openapi: 3.1.0
info:
  title: InsightCloudSec API
  description: "<p>Welcome to the reference documentation for the public APIs (v3) available for InsightCloudSec.</p>\n\t\t<p>Here are a few resources to help start using our APIs:</p>\n\t\t<ul>\n\t\t<li><a href='https://docs.rapid7.com/insightcloudsec/api-documentation'>Learn about basic InsightCloudSec API concepts and capabilities</a></li>\n\t\t<li><a href='https://docs.rapid7.com/insightcloudsec/api/v2/#operation/create-api-key'>Get an InsightCloudSec API key to set up authentication</a></li>\n\t\t<li><a href='https://docs.rapid7.com/insightcloudsec/welcome-to-insightcloudsec'>Learn more about InsightCloudSec</a></li>\n\t\t</ul>\n\t\t<p>After you’ve got the basics down, you can effectively interact with the sample requests and responses found in this file.</p>"
  contact:
    name: Rapid7 Support
    url: https://support.rapid7.com
    email: support@rapid7.com
  version: v3
servers:
  - url: https://{insightcloudsecUrl}/v3
    variables:
      insightcloudsecUrl:
        default: my.insightcloudsec.com
security:
  - Api-Key: []
tags: []
paths:
  /external-data/sources:
    get:
      summary: Get Data Sources
      description: List existing external data sources
      operationId: get-data-sources
      parameters:
        - name: source_type
          in: query
          description: Specifies the data should be an external resource.
          schema:
            type: string
          required: true
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: |-
                    [
                      {
                        "source_id": "divvyexternaldatasource:1:resource_external:test_source", 
                        "organization_id": 1, 
                        "source_type": "resource_external", 
                        "source_name": "test_source", 
                        "remote_bucket_config": {
                          "organization_id": 1, 
                          "enabled": true, 
                          "region": "us-east-1", 
                          "name": "test_bucket", 
                          "file_name": "external_data.json", 
                          "credentials": {
                            "type": 0, 
                            "org_service_id": 227
                          }
                        }, 
                        "cloud_type_id": "AWS", 
                        "last_success": null, 
                        "last_failure": null, 
                        "last_modified": "2021-04-16T18:56:03Z"
                      }
                    ]
              schema:
                type: array
                items:
                  type: object
                  properties:
                    source_id:
                      type: string
                      example: divvyexternaldatasource:1:resource_external:test_source
                    organization_id:
                      type: integer
                      example: 1
                      default: 0
                    source_type:
                      type: string
                      example: resource_external
                    source_name:
                      type: string
                      example: test_source
                    remote_bucket_config:
                      type: object
                      properties:
                        organization_id:
                          type: integer
                          example: 1
                          default: 0
                        enabled:
                          type: boolean
                          example: true
                          default: true
                        region:
                          type: string
                          example: us-east-1
                        name:
                          type: string
                          example: test_bucket
                        file_name:
                          type: string
                          example: external_data.json
                        credentials:
                          type: object
                          properties:
                            type:
                              type: integer
                              example: 0
                              default: 0
                            org_service_id:
                              type: integer
                              example: 227
                              default: 0
                    cloud_type_id:
                      type: string
                      example: AWS
                    last_success: {}
                    last_failure: {}
                    last_modified:
                      type: string
                      example: '2021-04-16T18:56:03Z'
      deprecated: false
    post:
      summary: Create Data Source
      description: Create an external data source from a .json file contained within an AWS S3 bucket
      operationId: create-data-source
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - source_type
                - source_name
                - remote_bucket_config
                - cloud_type_id
              properties:
                source_type:
                  type: string
                  description: 'Type of data source. This cannot be changed once created. Available options: ''resource_external'''
                  default: resource_external
                source_name:
                  type: string
                  description: Name for the data source. This cannot be changed once created. If the source name already exists, the request will fail.
                remote_bucket_config:
                  type: object
                  description: Configuration information for the remote bucket storing the external data.
                  required:
                    - enabled
                    - region
                    - name
                    - file_name
                  properties:
                    enabled:
                      type: boolean
                      description: Whether the source is enabled. Must be 'true' to be used
                    region:
                      type: string
                      description: The region where the bucket is located
                    name:
                      type: string
                      description: The name of the bucket
                    file_name:
                      type: string
                      description: File name that contains the external data. Must be a .json file. If the file is nested under a folder, the file name should be prefixed with the appropriate directory path
                    credentials:
                      type: object
                      description: Credentials for accessing the bucket
                      required:
                        - type
                      properties:
                        type:
                          type: integer
                          description: 'Type of authentication used for the bucket. Available options: ''0'' (Re-use organization credentials), ''1'' (Long-term credentials), ''2'' (Instance Assume Role), ''3'' (STS Assume Role)'
                          format: int32
                        org_service_id:
                          type: integer
                          description: The unique identifier for the organization whose credentials will be re-used
                          format: int32
                        api_key:
                          type: string
                          description: AWS Access key ID
                        secret_key:
                          type: string
                          description: AWS Secret Access key
                        role_name:
                          type: string
                          description: The role ARN used to access the bucket
                        session_name:
                          type: string
                          description: The name to use for the session while connected to AWS
                        external_id:
                          type: string
                          description: A unique external identifier to assist in identifying the correct organization
                        role_duration_min:
                          type: string
                          description: Session length for accessing the organization information
                cloud_type_id:
                  type: string
                  description: 'Unique identifier signifying the bucket''s cloud type. Available options: ''AWS'''
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: |-
                    {
                      "source_id": "divvyexternaldatasource:1:resource_external:test_source", 
                      "organization_id": 1, 
                      "source_type": "resource_external", 
                      "source_name": "test_source", 
                      "remote_bucket_config": {
                        "organization_id": 1, 
                        "enabled": true, 
                        "region": "us-east-1", 
                        "name": "test_bucket", 
                        "file_name": "external_data.json", 
                        "credentials": {
                          "type": 0, 
                          "org_service_id": 227
                        }
                      }, 
                      "cloud_type_id": "AWS", 
                      "last_success": null, 
                      "last_failure": null, 
                      "last_modified": null
                    }
              schema:
                type: object
                properties:
                  source_id:
                    type: string
                    example: divvyexternaldatasource:1:resource_external:test_source
                  organization_id:
                    type: integer
                    example: 1
                    default: 0
                  source_type:
                    type: string
                    example: resource_external
                  source_name:
                    type: string
                    example: test_source
                  remote_bucket_config:
                    type: object
                    properties:
                      organization_id:
                        type: integer
                        example: 1
                        default: 0
                      enabled:
                        type: boolean
                        example: true
                        default: true
                      region:
                        type: string
                        example: us-east-1
                      name:
                        type: string
                        example: test_bucket
                      file_name:
                        type: string
                        example: external_data.json
                      credentials:
                        type: object
                        properties:
                          type:
                            type: integer
                            example: 0
                            default: 0
                          org_service_id:
                            type: integer
                            example: 227
                            default: 0
                  cloud_type_id:
                    type: string
                    example: AWS
                  last_success: {}
                  last_failure: {}
                  last_modified: {}
      deprecated: false
  /external-data/sources/{source_id}:
    delete:
      summary: Delete Data Source
      description: Delete an existing data source
      operationId: delete-data-source
      parameters:
        - name: source_id
          in: path
          description: Unique identifier for the existing data source
          schema:
            type: string
          required: true
      responses:
        '204':
          description: '204'
          content:
            application/json:
              examples:
                Result:
                  value: ''
      deprecated: false
    put:
      summary: Update Data Source
      description: Alters characteristics of an existing data source
      operationId: update-data-source
      parameters:
        - name: source_id
          in: path
          description: Unique identifier for the existing data source
          schema:
            type: string
          required: true
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                remote_bucket_config:
                  type: object
                  description: Configuration information for the remote bucket storing the external data. Partial updates are not supported, so all appropriate parameters must be provided
                  required:
                    - enabled
                    - region
                    - name
                    - file_name
                  properties:
                    enabled:
                      type: boolean
                      description: Whether the source is enabled. Must be 'true' to be used
                    region:
                      type: string
                      description: The region where the bucket is located
                    name:
                      type: string
                      description: The name of the bucket
                    file_name:
                      type: string
                      description: File name that contains the external data. Must be a .json file. If the file is nested under a folder, the file name should be prefixed with the appropriate directory path
                    credentials:
                      type: object
                      description: Credentials for accessing the bucket
                      required:
                        - type
                      properties:
                        type:
                          type: integer
                          description: 'Type of authentication used for the bucket. Available options: ''0'' (Re-use organization credentials), ''1'' (Long-term credentials), ''2'' (Instance Assume Role), ''3'' (STS Assume Role)'
                          format: int32
                        org_service_id:
                          type: integer
                          description: The unique identifier for the organization whose credentials will be re-used
                          format: int32
                        api_key:
                          type: string
                          description: AWS Access key ID
                        secret_key:
                          type: string
                          description: AWS Secret Access key
                        role_name:
                          type: string
                          description: The role ARN used to access the bucket
                        session_name:
                          type: string
                          description: The name to use for the session while connected to AWS
                        external_id:
                          type: string
                          description: A unique external identifier to assist in identifying the correct organization
                        role_duration_min:
                          type: string
                          description: Session length for accessing the organization information
                cloud_type_id:
                  type: string
                  description: 'Unique identifier signifying the bucket''s cloud type. Available options: ''AWS''. Providing an empty string will remove the existing value, so do not provide this key unless the value must be updated'
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: |-
                    {
                      "source_id": "divvyexternaldatasource:1:resource_external:test_source", 
                      "organization_id": 1, 
                      "source_type": "resource_external", 
                      "source_name": "test_source", 
                      "remote_bucket_config": {
                        "organization_id": 1, 
                        "enabled": true, 
                        "region": "us-east-1", 
                        "name": "new_test_bucket", 
                        "file_name": "new_external_data.json", 
                        "credentials": {
                          "type": 0, 
                          "org_service_id": 227
                        }
                      }, 
                      "cloud_type_id": "AWS", 
                      "last_success": null, 
                      "last_failure": null, 
                      "last_modified": null
                    }
              schema:
                type: object
                properties:
                  source_id:
                    type: string
                    example: divvyexternaldatasource:1:resource_external:test_source
                  organization_id:
                    type: integer
                    example: 1
                    default: 0
                  source_type:
                    type: string
                    example: resource_external
                  source_name:
                    type: string
                    example: test_source
                  remote_bucket_config:
                    type: object
                    properties:
                      organization_id:
                        type: integer
                        example: 1
                        default: 0
                      enabled:
                        type: boolean
                        example: true
                        default: true
                      region:
                        type: string
                        example: us-east-1
                      name:
                        type: string
                        example: new_test_bucket
                      file_name:
                        type: string
                        example: new_external_data.json
                      credentials:
                        type: object
                        properties:
                          type:
                            type: integer
                            example: 0
                            default: 0
                          org_service_id:
                            type: integer
                            example: 227
                            default: 0
                  cloud_type_id:
                    type: string
                    example: AWS
                  last_success: {}
                  last_failure: {}
                  last_modified: {}
      deprecated: false
  /public/resource/query:
    post:
      summary: Query Resources (v3)
      description: |-
        Query for resources using pagination. 

