diff --git a/assets/queries/ansible/aws/s3_bucket_without_versioning/metadata.json b/assets/queries/ansible/aws/s3_bucket_without_versioning/metadata.json index 79f6f62dece..b7f62144077 100644 --- a/assets/queries/ansible/aws/s3_bucket_without_versioning/metadata.json +++ b/assets/queries/ansible/aws/s3_bucket_without_versioning/metadata.json @@ -2,7 +2,7 @@ "id": "9232306a-f839-40aa-b3ef-b352001da9a5", "queryName": "S3 Bucket Without Versioning", "severity": "MEDIUM", - "category": "Observability", + "category": "Backup", "descriptionText": "S3 bucket should have versioning enabled", "descriptionUrl": "https://docs.ansible.com/ansible/latest/collections/amazon/aws/s3_bucket_module.html#parameter-versioning", "platform": "Ansible", diff --git a/assets/queries/azureResourceManager/standard_price_not_selected/metadata.json b/assets/queries/azureResourceManager/standard_price_not_selected/metadata.json index 6a9516facbb..b10e68aa97f 100644 --- a/assets/queries/azureResourceManager/standard_price_not_selected/metadata.json +++ b/assets/queries/azureResourceManager/standard_price_not_selected/metadata.json @@ -2,7 +2,7 @@ "id": "2081c7d6-2851-4cce-bda5-cb49d462da42", "queryName": "Standard Price Is Not Selected", "severity": "LOW", - "category": "Networking and Firewall", + "category": "Resource Management", "descriptionText": "Azure Security Center provides more features for standard pricing mode, so it must be activated.", "descriptionUrl": "https://docs.microsoft.com/en-us/azure/templates/microsoft.security/pricings?tabs=json#pricingproperties-object", "platform": "AzureResourceManager", diff --git a/assets/queries/cloudFormation/aws/iam_groups_inline_policies/metadata.json b/assets/queries/cloudFormation/aws/iam_groups_inline_policies/metadata.json index 71ce2b1bf3e..cb2b5f85810 100644 --- a/assets/queries/cloudFormation/aws/iam_groups_inline_policies/metadata.json +++ b/assets/queries/cloudFormation/aws/iam_groups_inline_policies/metadata.json @@ -2,7 +2,7 @@ "id": "a58d1a2d-4078-4b80-855b-84cc3f7f4540", "queryName": "IAM Group Inline Policies", "severity": "MEDIUM", - "category": "Encryption", + "category": "Access Control", "descriptionText": "IAM Groups should not use inline policies and instead use managed policies. If a group is deleted, the inline policy is also deleted", "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-group.html", "platform": "CloudFormation", diff --git a/assets/queries/cloudFormation/aws/iam_user_login_profile_password_is_in_plaintext/metadata.json b/assets/queries/cloudFormation/aws/iam_user_login_profile_password_is_in_plaintext/metadata.json index 79049783874..5d8887fe523 100644 --- a/assets/queries/cloudFormation/aws/iam_user_login_profile_password_is_in_plaintext/metadata.json +++ b/assets/queries/cloudFormation/aws/iam_user_login_profile_password_is_in_plaintext/metadata.json @@ -2,7 +2,7 @@ "id": "06adef8c-c284-4de7-aad2-af43b07a8ca1", "queryName": "IAM User LoginProfile Password Is In Plaintext", "severity": "HIGH", - "category": "Insecure Configurations", + "category": "Secret Management", "descriptionText": "IAM User LoginProfile Password must not be a plaintext string", "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-user.html", "platform": "CloudFormation", diff --git a/assets/queries/cloudFormation/aws/rds_multi_az_deployment_disabled/metadata.json b/assets/queries/cloudFormation/aws/rds_multi_az_deployment_disabled/metadata.json index ea95757bab3..c60db4f8f2d 100644 --- a/assets/queries/cloudFormation/aws/rds_multi_az_deployment_disabled/metadata.json +++ b/assets/queries/cloudFormation/aws/rds_multi_az_deployment_disabled/metadata.json @@ -2,7 +2,7 @@ "id": "2b1d4935-9acf-48a7-8466-10d18bf51a69", "queryName": "RDS Multi-AZ Deployment Disabled", "severity": "MEDIUM", - "category": "Backup", + "category": "Availability", "descriptionText": "AWS RDS Instance should have a multi-az deployment", "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html", "platform": "CloudFormation", diff --git a/assets/queries/cloudFormation/aws/s3_bucket_without_versioning/metadata.json b/assets/queries/cloudFormation/aws/s3_bucket_without_versioning/metadata.json index 190ab58609a..b2842d7b4e9 100644 --- a/assets/queries/cloudFormation/aws/s3_bucket_without_versioning/metadata.json +++ b/assets/queries/cloudFormation/aws/s3_bucket_without_versioning/metadata.json @@ -2,7 +2,7 @@ "id": "a227ec01-f97a-4084-91a4-47b350c1db54", "queryName": "S3 Bucket Without Versioning", "severity": "MEDIUM", - "category": "Observability", + "category": "Backup", "descriptionText": "S3 bucket should have versioning enabled", "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket.html", "platform": "CloudFormation", diff --git a/assets/queries/cloudFormation/aws/unscanned_ecr_image/metadata.json b/assets/queries/cloudFormation/aws/unscanned_ecr_image/metadata.json index 6ab0fcb2df5..0ff4cac917e 100644 --- a/assets/queries/cloudFormation/aws/unscanned_ecr_image/metadata.json +++ b/assets/queries/cloudFormation/aws/unscanned_ecr_image/metadata.json @@ -2,7 +2,7 @@ "id": "9025b2b3-e554-4842-ba87-db7aeec36d35", "queryName": "Unscanned ECR Image", "severity": "LOW", - "category": "Encryption", + "category": "Observability", "descriptionText": "Checks if the ECR Image has been scanned", "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecr-repository.html#cfn-ecr-repository-imagescanningconfiguration", "platform": "CloudFormation", diff --git a/assets/queries/crossplane/azure/redis_cache_allows_non_ssl_connections/metadata.json b/assets/queries/crossplane/azure/redis_cache_allows_non_ssl_connections/metadata.json index 02f94330109..46a3aa51d65 100644 --- a/assets/queries/crossplane/azure/redis_cache_allows_non_ssl_connections/metadata.json +++ b/assets/queries/crossplane/azure/redis_cache_allows_non_ssl_connections/metadata.json @@ -2,7 +2,7 @@ "id": "6c7cfec3-c686-4ed2-bf58-a1ec054b63fc", "queryName": "Redis Cache Allows Non SSL Connections", "severity": "MEDIUM", - "category": "Encryption", + "category": "Insecure Configurations", "descriptionText": "Redis Cache resource should not allow non-SSL connections.", "descriptionUrl": "https://doc.crds.dev/github.com/crossplane/provider-azure/cache.azure.crossplane.io/Redis/v1beta1@v0.19.0#spec-forProvider-enableNonSslPort", "platform": "Crossplane", diff --git a/assets/queries/dockerfile/unix_ports_out_of_range/metadata.json b/assets/queries/dockerfile/unix_ports_out_of_range/metadata.json index 02afbd66e60..943230750f3 100644 --- a/assets/queries/dockerfile/unix_ports_out_of_range/metadata.json +++ b/assets/queries/dockerfile/unix_ports_out_of_range/metadata.json @@ -2,11 +2,12 @@ "id": "71bf8cf8-f0a1-42fa-b9d2-d10525e0a38e", "queryName": "UNIX Ports Out Of Range", "severity": "INFO", - "category": "Availability", + "category": "Networking and Firewall", "descriptionText": "Exposing UNIX ports out of range from 0 to 65535", "descriptionUrl": "https://docs.docker.com/engine/reference/builder/#expose", "platform": "Dockerfile", "descriptionID": "fed3d812", "cwe": "682", - "oldSeverity": "HIGH" + "oldSeverity": "HIGH", + "cloudProvider" : "common" } \ No newline at end of file diff --git a/assets/queries/pulumi/azure/redis_cache_allows_non_ssl_connections/metadata.json b/assets/queries/pulumi/azure/redis_cache_allows_non_ssl_connections/metadata.json index 121375da5f6..86cbcee9c64 100644 --- a/assets/queries/pulumi/azure/redis_cache_allows_non_ssl_connections/metadata.json +++ b/assets/queries/pulumi/azure/redis_cache_allows_non_ssl_connections/metadata.json @@ -2,7 +2,7 @@ "id": "49e30ac8-f58e-4222-b488-3dcb90158ec1", "queryName": "Redis Cache Allows Non SSL Connections", "severity": "MEDIUM", - "category": "Encryption", + "category": "Insecure Configurations", "descriptionText": "Redis Cache resource should not allow non-SSL connections.", "descriptionUrl": "https://www.pulumi.com/registry/packages/azure-native/api-docs/cache/redis/#enablenonsslport_yaml", "platform": "Pulumi", diff --git a/assets/queries/terraform/aws/default_vpc_exists/metadata.json b/assets/queries/terraform/aws/default_vpc_exists/metadata.json index 88d252ee8be..285f3ce5eea 100644 --- a/assets/queries/terraform/aws/default_vpc_exists/metadata.json +++ b/assets/queries/terraform/aws/default_vpc_exists/metadata.json @@ -2,7 +2,7 @@ "id": "96ed3526-0179-4c73-b1b2-372fde2e0d13", "queryName": "Default VPC Exists", "severity": "MEDIUM", - "category": "Observability", + "category": "Insecure Defaults", "descriptionText": "It