Implement CIS 3.1.1 audit log search control

[Alsewedy]

Summary

Implements CIS 3.1.1 by adding the Rego policy and updating the control metadata to verify that Microsoft 365 audit log search is enabled.

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactor / code cleanup
• Documentation
• CI/CD / infrastructure
• Security

Affected Components

• /backend-api
• /frontend
• /engine (collectors / policies)
• /security
• /infrastructure
• /.github/workflows
• /docs

Motivation

This control is required to automate CIS 3.1.1 and verify that audit log search is enabled.

Testing Done

• Unit tests pass locally
• Tested manually — describe how:
• No tests required — explain why:

Security Considerations

Breaking Changes

• No breaking changes
• Yes — describe below:

Rollback Plan

• Revert commit is sufficient
• Requires additional steps — describe below:

Checklist

• Code follows project conventions
• No secrets, credentials, or tokens committed
• Relevant documentation updated (if applicable)
• CI/CD workflows pass on this branch
• PR is focused on one thing

Screenshots

[github-actions]

Preview Environment

A preview environment can be spun up on demand for this PR.

Action	Label	Includes
Spin up preview	deploy-preview	Frontend, backend, database, Redis, OPA, worker
Spin up preview with M365	deploy-preview-m365	Everything above + PowerShell service for Exchange/Teams scan testing
Tear down preview	teardown-preview	Stops the environment early

The environment will also be torn down automatically when the PR is closed or merged.
Preview URLs will appear in a follow-up comment once the deploy completes (~5–8 min).
M365 scans require real tenant credentials added through the frontend UI.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5b630a1127

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Check UnifiedAuditLogIngestionEnabled for 3.1.1

For tenants where mailbox auditing-on-by-default is enabled (AuditDisabled=false) but Purview unified audit log ingestion is off, this returns compliant even though CIS 3.1.1 should fail. The benchmark text in docs/engine/Framework/CIS_M365_Benchmarks.json:496 audits Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled and requires it to be True; AuditDisabled is the separate 6.1.1 mailbox-auditing control, so this new ready control duplicates 6.1.1 and misses disabled audit-log search.

Useful? React with 👍 / 👎.

[github-actions]

CI: Engine

Job	Result
Security analysis (CodeQL)	✅ success
Lint	✅ success
Tests	✅ success

All checks passed.