        *Requires Domain Admin, Organization Admin, or Basic User with "View Resource" permissions.*
      operationId: query-resources-v3
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - limit
              properties:
                badges:
                  type: array
                  description: The key-value pairs for badges.
                  items:
                    properties:
                      key:
                        type: string
                        description: The badge key.
                      value:
                        type: string
                        description: The badge value.
                    required:
                      - key
                      - value
                    type: object
                badge_filter_operator:
                  type: string
                  description: 'Operator for evaluating multiple badges. Options are: "OR" or "AND".'
                  default: OR
                filters:
                  type: array
                  description: The name and configuration for a filter.
                  items:
                    properties:
                      name:
                        type: string
                        description: The name of the filter. Use the [Get Filter Registry](https://docs.divvycloud.com/reference#get-filter-registry) endpoint to obtain a filter's name.
                      config:
                        type: object
                        description: The configuration for the filter, which varies from filter to filter. Use the [Get Filter Registry](https://docs.divvycloud.com/reference#get-filter-registry) endpoint to obtain a filter's configuration.
                    required:
                      - name
                    type: object
                insight:
                  type: string
                  description: 'A union of the Insight''s pack type and ID: `pack-type:insight-id`'
                limit:
                  type: integer
                  description: The maximum number of resources returned if `selected_resource_type` is provided and resources match the provided criteria. The value can be between 1 and 1000.
                  format: int32
                offset:
                  type: integer
                  description: The number of entries to skip over before returning anything. It is *highly* recommended that `cursor` be used instead.
                  format: int32
                scopes:
                  type: array
                  description: A list of the Cloud Organization Resource ID(s) and/or Resource Group ID(s) to which to scope the query. Use the [List Clouds](https://docs.divvycloud.com/reference#list-clouds) endpoint to obtain Cloud Organization resource ID(s); use the [List Resource Group Associations endpoint](https://docs.divvycloud.com/reference#get-resource-associations) to obtain resource group ID(s).
                  items:
                    type: string
                selected_resource_type:
                  type: string
                  description: The resource type that will be used to populate the response object. If no type is provided, counts of all resource types (in the user's current InsightCloudSec Organization) will be returned.
                tags:
                  type: array
                  description: A list of tag names.
                  items:
                    type: string
                cursor:
                  type: string
                  description: The hash value for the next page of results. This value can be obtained from the `next_cursor` parameter in the response object if there are more results that match a successful request. This process can be repeated until the `next_cursor` response parameter is null.
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: |-
                    {
                        "counts": {
                            "accessanalyzer": 58, 
                            "accesslistflowlog": 3, 
                            "airflowenvironment": 2,
                            ...
                            "webapp": 70, 
                            "webappgroup": 26, 
                            "workspace": 14
                        }, 
                            "selected_resource_type": "messagequeue", 
                            "supported_types": [
                                "accessanalyzer", 
                                "accesslistflowlog", 
                                "airflowenvironment",
                                ...
                                "webapp", 
                                "webappgroup", 
                                "workspace"
                            ], 
                            "resources": [
                                {
                                    "resource_type": "messagequeue", 
                                    "messagequeue": {
                                        "common": {
                                            "resource_id": "messagequeue:343:us-east-1:EncryptedSQS.fifo:", 
                                            "resource_name": "EncryptedSQS.fifo", 
                                            "resource_type": "messagequeue", 
                                            "cloud": "AWS", 
                                            "account": "AWS QA via STS", 
                                            "account_id": "050283019178", 
                                            "account_status": "PAUSED", 
                                            "organization_service_id": 343, 
                                            "region": "us-east-1", 
                                            "creation_timestamp": "2018-05-01 19:57:27", 
                                            "discovered_timestamp": "2018-08-01 21:13:41", 
                                            "modified_timestamp": "2021-06-03 11:44:23", 
                                            "namespace_id": "arn:aws:sqs:us-east-1:050283019178:EncryptedSQS.fifo", 
                                            "tags": {
                                                "Key": "Value", 
                                                "Level": "Account", 
                                                "DV2019": "1095"
                                            }
                                        }, 
                                        "url": "https://queue.amazonaws.com/050283019178/EncryptedSQS.fifo", 
                                        "name": "EncryptedSQS.fifo", 
                                        "region_name": "us-east-1", 
                                        "message_count": 0, 
                                        "messages_delayed_count": 0, 
                                        "messages_not_visible_count": 0, 
                                        "creation_timestamp": "2018-05-01 19:57:27", 
                                        "last_modified": "2018-11-26 21:27:42", 
                                        "delay": 0, 
                                        "max_size": 262144, 
                                        "retention_period": 345600, 
                                        "publicly_accessible": false, 
                                        "arn": "arn:aws:sqs:us-east-1:050283019178:EncryptedSQS.fifo", 
                                        "server_side_encryption": true, 
                                        "queue_type": "fifo", 
                                        "deduplication": false, 
                                        "key_resource_id": "serviceencryptionkey:135154:ap-southeast-2:a25bb189-3d89-4cf8-bdcf-078a8eac37ec:", 
                                        "key_reuse_period": 300, 
                                        "visibility_timeout": 30, 
                                        "receive_message_wait_time": 0
                                    }
                                }
                                ...
                            ], 
                            "scopes": [], 
                            "limit": 1, 
                            "offset": 539, 
                            "order_by": null, 
                            "filters": [], 
                            "headers": [
                                {
                                    "name": "Resource ID", 
                                    "value": ["common", "resource_id"], 
                                    "visible": false, 
                                    "order_by": false
                                },
                                ...
                                {
                                    "name": "Organization Service ID", 
                                    "value": ["common", "organization_service_id"], 
                                    "visible": false, 
                                    "order_by": false
                                }
                            ], 
                            "next_cursor": null
                    }
      deprecated: false
      x-readme:
        code-samples:
          - language: python
            code: |-
              """This endpoint utilizes cursor pagination. Below is an example that utilizes a 
              loop to send the next cursor to the resource query endpoint to retrieve the next set 
              of resources in the user's current organization. It stops when None is returned, 
              indicating no further resources are available."""

              import json
              import requests

              base_url = ''
              apikey = ''

              headers = {
                  'Content-Type': 'application/json',
                  'Accept': 'application/json',
                  'Accept-encoding': 'gzip',
                  'Api-Key': apikey
              }

              def resource_query(cursor):
                  # v3 supports up to 1000 resources per call
                  payload = {
                    'selected_resource_type': '<resource type>',
                    'scopes': [],
                    'filters': [],
                    'limit': 1000,
                    'tags': [],
                    'badges': [],
                    'badge_filter_operator': 'OR'
                  }
                  if cursor:
                      payload['cursor'] = cursor
                  response = requests.post(
                      url=base_url + '/v3/public/resource/query',
                      data=json.dumps(payload),
                      headers=headers
                  )
                  return response.json()

              cursor = None
              while True:
                  response = resource_query(cursor)
                  cursor = response.get('next_cursor', False)
                  print(response)
                  if not cursor:
                      print('\nComplete')
                      break
        samples-languages:
          - python
  /public/resource/etl-query:
    post:
      summary: Query Resources (v3-ETL)
      description: |-
        Query for resources using pagination. This endpoint is the successor to the standard v3 query resources endpoint. This endpoint is faster overall than the standard v3 query resources endpoint and should be used for maximum efficiency.

        *Note: Requires Domain Admin, Organization Admin, or Basic User with "View Resource" permissions.*
      operationId: query-resources-v3-etl
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - limit
              properties:
                badges:
                  type: array
                  description: The key-value pairs for badges.
                  items:
                    properties:
                      key:
                        type: string
                        description: The badge key.
                      value:
                        type: string
                        description: The badge value.
                    required:
                      - key
                      - value
                    type: object
                badge_filter_operator:
                  type: string
                  description: 'Operator for evaluating multiple badges. Options are: "OR" or "AND".'
                  default: OR
                filters:
                  type: array
                  description: The name and configuration for a filter.
                  items:
                    properties:
                      name:
                        type: string
                        description: The name of the filter. Use the [Get Filter Registry](https://docs.divvycloud.com/reference#get-filter-registry) endpoint to obtain a filter's name.
                      config:
                        type: object
                        description: The configuration for the filter, which varies from filter to filter. Use the [Get Filter Registry](https://docs.divvycloud.com/reference#get-filter-registry) endpoint to obtain a filter's configuration.
                    required:
                      - name
                    type: object
                insight:
                  type: string
                  description: 'A union of the Insight''s pack type and ID: `pack-type:insight-id`'
                limit:
                  type: integer
                  description: The maximum number of resources returned if `selected_resource_type` is provided and resources match the provided criteria. The value can be between 1 and 1000.
                  format: int32
                offset:
                  type: integer
                  description: The number of entries to skip over before returning anything. It is *highly* recommended that `cursor` be used instead.
                  format: int32
                scopes:
                  type: array
                  description: A list of the Cloud Organization Resource ID(s) and/or Resource Group ID(s) to which to scope the query. Use the [List Clouds](https://docs.divvycloud.com/reference#list-clouds) endpoint to obtain Cloud Organization resource ID(s); use the [List Resource Group Associations endpoint](https://docs.divvycloud.com/reference#get-resource-associations) to obtain resource group ID(s).
                  items:
                    type: string
                selected_resource_type:
                  type: string
                  description: The resource type that will be used to populate the response object. If no type is provided, counts of all resource types (in the user's current InsightCloudSec Organization) will be returned.
                tags:
                  type: array
                  description: A list of tag names.
                  items:
                    type: string
                cursor:
                  type: string
                  description: The hash value for the next page of results. This value can be obtained from the `next_cursor` parameter in the response object if there are more results that match a successful request. This process can be repeated until the `next_cursor` response parameter is null.
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: |2-

                        "selected_resource_type": "messagequeue",
                        "supported_types": [
                                "accessanalyzer", 
                                "accesslistflowlog", 
                                "airflowenvironment",
                                ...
