including fixing an incorrect collector mapping found in metadata.json.
Type of Change