isn't recommended to use resources in default VPC", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_vpc", "platform": "Terraform", diff --git a/assets/queries/terraform/aws/rds_cluster_with_backup_disabled/metadata.json b/assets/queries/terraform/aws/rds_cluster_with_backup_disabled/metadata.json index 91a0e79daea..b171cc3e358 100644 --- a/assets/queries/terraform/aws/rds_cluster_with_backup_disabled/metadata.json +++ b/assets/queries/terraform/aws/rds_cluster_with_backup_disabled/metadata.json @@ -2,7 +2,7 @@ "id": "e542bd46-58c4-4e0f-a52a-1fb4f9548e02", "queryName": "RDS Cluster With Backup Disabled", "severity": "MEDIUM", - "category": "Best Practices", + "category": "Backup", "descriptionText": "RDS Cluster backup retention period should be specifically defined", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#backup_retention_period", "platform": "Terraform", diff --git a/assets/queries/terraform/aws/redis_disabled/metadata.json b/assets/queries/terraform/aws/redis_disabled/metadata.json index c49011d5fcb..80d29f5bbe0 100644 --- a/assets/queries/terraform/aws/redis_disabled/metadata.json +++ b/assets/queries/terraform/aws/redis_disabled/metadata.json @@ -2,7 +2,7 @@ "id": "4bd15dd9-8d5e-4008-8532-27eb0c3706d3", "queryName": "Redis Disabled", "severity": "LOW", - "category": "Encryption", + "category": "Insecure Configurations", "descriptionText": "ElastiCache should have Redis enabled, since it covers Compliance Certifications such as FedRAMP, HIPAA, and PCI DSS. For more information, take a look at 'https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/SelectEngine.html'", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_cluster#engine", "platform": "Terraform", diff --git a/assets/queries/terraform/aws/s3_bucket_without_versioning/metadata.json b/assets/queries/terraform/aws/s3_bucket_without_versioning/metadata.json index 895791a2dc5..d368b408d3f 100755 --- a/assets/queries/terraform/aws/s3_bucket_without_versioning/metadata.json +++ b/assets/queries/terraform/aws/s3_bucket_without_versioning/metadata.json @@ -2,7 +2,7 @@ "id": "568a4d22-3517-44a6-a7ad-6a7eed88722c", "queryName": "S3 Bucket Without Versioning", "severity": "MEDIUM", - "category": "Observability", + "category": "Backup", "descriptionText": "S3 bucket should have versioning enabled", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#versioning", "platform": "Terraform", diff --git a/assets/queries/terraform/aws/unscanned_ecr_image/metadata.json b/assets/queries/terraform/aws/unscanned_ecr_image/metadata.json index dfc8017cee6..b290d8673ee 100644 --- a/assets/queries/terraform/aws/unscanned_ecr_image/metadata.json +++ b/assets/queries/terraform/aws/unscanned_ecr_image/metadata.json @@ -2,7 +2,7 @@ "id": "9630336b-3fed-4096-8173-b9afdfe346a7", "queryName": "Unscanned ECR Image", "severity": "LOW", - "category": "Encryption", + "category": "Observability", "descriptionText": "Checks if the ECR Image has been scanned", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository#scan_on_push", "platform": "Terraform", diff --git a/assets/queries/terraform/gcp/user_with_iam_role/metadata.json b/assets/queries/terraform/gcp/user_with_iam_role/metadata.json index 6ef514a9bf5..d2d06a93216 100644 --- a/assets/queries/terraform/gcp/user_with_iam_role/metadata.json +++ b/assets/queries/terraform/gcp/user_with_iam_role/metadata.json @@ -2,7 +2,7 @@ "id": "704fcc44-a58f-4af5-82e2-93f2a58ef918", "queryName": "User with IAM Role", "severity": "LOW", - "category": "Best Practices", + "category": "Access Control", "descriptionText": "As a best practice, it is better to assign an IAM Role to a group than to a user", "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/iam_policy#role", "platform": "Terraform", diff --git a/e2e/fixtures/E2E_CLI_092_RESULT.json b/e2e/fixtures/E2E_CLI_092_RESULT.json index ace32aaf20a..9c6dcb59048 100644 --- a/e2e/fixtures/E2E_CLI_092_RESULT.json +++ b/e2e/fixtures/E2E_CLI_092_RESULT.json @@ -87,7 +87,7 @@ "severity": "MEDIUM", "platform": "CloudFormation", "cloud_provider": "AWS", - "category": "Backup", + "category": "Availability", "experimental": false, "description": "AWS RDS Instance should have a multi-az deployment", "description_id": "4bdb6677",