                                "webapp", 
                                "webappgroup", 
                                "workspace"
                        ], 
                        "resources": [
                                {
                                "resource_type": "messagequeue",
                                "messagequeue": {
                                    "common": {
                                        "resource_id": "messagequeue:1:ca-central-1:divvycloud-event-aggregator-89CB530D0F40DE3D.fifo:",
                                        "resource_name": "divvycloud-event-aggregator-89CB530D0F40DE3D.fifo",
                                        "resource_type": "messagequeue",
                                        "cloud": "AWS",
                                        "account": "Travis-Training",
                                        "account_id": "889956758113",
                                        "account_status": "DEFAULT",
                                        "organization_service_id": 1,
                                        "region": "ca-central-1",
                                        "creation_timestamp": "2021-06-17 16:24:08",
                                        "discovered_timestamp": "2021-08-31 20:05:43",
                                        "modified_timestamp": "2021-12-04 20:09:24",
                                        "namespace_id": "arn:aws:sqs:ca-central-1:889956758113:divvycloud-event-aggregator-89CB530D0F40DE3D.fifo",
                                        "tags": {
                                            "Austin123": "Test123"
                                        }
                                    },
                                    "url": "https://sqs.ca-central-1.amazonaws.com/889956758113/divvycloud-event-aggregator-89CB530D0F40DE3D.fifo",
                                    "name": "divvycloud-event-aggregator-89CB530D0F40DE3D.fifo",
                                    "region_name": "ca-central-1",
                                    "message_count": 0,
                                    "messages_delayed_count": 0,
                                    "messages_not_visible_count": 0,
                                    "creation_timestamp": "2021-06-17 16:24:08",
                                    "last_modified": "2021-06-17 16:24:08",
                                    "delay": 0,
                                    "max_size": 262144,
                                    "retention_period": 86400,
                                    "policy": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Action\": \"sqs:SendMessage\", \"Effect\": \"Allow\", \"Resource\": \"arn:aws:sqs:ca-central-1:889956758113:divvycloud-event-aggregator-89CB530D0F40DE3D.fifo\", \"Condition\": {\"ArnEquals\": {\"aws:SourceArn\": \"arn:aws:events:ca-central-1:889956758113:rule/divvycloud-root-producer-89CB530D0F40DE3D*\"}}, \"Principal\": {\"Service\": \"events.amazonaws.com\"}}]}",
                                    "publicly_accessible": false,
                                    "arn": "arn:aws:sqs:ca-central-1:889956758113:divvycloud-event-aggregator-89CB530D0F40DE3D.fifo",
                                    "server_side_encryption": false,
                                    "transit_encryption": false,
                                    "queue_type": "fifo",
                                    "deduplication": true,
                                    "visibility_timeout": 30,
                                    "receive_message_wait_time": 0
                                }
                            }
                        ],
                        "scopes": [],
                        "limit": 25,
                        "offset": 28,
                        "order_by": "",
                        "filters": [],
                        "next_cursor": "eyJvZmZzZXQiOiAyOCwgImNoZWNrc3VtIjogIjhiMDQxYjMzMzE3MGQ0YmQwOTI1NTBiZWY3MGY2MWU5MTI0NjZlN2JhZGJjZWUxNzYyNDFmYmE1NGE4MjZjNGEifQ=="
                    }
      deprecated: false
      x-readme:
        code-samples:
          - language: python
            code: |-
              """This endpoint utilizes cursor pagination. Below is an example that utilizes a 
              loop to send the next cursor to the resource etl-query endpoint to retrieve the next set 
              of resources in the user's current organization. It stops when None is returned, 
              indicating no further resources are available."""

              import json
              import requests

              base_url = ''
              apikey = ''

              headers = {
                  'Content-Type': 'application/json',
                  'Accept': 'application/json',
                  'Accept-encoding': 'gzip',
                  'Api-Key': apikey
              }

              def resource_etl_query(cursor):
                  # v3 supports up to 1000 resources per call
                  payload = {
                    'selected_resource_type': '<resource type>',
                    'scopes': [],
                    'filters': [],
                    'limit': 1000,
                    'tags': [],
                    'badges': [],
                    'badge_filter_operator': 'OR'
                  }
                  if cursor:
                      payload['cursor'] = cursor
                  response = requests.post(
                      url=base_url + '/v3/public/resource/etl-query',
                      data=json.dumps(payload),
                      headers=headers
                  )
                  return response.json()

              cursor = None
              while True:
                  response = resource_etl_query(cursor)
                  cursor = response.get('next_cursor', False)
                  print(response)
                  if not cursor:
                      print('\nComplete')
                      break
        samples-languages:
          - python
  /iam/iam-explorer/principals/{principal_resource_id}/policy-stack:
    get:
      summary: List Policy Stack
      description: List resources', groups', organization units' policies that are associated with a given principal ID.
      operationId: list-policy-stack
      parameters:
        - name: principal_resource_id
          in: path
          description: InsightCloudSec resource ID for the principal.
          schema:
            type: string
          required: true
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: |
                    {
                      "principal": {
                        "arn": "arn:aws:iam::123456789123:user/user1",
                        "type": "serviceuser",        
                        "resource_id": "serviceuser:8:AIDAABC123DEF456GHI78:",
                        "attached_policies": [
                          {
                            "SamplePolicy": {
                              "arn": "arn:aws:iam::123456789123:policy/SamplePolicy",
                              "name": "SamplePolicy",
                              "resource_id": "servicemanagedpolicy:AWS:SamplePolicy:",
                              "content": {
                                "Version": "2012-10-17",
                                "Statement": [
                                  {
                                    "Action": [
                                      "iam:*"
                                    ],
                                    "Effect": "Allow",
                                    "Resource": "*"
                                  }
                                ]
                              }
                            }
                          }
                        ],
                        "inline_policies": [
                          {
                            "SampleAdminPolicy": {
                              "arn": "",
                              "name": "SampleAdminPolicy",
                              "resource_id": "serviceuser:8:AIDAABC123DEF456GHI78::SampleAdminPolicy",
                              "content": {
                                "Version": "2012-10-17",
                                "Statement": [
                                  {
                                    "Sid": "VisualEditor0",
                                    "Action": "*",
                                    "Effect": "Allow",
                                    "Resource": "*"
                                  }
                                ]
                              }
                            }
                          }
                        ],
                        "boundary_policy": {},
                        "groups": [
                          {
                            "arn:aws:iam::123456789123:group/Sample-Group": {
                              "name": "Admin",
                              "group_id": "AIDAABC123DEF456GHI78",
                              "resource_id": "servicegroup:102:AIDAABC123DEF456GHI78:",
                              "attached_policies": [
                                {
                                  "sample-group-policy": {
                                    "arn": "arn:aws:iam::123456789123:policy/sample-group-policy",
                                    "name": "sample-group-policy",
                                    "resource_id": "servicepolicy:8:AIDAABC123DEF456GHI78:",
                                    "content": {
                                      "Version": "2012-10-17",
                                      "Statement": [
                                        {
                                          "Sid": "Allowallwildcard",
                                          "Action": [
                                            "s3:*"
                                          ],
                                          "Effect": "Allow",
                                          "Resource": [
                                            "*"
                                          ]
                                        }
                                      ]
                                    }
                                  }
                                }
                              ],
                              "inline_policies": [
                                {
                                  "sample-inline-policy-123": {
                                    "name": "sample-inline-policy-123",
                                    "resource_id": "servicegroup:8:AIDAABC123DEF456GHI78::sample-inline-policy-123",
                                    "content": {
                                      "Version": "2012-10-17",
                                      "Statement": [
                                        {
                                          "Sid": "Stmt1617110097000",
                                          "Action": [
                                            "ec2:*"
                                          ],
                                          "Effect": "Allow",
                                          "Resource": [
                                            "*"
                                          ]
                                        }
                                      ]
                                    }
                                  }
                                }
                              ]
                            }
                          }
                        ],
                        "organizational_units": {
                          "arn:aws:organizations::123456789123:root/o-8thhndxqxj/r-r3mo": {
                            "name": "root_org",
                            "service_control_policies": [
                              {
                                "restrict-changing-pcms-policy-and-alias": {
                                  "arn": "arn:aws:iam::123456789123:policy/restrict-changing-pcms-policy-and-alias",
                                  "name": "restrict-changing-pcms-policy-and-alias",
                                  "resource_id": "servicecontrolpolicy:140:p-1ovpkzth:",
                                  "content": {
                                    "Version": "2012-10-17",
                                    "Statement": [
                                      {
                                        "Sid": "LockPCMSKeyPolicyAndAlias",
                                        "Effect": "Deny",
                                        "Action": [
                                          "kms:UpdateAlias",
                                          "kms:PutKeyPolicy"
                                        ],
                                        "Resource": "arn:aws:kms:*:*:key/*",
                                        "Condition": {
                                          "ForAnyValue:StringLike": {
                                            "kms:ResourceAliases": "alias/pcms*"
                                          }
                                        }
                                      }
                                    ]
                                  }
                                }
                              }
                            ]
                          },
                          "arn:aws:organizations::123456789123:ou/o-1abcdefghi/ou-a1bc-a12345bc": {
                            "name": "org_1",                     
                            "service_control_policies": [
                              {
                                "FullAWSAccess": {
                                  "arn": "arn:aws:iam::123456789123:policy/FullAWSAccess",
                                  "name": "FullAWSAccess",
                                  "resource_id": "servicecontrolpolicy:140:p-FullAWSAccess:",
                                  "content": {
                                    "Version": "2012-10-17",
                                    "Statement": [
                                      {
                                        "Effect": "Allow",
                                        "Action": "*",
                                        "Resource": "*"
                                      }
                                    ]
                                  }
                                }
                              }
                            ]
                          }
                        },
                        "account": {
                          "arn:aws:organizations::123456789123:account/o-1abcdefghi/123456789123": {
                            "account_name": "org_account_1",
                            "account_id": "050283019178",
                            "service_control_policies": [
                              {
                                "FullAWSAccess": {
                                  "arn": "arn:aws:iam::123456789123:policy/FullAWSAccess",
                                  "name": "FullAWSAccess",
                                  "resource_id": "servicecontrolpolicy:140:p-FullAWSAccess:",
                                  "content": {
                                    "Version": "2012-10-17",
                                    "Statement": [
                                      {
                                        "Effect": "Allow",
                                        "Action": "*",
                                        "Resource": "*"
                                      }
                                    ]
                                  }
                                }
                              }
                            ]
                          }
                        },
                        "resource": [
                          {
                            "arn:aws:s3:::divvyiamwildcardbuckettest": {
                              "arn": "arn:aws:s3:::divvyiamwildcardbuckettest",
                              "name": "divvyiamwildcardbuckettest",
                              "resource_type": "storagecontainer",
                              "resource_id": "storagecontainer:10:us-east-1:divvyiamwildcardbuckettest:",
                              "resource_policies": [
                                {
                                  "Resource Policy": {
                                    "arn": "arn:aws:s3:::divvyiamwildcardbuckettest",
                                    "name": "Resource Policy",
                                    "resource_id": "storagecontainer:10:us-east-1:divvyiamwildcardbuckettest:",
                                    "content": {
                                      "Id": "Policy1603394418213",
                                      "Version": "2012-10-17",
                                      "Statement": [
                                        {
                                          "Sid": "Stmt1603394416353",
                                          "Action": "s3:listbucket",
                                          "Effect": "Allow",
                                          "Resource": "arn:aws:s3:::divvyiamwildcardbuckettest",
                                          "Principal": {
                                            "AWS": "arn:aws:iam::123456789123:root"
                                          }
                                        }
                                      ]
                                    }
                                  }
                                }
                              ]
                            }
                          }
                        ]
                      }
                    }
              schema:
                type: object
                properties:
                  principal:
                    type: object
                    properties:
                      arn:
                        type: string
                        example: arn:aws:iam::123456789123:user/user1
                      type:
                        type: string
                        example: serviceuser
                      resource_id:
                        type: string
                        example: 'serviceuser:8:AIDAABC123DEF456GHI78:'
                      attached_policies:
                        type: array
                        items:
                          type: object
                          properties:
                            SamplePolicy:
                              type: object
                              properties:
                                arn:
                                  type: string
                                  example: arn:aws:iam::123456789123:policy/SamplePolicy
                                name:
                                  type: string
                                  example: SamplePolicy
                                resource_id:
                                  type: string
                                  example: 'servicemanagedpolicy:AWS:SamplePolicy:'
                                content:
                                  type: object
                                  properties:
                                    Version:
                                      type: string
                                      example: '2012-10-17'
                                    Statement:
                                      type: array
                                      items:
                                        type: object
                                        properties:
                                          Action:
                                            type: array
                                            items:
                                              type: string
                                              example: iam:*
                                          Effect:
                                            type: string
                                            example: Allow
                                          Resource:
                                            type: string
                                            example: '*'
                      inline_policies:
                        type: array
                        items:
                          type: object
                          properties:
                            SampleAdminPolicy:
                              type: object
                              properties:
