auditor

Documentation

Index

• Constants
• type AuditConfiLogAnalytics
  • func (config *AuditConfiLogAnalytics) IsEnabled() bool
• type AuditConfig
• type AuditConfigResourceGraph
  • func (config *AuditConfigResourceGraph) IsEnabled() bool
• type AzureAuditor
  • func NewAzureAuditor() *AzureAuditor
  • func (auditor *AzureAuditor) GetConfig() AuditConfig
  • func (auditor *AzureAuditor) GetReport() map[string]*AzureAuditorReport
  • func (auditor *AzureAuditor) Init()
  • func (auditor *AzureAuditor) MetricsLock() *sync.RWMutex
  • func (auditor *AzureAuditor) Reload()
  • func (auditor *AzureAuditor) ReportLock() *sync.RWMutex
  • func (auditor *AzureAuditor) Run()
  • func (auditor *AzureAuditor) SetConfigs(configPaths ...string)
• type AzureAuditorReport
  • func NewAzureAuditorReport() *AzureAuditorReport
  • func (report *AzureAuditorReport) Add(resource *validator.AzureObject, ruleID string, status types.RuleStatus)
  • func (report *AzureAuditorReport) Clear()
• type AzureAuditorReportLine
  • func (reportLine *AzureAuditorReportLine) Hash() [20]byte
  • func (reportLine *AzureAuditorReportLine) MarshalJSON() ([]byte, error)
• type AzureAuditorReportSummary
• type LogAnaltyicsQueryResult

Constants

const (
	ReportKeyvaultAccessPolicies   = "KeyvaultAccessPolicy"
	ReportResourceProviders        = "ResourceProvider"
	ReportResourceProviderFeatures = "ResourceProviderFeature"
	ReportResourceGroups           = "ResourceGroup"
	ReportRoleAssignments          = "RoleAssignment"
	ReportResourceGraph            = "ResourceGraph:%v"
	ReportLogAnalytics             = "LogAnalytics:%v"
)

const (
	OperationInsightsWorkspaceUrlSuffix = "/v1"
)

const (
	ResourceGraphQueryOptionsTop = 1000
)

Types

type AuditConfiLogAnalytics

type AuditConfiLogAnalytics struct {
	Enabled bool                                        `yaml:"enabled"`
	Queries map[string]*validator.AuditConfigValidation `yaml:"queries"`
}

func (*AuditConfiLogAnalytics) IsEnabled

func (config *AuditConfiLogAnalytics) IsEnabled() bool

type AuditConfig

type AuditConfig struct {
	RoleAssignments          *validator.AuditConfigValidation `yaml:"roleAssignments"`
	ResourceGroups           *validator.AuditConfigValidation `yaml:"resourceGroups"`
	ResourceProviders        *validator.AuditConfigValidation `yaml:"resourceProviders"`
	ResourceProviderFeatures *validator.AuditConfigValidation `yaml:"resourceProviderFeatures"`
	KeyvaultAccessPolicies   *validator.AuditConfigValidation `yaml:"keyvaultAccessPolicies"`
	ResourceGraph            *AuditConfigResourceGraph        `yaml:"resourceGraph"`
	LogAnalytics             *AuditConfiLogAnalytics          `yaml:"logAnalytics"`
}

type AuditConfigResourceGraph

type AuditConfigResourceGraph struct {
	Enabled bool                                        `yaml:"enabled"`
	Queries map[string]*validator.AuditConfigValidation `yaml:"queries"`
}

func (*AuditConfigResourceGraph) IsEnabled

func (config *AuditConfigResourceGraph) IsEnabled() bool

type AzureAuditor

type AzureAuditor struct {
	UserAgent string
	Opts      config.Opts

	Logger *zap.SugaredLogger
	// contains filtered or unexported fields
}

func NewAzureAuditor

func NewAzureAuditor() *AzureAuditor

func (*AzureAuditor) GetConfig

func (auditor *AzureAuditor) GetConfig() AuditConfig

func (*AzureAuditor) GetReport

func (auditor *AzureAuditor) GetReport() map[string]*AzureAuditorReport

func (*AzureAuditor) Init

func (auditor *AzureAuditor) Init()

func (*AzureAuditor) MetricsLock

func (auditor *AzureAuditor) MetricsLock() *sync.RWMutex

func (*AzureAuditor) Reload

func (auditor *AzureAuditor) Reload()

func (*AzureAuditor) ReportLock

func (auditor *AzureAuditor) ReportLock() *sync.RWMutex

func (*AzureAuditor) Run

func (auditor *AzureAuditor) Run()

func (*AzureAuditor) SetConfigs

func (auditor *AzureAuditor) SetConfigs(configPaths ...string)

type AzureAuditorReport

type AzureAuditorReport struct {
	Summary    *AzureAuditorReportSummary
	Lines      []*AzureAuditorReportLine
	UpdateTime *time.Time
	// contains filtered or unexported fields
}

func NewAzureAuditorReport

func NewAzureAuditorReport() *AzureAuditorReport

func (*AzureAuditorReport) Add

func (report *AzureAuditorReport) Add(resource *validator.AzureObject, ruleID string, status types.RuleStatus)

func (*AzureAuditorReport) Clear

func (report *AzureAuditorReport) Clear()

type AzureAuditorReportLine

type AzureAuditorReportLine struct {
	Resource map[string]interface{} `json:"resource"`
	RuleID   string                 `json:"rule"`
	GroupBy  interface{}            `json:"groupBy"`
	Status   string                 `json:"status"`
	Count    uint64                 `json:"count"`
}

func (*AzureAuditorReportLine) Hash

func (reportLine *AzureAuditorReportLine) Hash() [20]byte

func (*AzureAuditorReportLine) MarshalJSON

func (reportLine *AzureAuditorReportLine) MarshalJSON() ([]byte, error)

type AzureAuditorReportSummary

type AzureAuditorReportSummary struct {
	Ignore int64
	Deny   int64
	Allow  int64
}

type LogAnaltyicsQueryResult

type LogAnaltyicsQueryResult struct {
	Tables *[]struct {
		Name    string `json:"name"`
		Columns *[]struct {
			Name *string `json:"name"`
			Type *string `json:"type"`
		} `json:"columns"`
		Rows *[][]interface{} `json:"rows"`
	} `json:"tables"`
}