Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enhanced Defender license warnings for policy groups 2 and 4 #929

Conversation

Dylan-MITRE
Copy link
Contributor

@Dylan-MITRE Dylan-MITRE commented Feb 21, 2024

🗣 Description

Add licenses check for policy groups 2 and 4 in addition to the current check, make the report details more precise. And let user be more aware of the missing licenses.

💭 Motivation and context

closes #599

🧪 Testing

Run Scuba for Defender
Change the json file mainly "defender_license" to "false"
Run Scuba for Defender again
Will see warning about Defender license missing during the run
Will see notes on reports indicates license missing

Note: the check for policy group 2 and 4 will still pass or fail based on the environment setting because we are modifying the json file from an tenant with required licenses. The result is still be accurate based on the environment information. Note that, normally it will fail if they don't have license due to missing information from the provider JSON.

✅ Pre-approval checklist

  • This PR has an informative and human-readable title.
  • PR targets the correct parent branch (e.g., main or release-name) for merge.
  • Changes are limited to a single goal - eschew scope creep!
  • Changes are sized such that they do not touch excessive number of files.
  • All future TODOs are captured in issues, which are referenced in code comments.
  • These code changes follow the ScubaGear content style guide.
  • Related issues these changes resolve are linked preferably via closing keywords.
  • All relevant type-of-change labels added.
  • All relevant project fields are set.
  • All relevant repo and/or project documentation updated to reflect these changes.
  • Unit tests added/updated to cover PowerShell and Rego changes.
  • Functional tests added/updated to cover PowerShell and Rego changes.
  • All relevant functional tests passed.
  • All automated checks (e.g., linting, static analysis, unit/smoke tests) passed.

✅ Pre-merge checklist

  • PR passed smoke test check.

  • Feature branch has been rebased against changes from parent branch, as needed

    Use Rebase branch button below or use this reference to rebase from the command line.

  • Resolved all merge conflicts on branch

  • Notified merge coordinator that PR is ready for merge via comment mention

✅ Post-merge checklist

  • Feature branch deleted after merge to clean up repository.
  • Verified that all checks pass on parent branch (e.g., main or release-name) after merge.

@Dylan-MITRE Dylan-MITRE linked an issue Feb 21, 2024 that may be closed by this pull request
@Dylan-MITRE Dylan-MITRE changed the title 599 missing licenses not reported for defender policy groups 2 and 4 Add licenses check for policy groups 2 and 4 Feb 22, 2024
@Dylan-MITRE Dylan-MITRE self-assigned this Feb 22, 2024
@Dylan-MITRE Dylan-MITRE added the bug This issue or pull request addresses broken functionality label Feb 22, 2024
@Dylan-MITRE Dylan-MITRE added this to the Glacier milestone Feb 22, 2024
@Dylan-MITRE Dylan-MITRE force-pushed the 599-missing-licenses-not-reported-for-defender-policy-groups-2-and-4 branch from 1e35219 to dc3dc6e Compare February 22, 2024 18:23
@Dylan-MITRE Dylan-MITRE marked this pull request as ready for review February 22, 2024 19:48
Copy link
Collaborator

@schrolla schrolla left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The licensing relationship to policy group 4, particularly 4.2 is a bit more granular and tricky than just adding a warning. This might require some additional thinking about how best to report status on a policy item that contains a mix of both license required and non-license required items. Technically, without the license a tenant cannot meet the requirement, but without details about specific locations the admin doesn't have sufficient feedback to determine if the issue is due to license, DLP policy config, or a combination of both. See full comments below.

PowerShell/ScubaGear/Rego/DefenderConfig.rego Outdated Show resolved Hide resolved
PowerShell/ScubaGear/Rego/DefenderConfig.rego Outdated Show resolved Hide resolved
PowerShell/ScubaGear/Rego/DefenderConfig.rego Outdated Show resolved Hide resolved
PowerShell/ScubaGear/Rego/DefenderConfig.rego Outdated Show resolved Hide resolved
PowerShell/ScubaGear/Rego/Utils/Defender.rego Outdated Show resolved Hide resolved
Copy link
Collaborator

@schrolla schrolla left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Getting closer, but recommend additional code to better delineate which locations are not meeting the baseline rather than a generic message. See comments below.

@Dylan-MITRE Dylan-MITRE linked an issue Mar 7, 2024 that may be closed by this pull request
@Dylan-MITRE
Copy link
Contributor Author

Also added fix for powershell bugs #976

@Dylan-MITRE Dylan-MITRE force-pushed the 599-missing-licenses-not-reported-for-defender-policy-groups-2-and-4 branch from 1a644f8 to 9b00f72 Compare March 13, 2024 13:11
@schrolla schrolla assigned schrolla and unassigned Dylan-MITRE Mar 14, 2024
@schrolla schrolla requested review from Sloane4 and removed request for schrolla March 14, 2024 15:14
@schrolla schrolla force-pushed the 599-missing-licenses-not-reported-for-defender-policy-groups-2-and-4 branch from f996684 to 81f2021 Compare March 18, 2024 14:19
@rgbrow1949 rgbrow1949 modified the milestones: Glacier, Halibut Mar 28, 2024
@schrolla schrolla force-pushed the 599-missing-licenses-not-reported-for-defender-policy-groups-2-and-4 branch 2 times, most recently from b952bc7 to ccafb10 Compare April 12, 2024 14:41
@schrolla schrolla force-pushed the 599-missing-licenses-not-reported-for-defender-policy-groups-2-and-4 branch from ccafb10 to 6d0ab73 Compare May 9, 2024 13:40
@schrolla schrolla removed the request for review from isab-m May 10, 2024 18:53
@schrolla schrolla force-pushed the 599-missing-licenses-not-reported-for-defender-policy-groups-2-and-4 branch from 06246ed to 621d1a6 Compare May 30, 2024 21:36
Copy link
Collaborator

@buidav buidav left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Functionally works great.
Biggest issue is to fix the new dlp_license key naming.

schrolla and others added 2 commits May 30, 2024 21:16
@buidav buidav self-requested a review May 31, 2024 03:33
Copy link
Collaborator

@buidav buidav left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!

@schrolla
Copy link
Collaborator

@nanda-katikaneni This PR is ready for merge.

@nanda-katikaneni nanda-katikaneni merged commit dbb8209 into main May 31, 2024
16 checks passed
@nanda-katikaneni nanda-katikaneni deleted the 599-missing-licenses-not-reported-for-defender-policy-groups-2-and-4 branch May 31, 2024 12:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug This issue or pull request addresses broken functionality
Projects
None yet
6 participants