                                arn:
                                  type: string
                                  example: ''
                                name:
                                  type: string
                                  example: SampleAdminPolicy
                                resource_id:
                                  type: string
                                  example: serviceuser:8:AIDAABC123DEF456GHI78::SampleAdminPolicy
                                content:
                                  type: object
                                  properties:
                                    Version:
                                      type: string
                                      example: '2012-10-17'
                                    Statement:
                                      type: array
                                      items:
                                        type: object
                                        properties:
                                          Sid:
                                            type: string
                                            example: VisualEditor0
                                          Action:
                                            type: string
                                            example: '*'
                                          Effect:
                                            type: string
                                            example: Allow
                                          Resource:
                                            type: string
                                            example: '*'
                      boundary_policy:
                        type: object
                        properties: {}
                      groups:
                        type: array
                        items:
                          type: object
                          properties:
                            arn:aws:iam::123456789123:group/Sample-Group:
                              type: object
                              properties:
                                name:
                                  type: string
                                  example: Admin
                                group_id:
                                  type: string
                                  example: AIDAABC123DEF456GHI78
                                resource_id:
                                  type: string
                                  example: 'servicegroup:102:AIDAABC123DEF456GHI78:'
                                attached_policies:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      sample-group-policy:
                                        type: object
                                        properties:
                                          arn:
                                            type: string
                                            example: arn:aws:iam::123456789123:policy/sample-group-policy
                                          name:
                                            type: string
                                            example: sample-group-policy
                                          resource_id:
                                            type: string
                                            example: 'servicepolicy:8:AIDAABC123DEF456GHI78:'
                                          content:
                                            type: object
                                            properties:
                                              Version:
                                                type: string
                                                example: '2012-10-17'
                                              Statement:
                                                type: array
                                                items:
                                                  type: object
                                                  properties:
                                                    Sid:
                                                      type: string
                                                      example: Allowallwildcard
                                                    Action:
                                                      type: array
                                                      items:
                                                        type: string
                                                        example: s3:*
                                                    Effect:
                                                      type: string
                                                      example: Allow
                                                    Resource:
                                                      type: array
                                                      items:
                                                        type: string
                                                        example: '*'
                                inline_policies:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      sample-inline-policy-123:
                                        type: object
                                        properties:
                                          name:
                                            type: string
                                            example: sample-inline-policy-123
                                          resource_id:
                                            type: string
                                            example: servicegroup:8:AIDAABC123DEF456GHI78::sample-inline-policy-123
                                          content:
                                            type: object
                                            properties:
                                              Version:
                                                type: string
                                                example: '2012-10-17'
                                              Statement:
                                                type: array
                                                items:
                                                  type: object
                                                  properties:
                                                    Sid:
                                                      type: string
                                                      example: Stmt1617110097000
                                                    Action:
                                                      type: array
                                                      items:
                                                        type: string
                                                        example: ec2:*
                                                    Effect:
                                                      type: string
                                                      example: Allow
                                                    Resource:
                                                      type: array
                                                      items:
                                                        type: string
                                                        example: '*'
                      organizational_units:
                        type: object
                        properties:
                          arn:aws:organizations::123456789123:root/o-8thhndxqxj/r-r3mo:
                            type: object
                            properties:
                              name:
                                type: string
                                example: root_org
                              service_control_policies:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    restrict-changing-pcms-policy-and-alias:
                                      type: object
                                      properties:
                                        arn:
                                          type: string
                                          example: arn:aws:iam::123456789123:policy/restrict-changing-pcms-policy-and-alias
                                        name:
                                          type: string
                                          example: restrict-changing-pcms-policy-and-alias
                                        resource_id:
                                          type: string
                                          example: 'servicecontrolpolicy:140:p-1ovpkzth:'
                                        content:
                                          type: object
                                          properties:
                                            Version:
                                              type: string
                                              example: '2012-10-17'
                                            Statement:
                                              type: array
                                              items:
                                                type: object
                                                properties:
                                                  Sid:
                                                    type: string
                                                    example: LockPCMSKeyPolicyAndAlias
                                                  Effect:
                                                    type: string
                                                    example: Deny
                                                  Action:
                                                    type: array
                                                    items:
                                                      type: string
                                                      example: kms:UpdateAlias
                                                  Resource:
                                                    type: string
                                                    example: arn:aws:kms:*:*:key/*
                                                  Condition:
                                                    type: object
                                                    properties:
                                                      ForAnyValue:StringLike:
                                                        type: object
                                                        properties:
                                                          kms:ResourceAliases:
                                                            type: string
                                                            example: alias/pcms*
                          arn:aws:organizations::123456789123:ou/o-1abcdefghi/ou-a1bc-a12345bc:
                            type: object
                            properties:
                              name:
                                type: string
                                example: org_1
                              service_control_policies:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    FullAWSAccess:
                                      type: object
                                      properties:
                                        arn:
                                          type: string
                                          example: arn:aws:iam::123456789123:policy/FullAWSAccess
                                        name:
                                          type: string
                                          example: FullAWSAccess
                                        resource_id:
                                          type: string
                                          example: 'servicecontrolpolicy:140:p-FullAWSAccess:'
                                        content:
                                          type: object
                                          properties:
                                            Version:
                                              type: string
                                              example: '2012-10-17'
                                            Statement:
                                              type: array
                                              items:
                                                type: object
                                                properties:
                                                  Effect:
                                                    type: string
                                                    example: Allow
                                                  Action:
                                                    type: string
                                                    example: '*'
                                                  Resource:
                                                    type: string
                                                    example: '*'
                      account:
                        type: object
                        properties:
                          arn:aws:organizations::123456789123:account/o-1abcdefghi/123456789123:
                            type: object
                            properties:
                              account_name:
                                type: string
                                example: org_account_1
                              account_id:
                                type: string
                                example: '050283019178'
                              service_control_policies:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    FullAWSAccess:
                                      type: object
                                      properties:
                                        arn:
                                          type: string
                                          example: arn:aws:iam::123456789123:policy/FullAWSAccess
                                        name:
                                          type: string
                                          example: FullAWSAccess
                                        resource_id:
                                          type: string
                                          example: 'servicecontrolpolicy:140:p-FullAWSAccess:'
                                        content:
                                          type: object
                                          properties:
                                            Version:
                                              type: string
                                              example: '2012-10-17'
                                            Statement:
                                              type: array
                                              items:
                                                type: object
                                                properties:
                                                  Effect:
                                                    type: string
                                                    example: Allow
                                                  Action:
                                                    type: string
                                                    example: '*'
                                                  Resource:
                                                    type: string
                                                    example: '*'
                      resource:
                        type: array
                        items:
                          type: object
                          properties:
                            arn:aws:s3:::divvyiamwildcardbuckettest:
                              type: object
                              properties:
                                arn:
                                  type: string
                                  example: arn:aws:s3:::divvyiamwildcardbuckettest
                                name:
                                  type: string
                                  example: divvyiamwildcardbuckettest
                                resource_type:
                                  type: string
                                  example: storagecontainer
                                resource_id:
                                  type: string
                                  example: 'storagecontainer:10:us-east-1:divvyiamwildcardbuckettest:'
                                resource_policies:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      Resource Policy:
                                        type: object
                                        properties:
                                          arn:
                                            type: string
                                            example: arn:aws:s3:::divvyiamwildcardbuckettest
                                          name:
                                            type: string
                                            example: Resource Policy
                                          resource_id:
                                            type: string
                                            example: 'storagecontainer:10:us-east-1:divvyiamwildcardbuckettest:'
                                          content:
                                            type: object
                                            properties:
                                              Id:
                                                type: string
                                                example: Policy1603394418213
                                              Version:
                                                type: string
                                                example: '2012-10-17'
                                              Statement:
                                                type: array
                                                items:
                                                  type: object
                                                  properties:
                                                    Sid:
                                                      type: string
                                                      example: Stmt1603394416353
                                                    Action:
                                                      type: string
                                                      example: s3:listbucket
                                                    Effect:
                                                      type: string
                                                      example: Allow
                                                    Resource:
                                                      type: string
                                                      example: arn:aws:s3:::divvyiamwildcardbuckettest
                                                    Principal:
                                                      type: object
                                                      properties:
                                                        AWS:
                                                          type: string
                                                          example: arn:aws:iam::123456789123:root
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
        '404':
          description: '404'
          content:
            application/json:
              examples:
                Result:
                  value: |-
                    {
                      "error_message": "No Resource found with id storagecontainer:3131:us-east-1:THISBUCKETDOESNOTEXIST:",
                      "error_type": "NotFound"
                    }
              schema:
                type: object
                properties:
                  error_message:
                    type: string
                    example: 'No Resource found with id storagecontainer:3131:us-east-1:THISBUCKETDOESNOTEXIST:'
                  error_type:
                    type: string
                    example: NotFound
      deprecated: false
  /iam/iam-explorer/principals/{principal_resource_id}/list-actions:
    get:
      summary: List Actions
      description: List available actions for a given principal or resource.
      operationId: list-actions
      parameters:
        - name: principal_resource_id
          in: path
          description: InsightCloudSec resource ID for the principal.
          schema:
            type: string
          required: true
        - name: service
          in: query
          description: Service to filter the allowed actions, e.g., `s3`, `kms`, etc.
          schema:
            type: string
        - name: category
          in: query
          description: 'Category to filter the allowed actions. Options are: `read`, `write`, `list`, `tag`, and `perm`.'
          schema:
            type: string
        - name: entity_resource_id
          in: query
          description: Resource ID for the resource a principal is allowed to perform actions against.
          schema:
            type: string
        - name: excluded
          in: query
          description: A JSON-encoded string containing objects composed of keys that are principal, group, organization unit, or account IDs and values are lists of policy IDs for policies attached to a given key. These will be ignored during analysis.
          schema:
            type: string
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: |-
                    {
                      "value": {
                        "actions_count": "3",
                        "services_count": "2",
                        "allowed_actions": [
                          {
                            "name": "getkeypolicy",
                            "service": "kms",
                            "category": "read"
                          },
                          {
                            "name": "getbucketlocation",
                            "service": "s3",
                            "category": "read"
                          },
                          {
                            "name": "listbucket",
                            "service": "s3",
                            "category": "list"
                          }
                        ],
                        "resources_count": "0"
                      }
                    }
              schema:
                type: object
                properties:
                  value:
                    type: object
                    properties:
                      actions_count:
                        type: string
                        example: '3'
                      services_count:
                        type: string
                        example: '2'
                      allowed_actions:
                        type: array
                        items:
                          type: object
                          properties:
                            name:
                              type: string
                              example: getkeypolicy
                            service:
                              type: string
                              example: kms
                            category:
                              type: string
                              example: read
                      resources_count:
                        type: string
                        example: '0'
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
        '404':
          description: '404'
          content:
            application/json:
              examples:
                Result:
                  value: |-
                    {
                      "error_message": "Either the selected principal does not exist or is unsupported",
                      "error_type": "NotFound"
                    }
              schema:
                type: object
                properties:
                  error_message:
                    type: string
                    example: Either the selected principal does not exist or is unsupported
                  error_type:
                    type: string
                    example: NotFound
      deprecated: false
  /lpa/principals/{principal_resource_id}/permissions:
    get:
      summary: List Principal Permissions
      description: Lists used and unused permissions based on a given principal.
      operationId: list-principal-permissions
      parameters:
        - name: principal_resource_id
          in: path
          description: The InsightCloudSec Resource ID for a principal.
          schema:
            type: string
          required: true
        - name: start
          in: query
          description: The start date for the collection window of used and unused permissions. Use in conjunction with `end`. Takes precedence over `previous_days`.
          schema:
            type: string
            format: date
        - name: end
          in: query
          description: The end date for the collection window of used and unused permissions. Use in conjunction with `start`. Takes precedence over `previous_days`.
          schema:
            type: string
            format: date
        - name: filter_by
          in: query
          description: 'Key to filter by; paired with `filter`. Options are: `permission` or `status`.'
          schema:
            type: string
        - name: filter
          in: query
          description: Value to filter by; paired with `filter_by`.
          schema:
            type: string
        - name: order_by
          in: query
          description: 'Key to order by; paired with `order`. Options are: `permission` or `status`.'
          schema:
            type: string
        - name: order
          in: query
          description: 'Direction to order; paired with `order_by`. Options are: `asc` (ascending) or `desc` (descending).'
          schema:
            type: string
        - name: page
          in: query
          description: The page number for the list of results to return. Must be positive.
          schema:
            type: integer
            format: int32
        - name: page_size
          in: query
          description: The size of the page for the list of results. Must be positive.
          schema:
            type: integer
            format: int32
        - name: previous_days
          in: query
          description: The previous *n* number of days of the request date range, where *n* can be an integer between 1 and 90.
          schema:
            type: integer
            format: int32
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: |
                    {
                      "end": "2023-01-09",
                      "page": 1,
                      "permissions": [
                        {
                          "action": "access-analyzer.ListPolicyGenerations",
                          "category": "read",
                          "count": 3,
                          "last_executed_date": "2023-01-09T21:10:09",
                          "permission": "access-analyzer:listpolicygenerations",
                          "status": "Used"
                        },
                        {
                          "action": "appsync.GetGraphqlApi",
                          "category": "read",
                          "count": 1,
                          "last_executed_date": "2023-01-03T21:58:25",
                          "permission": "appsync:getgraphqlapi",
                          "status": "Used"
                        },
                        {
                          "category": "read",
                          "permission": "a4b:getskillgroup",
                          "status": "Unused"
                        },
                        {
                          "category": "list",
                          "permission": "a4b:listbusinessreportschedules",
                          "status": "Unused"
                        },
                        {
                          "category": "list",
                          "permission": "a4b:listconferenceproviders",
                          "status": "Unused"
                        }
                      ],
                      "principal": {
                        "name": "ssoUser",
                        "resource_id": "servicerole:**:****************:",
                        "resource_type": "servicerole"
                      },
                      "start": "2023-01-02",
                      "total_pages": 1,
                      "warnings": {
                        "An API method could not be found for the following actions:": [
                          "tagging.GetResources",
                          "tagging.GetTagKeys"
                        ]
                      }
                    }
              schema:
                type: object
                properties:
                  end:
                    type: string
                    example: '2023-01-09'
                  page:
                    type: integer
                    example: 1
                    default: 0
                  permissions:
                    type: array
                    items:
                      type: object
                      properties:
                        action:
                          type: string
                          example: access-analyzer.ListPolicyGenerations
                        category:
                          type: string
                          example: read
                        count:
                          type: integer
                          example: 3
                          default: 0
                        last_executed_date:
                          type: string
                          example: '2023-01-09T21:10:09'
                        permission:
                          type: string
                          example: access-analyzer:listpolicygenerations
                        status:
                          type: string
                          example: Used
                  principal:
                    type: object
                    properties:
                      name:
                        type: string
                        example: ssoUser
                      resource_id:
                        type: string
                        example: 'servicerole:**:****************:'
                      resource_type:
                        type: string
                        example: servicerole
                  start:
                    type: string
                    example: '2023-01-02'
                  total_pages:
                    type: integer
                    example: 1
                    default: 0
                  warnings:
                    type: object
                    properties:
                      'An API method could not be found for the following actions:':
                        type: array
                        items:
                          type: string
                          example: tagging.GetResources
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
  /lpa/principals/{principal_resource_id}/actions:
    get:
      summary: List Principal Activity
      description: Lists the activity (policy/permission actions) for a given principal.
      operationId: list-principal-activity
      parameters:
        - name: principal_resource_id
          in: path
          description: The InsightCloudSec resource ID for the principal, e.g., `servicerole:123:0a123b45-01a2-01ab-a012-0a12b3bc456d:`.
          schema:
            type: string
          required: true
        - name: start
          in: query
          description: The start date (in `YYYY-MM-DD` format) for the range in which to search for principal activity.
          required: true
          schema:
            type: string
            format: date
        - name: end
          in: query
          description: The end date (in `YYYY-MM-DD` format) for the range in which to search for principal activity.
          required: true
          schema:
            type: string
            format: date
        - name: format
          in: query
          description: Output format for the activity list.
          schema:
            type: string
            default: json
        - name: source
          in: query
          description: 'Determines the location from which the principal''s actions are collected. Options are: `sql` (retrieved from the MySQL cache) or `storage` (retrieved from Azure Storage or LPA Working Bucket (S3)).'
          schema:
            type: string
            default: sql
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: |-
                    {
                        "executed_actions": [
                            {
                                "action": "access-analyzer.ListAnalyzers",
                                "count": 11211,
                                "last_executed_date": "2022-08-15T23:47:14"
                            },
                            {
                                "action": "acm.ListCertificates",
                                "count": 22211,
                                "last_executed_date": "2022-08-15T23:51:35"
                            },
                            {
                                "action": "airflow.ListEnvironments",
                                "count": 11429,
                                "last_executed_date": "2022-08-15T23:45:13"
                            },
                        ],
                        "metadata": {
                            "errors": []
                        },
                        "principal": {
                            "name": "ics-assume-role-test",
                            "resource_id": "serviceuser:12:ABCDEFGHI1JKLM23NO4PQ:",
                            "resource_type": "serviceuser"
                        }
                    }
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
  /public/resources/{resource_id}/export:
    get:
      summary: Export Source Data
      description: Exports a given resource's source data.
      operationId: export-source-data
      parameters:
        - name: resource_id
          in: path
          description: The InsightCloudSec resource ID.
          schema:
            type: string
          required: true
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: |
                    {
                        "legacy_details": {
                            "common": {
                                "resource_id": "dbinstance:112:us-east-1:example-database-name:",
                                "resource_name": "automation-dev-mysql",
                                "resource_type": "dbinstance",
                                "cloud": "AWS",
                                "account": "AWS IAR",
                                "account_id": "123456789012",
                                "account_status": "DEFAULT",
                                "organization_service_id": 112,
                                "region": "us-east-1",
                                "creation_timestamp": "2022-04-20 16:48:02",
                                "discovered_timestamp": "2022-04-20 17:29:08",
                                "modified_timestamp": "2022-04-22 18:41:01",
                                "namespace_id": "arn:aws:rds:us-east-1:050283019178:db:example-database-name",
                                "direct_link": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=example-database-name;is-cluster=false",
                                "properties": {
                                    "property_list": []
                                },
                                "noncompliance": [],
                                "tags": {
                                    "Name": "example-database-name"
                                }
                            },
                            "instance_id": "automation-dev-mysql",
                            "instance_type": "db.m5.xlarge",
                            "state": "available",
                            "endpoint_address": "example-database-name.us-east-1.rds.amazonaws.com",
                            "endpoint_port": 3306,
                            "engine": "mysql",
                            "engine_version": "5.7.33",
                            "storage_size": 250,
                            "storage_type": "io1",
                            "db_name": "db-name",
                            "master_username": "master-user",
                            "multi_az": true,
                            "encrypted": true,
                            "publicly_accessible": true,
                            "deletion_protection": false,
                            "backup_retention": 30,
                            "latest_restorable_time": "2022-04-22 18:35:00",
                            "network_resource_id": "privatenetwork:112:us-east-1:vpc-abc123456:",
                            "copy_tags_to_snapshot": true,
                            "enhanced_monitoring": true,
                            "iam_authentication": false,
                            "enabled_logging_types": "audit, error, slowquery",
                            "ca_cert": "example-ca-cert",
                            "option_groups": "default:mysql-5-7",
                            "parameter_groups": "example-database-name-pg"
                        },
                        "details": {},
                        "sources": {},
                        "findings": {
                            "insights": {
                                "counts_by_severity": {
                                    "critical": 0,
                                    "high": 2,
                                    "medium": 0,
                                    "low": 2,
                                    "info": 1
                                }
                            }
                        },
                        "dependencies": {
                            "privatesubnet": [
                                {
                                    "id": "example-subnet-id",
                                    "resource_id": "privatesubnet:112:us-east-1:subnet-example-subnet-id:",
                                    "name": "example-subnet",
                                    "type": "privatesubnet"
                                },
                                {
                                    "id": "subnet-0d2eeac926f1c3e9e",
                                    "resource_id": "privatesubnet:112:us-east-1:subnet-example-subnet-id:",
                                    "name": "example-subnet-2",
                                    "type": "privatesubnet"
                                }
                            ],
                            "privatenetwork": [
                                {
                                    "id": "vpc-a10202c6",
                                    "resource_id": "privatenetwork:112:us-east-1:vpc-abc123def:",
                                    "name": "example-vpc",
                                    "type": "privatenetwork"
                                }
                            ],
                            "serviceencryptionkey": [
                                {
                                    "id": "example-encryption-key-id",
                                    "resource_id": "serviceencryptionkey:763:us-east-1:example-encryption-key-id:",
                                    "name": "example-encryption-key-name",
                                    "type": "serviceencryptionkey"
                                }
                            ]
                        }
                    }
              schema:
                type: object
                properties:
                  legacy_details:
                    type: object
                    properties:
                      common:
                        type: object
                        properties:
                          resource_id:
                            type: string
                            example: 'dbinstance:112:us-east-1:example-database-name:'
                          resource_name:
                            type: string
                            example: automation-dev-mysql
                          resource_type:
                            type: string
                            example: dbinstance
                          cloud:
                            type: string
                            example: AWS
                          account:
                            type: string
                            example: AWS IAR
                          account_id:
                            type: string
                            example: '123456789012'
                          account_status:
                            type: string
                            example: DEFAULT
                          organization_service_id:
                            type: integer
                            example: 112
                            default: 0
                          region:
                            type: string
                            example: us-east-1
                          creation_timestamp:
                            type: string
                            example: '2022-04-20 16:48:02'
                          discovered_timestamp:
                            type: string
                            example: '2022-04-20 17:29:08'
                          modified_timestamp:
                            type: string
                            example: '2022-04-22 18:41:01'
                          namespace_id:
                            type: string
                            example: arn:aws:rds:us-east-1:050283019178:db:example-database-name
                          direct_link:
                            type: string
                            example: https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=example-database-name;is-cluster=false
                          properties:
                            type: object
                            properties:
                              property_list:
                                type: array
                          noncompliance:
                            type: array
                          tags:
                            type: object
                            properties:
                              Name:
                                type: string
                                example: example-database-name
                      instance_id:
                        type: string
                        example: automation-dev-mysql
                      instance_type:
                        type: string
                        example: db.m5.xlarge
                      state:
                        type: string
                        example: available
                      endpoint_address:
                        type: string
                        example: example-database-name.us-east-1.rds.amazonaws.com
                      endpoint_port:
                        type: integer
                        example: 3306
                        default: 0
                      engine:
                        type: string
                        example: mysql
                      engine_version:
                        type: string
                        example: 5.7.33
                      storage_size:
                        type: integer
                        example: 250
                        default: 0
                      storage_type:
                        type: string
                        example: io1
                      db_name:
                        type: string
                        example: db-name
                      master_username:
                        type: string
                        example: master-user
                      multi_az:
                        type: boolean
                        example: true
                        default: true
                      encrypted:
                        type: boolean
                        example: true
                        default: true
                      publicly_accessible:
                        type: boolean
                        example: true
                        default: true
                      deletion_protection:
                        type: boolean
                        example: false
                        default: true
                      backup_retention:
                        type: integer
                        example: 30
                        default: 0
                      latest_restorable_time:
                        type: string
                        example: '2022-04-22 18:35:00'
                      network_resource_id:
                        type: string
                        example: 'privatenetwork:112:us-east-1:vpc-abc123456:'
                      copy_tags_to_snapshot:
                        type: boolean
                        example: true
                        default: true
                      enhanced_monitoring:
                        type: boolean
                        example: true
                        default: true
                      iam_authentication:
                        type: boolean
                        example: false
                        default: true
                      enabled_logging_types:
                        type: string
                        example: audit, error, slowquery
                      ca_cert:
                        type: string
                        example: example-ca-cert
                      option_groups:
                        type: string
                        example: default:mysql-5-7
                      parameter_groups:
                        type: string
                        example: example-database-name-pg
                  details:
                    type: object
                    properties: {}
                  sources:
                    type: object
                    properties: {}
                  findings:
                    type: object
                    properties:
                      insights:
                        type: object
                        properties:
                          counts_by_severity:
                            type: object
                            properties:
                              critical:
                                type: integer
                                example: 0
                                default: 0
                              high:
                                type: integer
                                example: 2
                                default: 0
                              medium:
                                type: integer
                                example: 0
                                default: 0
                              low:
                                type: integer
                                example: 2
                                default: 0
                              info:
                                type: integer
                                example: 1
                                default: 0
                  dependencies:
                    type: object
                    properties:
                      privatesubnet:
                        type: array
                        items:
                          type: object
                          properties:
                            id:
                              type: string
                              example: example-subnet-id
                            resource_id:
                              type: string
                              example: 'privatesubnet:112:us-east-1:subnet-example-subnet-id:'
                            name:
                              type: string
                              example: example-subnet
                            type:
                              type: string
                              example: privatesubnet
                      privatenetwork:
                        type: array
                        items:
                          type: object
                          properties:
                            id:
                              type: string
                              example: vpc-a10202c6
                            resource_id:
                              type: string
                              example: 'privatenetwork:112:us-east-1:vpc-abc123def:'
                            name:
                              type: string
                              example: example-vpc
                            type:
                              type: string
                              example: privatenetwork
                      serviceencryptionkey:
                        type: array
                        items:
                          type: object
                          properties:
                            id:
                              type: string
                              example: example-encryption-key-id
                            resource_id:
                              type: string
                              example: 'serviceencryptionkey:763:us-east-1:example-encryption-key-id:'
                            name:
                              type: string
                              example: example-encryption-key-name
                            type:
                              type: string
                              example: serviceencryptionkey
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
  /lpa/principals/{principal_resource_id}/access-remediation-policy:
    get:
      summary: Generate Deny NotAction Policy
      description: Generates a remediation policy for a given principal that will deny all but the permissions that are in active use by the principal.
      operationId: generate-deny-notaction-policy
      parameters:
        - name: start
          in: query
          description: The start date for the collection window of used and unused permissions.
          schema:
            type: string
        - name: end
          in: query
          description: The end date for the collection window of used and unused permissions.
          schema:
            type: string
        - name: principal_resource_id
          in: path
          description: The InsightCloudSec resource ID for the principal, e.g., `servicerole:123:0a123b45-01a2-01ab-a012-0a12b3bc456d:`.
          schema:
            type: string
          required: true
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: |-
                    {
                      "policy": {
                        "Statement": [
                          {
                            "Effect": "Deny",
                            "NotAction": [
                              "snowball:ListLongTermPricing"
                            ],
                            "Resource": ["*"],
                            "Sid": "LPADenyUnusedPermissions"
                          }
                        ],
                        "Version": "2012-10-17"
                      },
                      "warnings": {}
                    }
              schema:
                type: object
                properties:
                  policy:
                    type: object
                    properties:
                      Statement:
                        type: array
                        items:
                          type: object
                          properties:
                            Effect:
                              type: string
                              example: Deny
                            NotAction:
                              type: array
                              items:
                                type: string
                                example: snowball:ListLongTermPricing
                            Resource:
                              type: array
                              items:
                                type: string
                                example: '*'
                            Sid:
                              type: string
                              example: LPADenyUnusedPermissions
                      Version:
                        type: string
                        example: '2012-10-17'
                  warnings:
                    type: object
                    properties: {}
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
  /iam/iam-explorer/actions-per-service:
    post:
      summary: List Actions Per Service
      description: Lists the actions available per given service.
      operationId: list-actions-per-service
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                scope:
                  type: array
                  description: The scope for the operation.
                  items:
                    properties:
                      id:
                        type: string
                        description: The InsightCloudSec resource ID for the given type.
                      type:
                        type: string
                        description: 'The type of service. Options are: `USER`, `APPLICATION`, or `RESOURCE`. *Note: If the type is `USER` and the ID is associated with a federated user, an error will be returned.*'
                    type: object
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
  /public/resources/{resource_id}/sources:
    get:
      summary: Get Source Documents
      description: Get the Source Documents associated with a given resource.
      operationId: get-source-documents
      parameters:
        - name: resource_id
          in: path
          description: The InsightCloudSec resource ID.
          schema:
            type: string
          required: true
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: |-
                    {
                        "DescribeInstances": {
                            "content": {
                                "Tags": [
                                    {
                                        "Key": "Owner",
                                        "Value": "ICS QA Team"
                                    }
                                ],
                                "State": {
                                    "Code": 80,
                                    "Name": "stopped"
                                },
                                "VpcId": "vpc-...",
                                "ImageId": "ami-...",
                                "KeyName": "key",
                                "SubnetId": "subnet-...",
                                "Placement": {
                                    "Tenancy": "default",
                                    "GroupName": "",
                                    "AvailabilityZone": "ca-central-1b"
                                },
                                "CpuOptions": {
                                    "CoreCount": 2,
                                    "ThreadsPerCore": 1
                                },
                                "EnaSupport": true,
                                "Hypervisor": "xen",
                                "InstanceId": "i-...",
                                "LaunchTime": "2022-12-09 17:36:02+00:00",
                                "Monitoring": {
                                    "State": "disabled"
                                },
                                "ClientToken": "",
                                "StateReason": {
                                    "Code": "Client.UserInitiatedShutdown",
                                    "Message": "Client.UserInitiatedShutdown: User initiated shutdown"
                                },
                                "Architecture": "x86_64",
                                "EbsOptimized": false,
                                "InstanceType": "t2.medium",
                                "ProductCodes": [],
                                "PublicDnsName": "",
                                "AmiLaunchIndex": 0,
                                "EnclaveOptions": {
                                    "Enabled": false
                                },
                                "PrivateDnsName": "ip-1-1-1-1.ca-central-1.compute.internal",
                                "RootDeviceName": "/dev/xvda",
                                "RootDeviceType": "ebs",
                                "SecurityGroups": [
                                    {
                                        "GroupId": "sg-...",
                                        "GroupName": "launch-wizard-5"
                                    }
                                ],
                                "UsageOperation": "RunInstances",
                                "MetadataOptions": {
                                    "State": "applied",
                                    "HttpTokens": "optional",
                                    "HttpEndpoint": "enabled",
                                    "HttpProtocolIpv6": "disabled",
                                    "InstanceMetadataTags": "enabled",
                                    "HttpPutResponseHopLimit": 1
                                },
                                "PlatformDetails": "Linux/UNIX",
                                "PublicIpAddress": "1.1.1.1",
                                "SourceDestCheck": true,
                                "PrivateIpAddress": "1.1.1.1",
                                "NetworkInterfaces": [
                                    {
                                        "VpcId": "vpc-...",
                                        "Groups": [
                                            {
                                                "GroupId": "sg-...",
                                                "GroupName": "launch-wizard-5"
                                            }
                                        ],
                                        "Status": "in-use",
                                        "OwnerId": "...",
                                        "SubnetId": "subnet-...",
                                        "Attachment": {
                                            "Status": "attached",
                                            "AttachTime": "2022-01-10 21:43:59+00:00",
                                            "DeviceIndex": 0,
                                            "AttachmentId": "eni-attach-...",
                                            "NetworkCardIndex": 0,
                                            "DeleteOnTermination": true
                                        },
                                        "MacAddress": "1:1:1:1:1",
                                        "Description": "",
                                        "InterfaceType": "interface",
                                        "Ipv6Addresses": [],
                                        "PrivateDnsName": "ip-1-1-1-1.ca-central-1.compute.internal",
                                        "SourceDestCheck": true,
                                        "PrivateIpAddress": "1.1.1.1",
                                        "NetworkInterfaceId": "eni-...",
                                        "PrivateIpAddresses": [
                                            {
                                                "Primary": true,
                                                "PrivateDnsName": "ip-1-1-1-1.ca-central-1.compute.internal",
                                                "PrivateIpAddress": "1.1.1.1"
                                            }
                                        ]
                                    }
                                ],
                                "HibernationOptions": {
                                    "Configured": false
                                },
                                "MaintenanceOptions": {
                                    "AutoRecovery": "default"
                                },
                                "VirtualizationType": "hvm",
                                "BlockDeviceMappings": [
                                    {
                                        "Ebs": {
                                            "Status": "attached",
                                            "VolumeId": "vol-...",
                                            "AttachTime": "2022-01-10 21:44:00+00:00",
                                            "DeleteOnTermination": true
                                        },
                                        "DeviceName": "/dev/xvda"
                                    }
                                ],
                                "PrivateDnsNameOptions": {
                                    "HostnameType": "ip-name",
                                    "EnableResourceNameDnsARecord": true,
                                    "EnableResourceNameDnsAAAARecord": false
                                },
                                "StateTransitionReason": "User initiated (2022-12-09 17:38:07 GMT)",
                                "UsageOperationUpdateTime": "2022-01-10 21:43:59+00:00",
                                "CapacityReservationSpecification": {
                                    "CapacityReservationPreference": "open"
                                }
                            },
                            "metadata": {
                                "hash": "...",
                                "groups": [],
                                "created": "2022-12-09 17:36:02+00:00",
                                "owner_id": "...",
                                "response_metadata": {
                                    "RequestId": "...",
                                    "HTTPHeaders": {
                                        "date": "Fri, 09 Dec 2022 17:42:39 GMT",
                                        "vary": "accept-encoding",
                                        "server": "AmazonEC2",
                                        "content-type": "text/xml;charset=UTF-8",
                                        "cache-control": "no-cache, no-store",
                                        "x-amzn-requestid": "...",
                                        "transfer-encoding": "chunked",
                                        "strict-transport-security": "max-age=31536000; includeSubDomains"
                                    },
                                    "RetryAttempts": 0,
                                    "HTTPStatusCode": 200
                                }
                            }
                        }
                    }
              schema:
                type: object
                properties:
                  DescribeInstances:
                    type: object
                    properties:
                      content:
                        type: object
                        properties:
                          Tags:
                            type: array
                            items:
                              type: object
                              properties:
                                Key:
                                  type: string
                                  example: Owner
                                Value:
                                  type: string
                                  example: ICS QA Team
                          State:
                            type: object
                            properties:
                              Code:
                                type: integer
                                example: 80
                                default: 0
                              Name:
                                type: string
                                example: stopped
                          VpcId:
                            type: string
                            example: vpc-...
                          ImageId:
                            type: string
                            example: ami-...
                          KeyName:
                            type: string
                            example: key
                          SubnetId:
                            type: string
                            example: subnet-...
                          Placement:
                            type: object
                            properties:
                              Tenancy:
                                type: string
                                example: default
                              GroupName:
                                type: string
                                example: ''
                              AvailabilityZone:
                                type: string
                                example: ca-central-1b
                          CpuOptions:
                            type: object
                            properties:
                              CoreCount:
                                type: integer
                                example: 2
                                default: 0
                              ThreadsPerCore:
                                type: integer
                                example: 1
                                default: 0
                          EnaSupport:
                            type: boolean
                            example: true
                            default: true
                          Hypervisor:
                            type: string
                            example: xen
                          InstanceId:
                            type: string
                            example: i-...
                          LaunchTime:
                            type: string
                            example: '2022-12-09 17:36:02+00:00'
                          Monitoring:
                            type: object
                            properties:
                              State:
                                type: string
                                example: disabled
                          ClientToken:
                            type: string
                            example: ''
                          StateReason:
                            type: object
                            properties:
                              Code:
                                type: string
                                example: Client.UserInitiatedShutdown
                              Message:
                                type: string
                                example: 'Client.UserInitiatedShutdown: User initiated shutdown'
                          Architecture:
                            type: string
                            example: x86_64
                          EbsOptimized:
                            type: boolean
                            example: false
                            default: true
                          InstanceType:
                            type: string
                            example: t2.medium
                          ProductCodes:
                            type: array
                          PublicDnsName:
                            type: string
                            example: ''
                          AmiLaunchIndex:
                            type: integer
                            example: 0
                            default: 0
                          EnclaveOptions:
                            type: object
                            properties:
                              Enabled:
                                type: boolean
                                example: false
                                default: true
                          PrivateDnsName:
                            type: string
                            example: ip-1-1-1-1.ca-central-1.compute.internal
                          RootDeviceName:
                            type: string
                            example: /dev/xvda
                          RootDeviceType:
                            type: string
                            example: ebs
                          SecurityGroups:
                            type: array
                            items:
                              type: object
                              properties:
                                GroupId:
                                  type: string
                                  example: sg-...
                                GroupName:
                                  type: string
                                  example: launch-wizard-5
                          UsageOperation:
                            type: string
                            example: RunInstances
                          MetadataOptions:
                            type: object
                            properties:
                              State:
                                type: string
                                example: applied
                              HttpTokens:
                                type: string
                                example: optional
                              HttpEndpoint:
                                type: string
                                example: enabled
                              HttpProtocolIpv6:
                                type: string
                                example: disabled
                              InstanceMetadataTags:
                                type: string
                                example: enabled
                              HttpPutResponseHopLimit:
                                type: integer
                                example: 1
                                default: 0
                          PlatformDetails:
                            type: string
                            example: Linux/UNIX
                          PublicIpAddress:
                            type: string
                            example: 1.1.1.1
                          SourceDestCheck:
                            type: boolean
                            example: true
                            default: true
                          PrivateIpAddress:
                            type: string
                            example: 1.1.1.1
                          NetworkInterfaces:
                            type: array
                            items:
                              type: object
                              properties:
                                VpcId:
                                  type: string
                                  example: vpc-...
                                Groups:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      GroupId:
                                        type: string
                                        example: sg-...
                                      GroupName:
                                        type: string
                                        example: launch-wizard-5
                                Status:
                                  type: string
                                  example: in-use
                                OwnerId:
                                  type: string
                                  example: ...
                                SubnetId:
                                  type: string
                                  example: subnet-...
                                Attachment:
                                  type: object
                                  properties:
                                    Status:
                                      type: string
                                      example: attached
                                    AttachTime:
                                      type: string
                                      example: '2022-01-10 21:43:59+00:00'
                                    DeviceIndex:
                                      type: integer
                                      example: 0
                                      default: 0
                                    AttachmentId:
                                      type: string
                                      example: eni-attach-...
                                    NetworkCardIndex:
                                      type: integer
                                      example: 0
                                      default: 0
                                    DeleteOnTermination:
                                      type: boolean
                                      example: true
                                      default: true
                                MacAddress:
                                  type: string
                                  example: '1:1:1:1:1'
                                Description:
                                  type: string
                                  example: ''
                                InterfaceType:
                                  type: string
                                  example: interface
                                Ipv6Addresses:
                                  type: array
                                PrivateDnsName:
                                  type: string
                                  example: ip-1-1-1-1.ca-central-1.compute.internal
                                SourceDestCheck:
                                  type: boolean
                                  example: true
                                  default: true
                                PrivateIpAddress:
                                  type: string
                                  example: 1.1.1.1
                                NetworkInterfaceId:
                                  type: string
                                  example: eni-...
                                PrivateIpAddresses:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      Primary:
                                        type: boolean
                                        example: true
                                        default: true
                                      PrivateDnsName:
                                        type: string
                                        example: ip-1-1-1-1.ca-central-1.compute.internal
                                      PrivateIpAddress:
                                        type: string
                                        example: 1.1.1.1
                          HibernationOptions:
                            type: object
                            properties:
                              Configured:
                                type: boolean
                                example: false
                                default: true
                          MaintenanceOptions:
                            type: object
                            properties:
                              AutoRecovery:
                                type: string
                                example: default
                          VirtualizationType:
                            type: string
                            example: hvm
                          BlockDeviceMappings:
                            type: array
                            items:
                              type: object
                              properties:
                                Ebs:
                                  type: object
                                  properties:
                                    Status:
                                      type: string
                                      example: attached
                                    VolumeId:
                                      type: string
                                      example: vol-...
                                    AttachTime:
                                      type: string
                                      example: '2022-01-10 21:44:00+00:00'
                                    DeleteOnTermination:
                                      type: boolean
                                      example: true
                                      default: true
                                DeviceName:
                                  type: string
                                  example: /dev/xvda
                          PrivateDnsNameOptions:
                            type: object
                            properties:
                              HostnameType:
                                type: string
                                example: ip-name
                              EnableResourceNameDnsARecord:
                                type: boolean
                                example: true
                                default: true
                              EnableResourceNameDnsAAAARecord:
                                type: boolean
                                example: false
                                default: true
                          StateTransitionReason:
                            type: string
                            example: User initiated (2022-12-09 17:38:07 GMT)
                          UsageOperationUpdateTime:
                            type: string
                            example: '2022-01-10 21:43:59+00:00'
                          CapacityReservationSpecification:
                            type: object
                            properties:
                              CapacityReservationPreference:
                                type: string
                                example: open
                      metadata:
                        type: object
                        properties:
                          hash:
                            type: string
                            example: ...
                          groups:
                            type: array
                          created:
                            type: string
                            example: '2022-12-09 17:36:02+00:00'
                          owner_id:
                            type: string
                            example: ...
                          response_metadata:
                            type: object
                            properties:
                              RequestId:
                                type: string
                                example: ...
                              HTTPHeaders:
                                type: object
                                properties:
                                  date:
                                    type: string
                                    example: Fri, 09 Dec 2022 17:42:39 GMT
                                  vary:
                                    type: string
                                    example: accept-encoding
                                  server:
                                    type: string
                                    example: AmazonEC2
                                  content-type:
                                    type: string
                                    example: text/xml;charset=UTF-8
                                  cache-control:
                                    type: string
                                    example: no-cache, no-store
                                  x-amzn-requestid:
                                    type: string
                                    example: ...
                                  transfer-encoding:
                                    type: string
                                    example: chunked
                                  strict-transport-security:
                                    type: string
                                    example: max-age=31536000; includeSubDomains
                              RetryAttempts:
                                type: integer
                                example: 0
                                default: 0
                              HTTPStatusCode:
                                type: integer
                                example: 200
                                default: 0
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
  /iac/configs:
    get:
      summary: Get IaC Configurations
      description: Provides a list of IaC configurations.
      operationId: get-iac-configurations
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: |-
                    [
                      {
                            "id": 1,
                            "organization_id": 7,
                            "name": "Zero Tags",
                            "description": "Resouces that are not tagged.",
                            "pack_id": 3,
                            "source": "custom",
                            "insights_blacklist": [],
                            "insights_warn_only": [],
                            "slack_channel": null,
                            "email_recipients": null,
                            "last_build_at": "2020-01-17T13:31:30Z",
                            "created_at": "2019-11-21T09:24:15Z",
                            "last_modified": "2020-03-12T07:38:34Z",
                            "total_builds": 13,
                            "success_count": 2,
                            "failure_count": 11,
                            "consumption_url": "http://localhost:8001/v3/iac/scan"
                        },
                        {
                            "id": 2,
                            "organization_id": 7,
                            "name": "Dynamic Analysis",
                            "description": "fdsafdsa",
                            "pack_id": 3,
                            "source": "backoffice",
                            "insights_blacklist": [],
                            "insights_warn_only": [],
                            "slack_channel": "",
                            "email_recipients": [],
                            "last_build_at": "2020-01-17T12:55:14Z",
                            "created_at": "2020-01-15T12:56:43Z",
                            "last_modified": "2020-03-12T07:38:34Z",
                            "total_builds": 4,
                            "success_count": 0,
                            "failure_count": 4,
                            "consumption_url": "http://localhost:8001/v3/iac/scan"
                        }
                    ]
              schema:
                type: array
                items:
                  type: object
                  properties:
                    id:
                      type: integer
                      example: 1
                      default: 0
                    organization_id:
                      type: integer
                      example: 7
                      default: 0
                    name:
                      type: string
                      example: Zero Tags
                    description:
                      type: string
                      example: Resouces that are not tagged.
                    pack_id:
                      type: integer
                      example: 3
                      default: 0
                    source:
                      type: string
                      example: custom
                    insights_blacklist:
                      type: array
                    insights_warn_only:
                      type: array
                    slack_channel: {}
                    email_recipients: {}
                    last_build_at:
                      type: string
                      example: '2020-01-17T13:31:30Z'
                    created_at:
                      type: string
                      example: '2019-11-21T09:24:15Z'
                    last_modified:
                      type: string
                      example: '2020-03-12T07:38:34Z'
                    total_builds:
                      type: integer
                      example: 13
                      default: 0
                    success_count:
                      type: integer
                      example: 2
                      default: 0
                    failure_count:
                      type: integer
                      example: 11
                      default: 0
                    consumption_url:
                      type: string
                      example: http://localhost:8001/v3/iac/scan
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
  /iac/scans:
    get:
      summary: Get all IaC scan results
      description: Retrieves the results for all completed IaC scans
      operationId: getAllIacScanResults
      parameters: []
      responses:
        '200':
          description: OK - All scan results retrieved
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/getAllIacScanResults200'
  /iac/scans/{scan_id}:
    get:
      summary: Get detailed IaC scan results
      description: Retrieves the detailed results for a given IaC scan
      operationId: getDetailedIacScanResults
      parameters:
        - name: scan_id
          in: path
          description: Provide the ID of the scan you'd like to request information about.
          schema:
            type: integer
            format: int32
          required: true
        - name: readable
          in: query
          description: Only applies if you're requesting JSON output. See the `/scan` endpoint documentation for more details.
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: OK - Detailed scan results retrieved
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/getReadableDetailedIacScanResults200'
                  - $ref: '#/components/schemas/getDetailedIacScanResults200'
  /iac/scan:
    post:
      summary: Initiate IaC Scan
      description: Initiates an IaC Scan
      operationId: initiate-iac-scan
      parameters:
        - name: readable
          in: query
          description: If `true`, return a simplified but more redundant JSON.
          schema:
            type: boolean
            default: false
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - scan_template
                - config_name
                - scan_name
                - author_name
                - iac_provider
              properties:
                scan_template:
                  type: string
                  description: Provide a JSON-formatted Terraform plan as generated by `terraform plan -out out.plan && terraform show -json out.plan`.
                config_name:
                  type: string
                  description: Provide the name of the configuration you want to scan the Terraform plan against.
                scan_name:
                  type: string
                  description: Provide a value to name your scan as shown in the Scans listing page.
                author_name:
                  type: string
                  description: Provide a value to provide an author name to associate with your scan. For instance, you could provide the name of the CD platform or job, or the person who set it up.
                iac_provider:
                  type: string
                  description: The IaC provider. Review the [IaC Overview](iac-overview#what-is-supported) for a full list of supported providers.
                  enum:
                    - terraform
                    - cft
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Example with `?readable=true`:
                  value: |-
                    {
                      "build_id": 9,
                      "config_name": "tests config1",
                      "message": "Your InsightCloudSec IaC Scan failed with 1 failed resources, 0 resource with warnings, 0 unanalyzed resources, and 0 error(s).",
                      "scan_results": "http://localhost:8001/iac/home/builds/9",
                      "success": false,
                      "status": "failure",
                      "errors": [],
                      "resources": [
                        {
                          "resource_source": "terraform",
                          "resource_address": "aws_s3_bucket.bucket",
                          "resource_name": "my-tf-test-bucket",
                          "resource_type": "storagecontainer",
                          "resource_region": "eu-north-1",
                          "passed_rules": [
                            {
                              "rule_name": "Storage Container Not Enforcing Encryption At Rest",
                              "rule_description": "Identify storage containers, e.g., AWS S3 buckets, without object encryption enabled",
                              "rule_detail": "## Overview -- Ensuring that storage containers are encrypted at rest wherever possible is an effective means at assuring the protection of the data stored on those containers. It may not be appropriate to always enforce encryption for things that are intended to be shared to a large audience but it is generally a boon. ### Remediation -- Leverage bot automation to notify you of storage containers that are not encrypted at rest, clean up exposed storage containers, and in certain cases, encrypt the storage container. ### Recommended Bot Workflow -- - Mark Resource Noncompliant: Flag storage containers not enforcing encryption at rest. - Send Email/Slack Notification: Notify operations/security team of these storage containers. - Cleanup Exposed Storage Container: Remove permissions from exposed storage containers, making them less accessible for exploitation - Encrypt Storage Container: Will protect vulnerable servers by mandating encryption. **Warning: Will overwrite any pre-existing bucket policies.** ### Compliance Information -- - HIPAA: Encryption Controls - \u00a7164.312(a)(2)(iv) - NIST 800-53: SC-28 - PCI DSS: Requirement 3: Protect stored cardholder data - NIST Cyber Security Framework (CSF): PR.DS-1 - GDPR: Article 32: Data protection by Design and by Default - SOC 2: C1.1, CC1.2, C1.7, CC5.6"
                            }
                          ],
                          "warning_rules": [],
                          "failed_rules": [
                            {
                              "rule_name": "Storage Container Without Access Logging",
                              "rule_description": "Identify storage containers, such as AWS S3, without access logging enabled",
                              "rule_detail": "Overview ---------- Storage Container Access Logging maintains a log of each access request to your storage containers, assisting in determining, preventing and diagnosing invalid access and data leakage concerns. It is recommended that storage container access logging be enabled wherever sensitive data is held. ### Remediation -- Leverage Bot automation to identify and monitor storage containers storing API Accounting Config logs to ensure they have access logging enabled ### Recommend Bot Workflow -- - Mark Resource Noncompliant: Mark API Accounting Configs that have logs in storage containers without access logging enabled - Send Email/Slack Notification: Notify operations/security team of API Accounting Configs that have logs in storage containers without access logging enabled. Separately, using cloud badges, identify cloud account owners and notify them of the steps to enable access logging on storage containers storing API Accounting Config logs - Enabled Access Logging: After providing sufficient time for corrective action, update the access logging property of the relevant storage containers ### Compliance Information -- - NIST 800-53: AU-12 - HIPAA: Audit Controls - \u00a7164.312(b) - PCI DSS: Requirement 10: Track and monitor all access to network resources and cardholder data - GDPR: Article 30: Maintain Records of Processing Activities - ISO 27001: A.10.10.1 - Audit Logging - SOC 2: A1.2, CC6.1 - FedRAMP CCM 3.0.1: IVS-01 - Center for Internet Security (CIS) - GCP: Storage 5.3"
                            }
                          ]
                        }
                      ],
                      "stacktrace": null
                    }
                Example without `?readable=true`:
                  value: |-
                    {
                      "build_id": 12,
                      "config_name": "tests config1",
                      "details": {
                        "failed_insights": [
                          {
                            "description": "Identify storage containers, such as AWS S3, without access logging enabled",
                            "failure": [
                              "storagecontainer:6"
                            ],
                            "id": 90,
                            "name": "Storage Container Without Access Logging",
                            "notes": "Overview\n----------\n\nStorage Container Access Logging maintains a log of each access request to your storage containers, assisting in determining, preventing and diagnosing invalid access and data leakage concerns.  It is recommended that storage container access logging be enabled wherever sensitive data is held.\n\n### Remediation\n\nLeverage Bot automation to identify and monitor storage containers storing API Accounting Config logs to ensure they have access logging enabled\n\n### Recommend Bot Workflow\n\n - Mark Resource Noncompliant: Mark API Accounting Configs that have logs in storage containers without access logging enabled\n - Send Email/Slack Notification: Notify operations/security team of  API Accounting Configs that have logs in storage containers without access logging enabled. Separately, using cloud badges, identify cloud account owners and notify them of the steps to enable access logging on storage containers storing API Accounting Config logs\n - Enabled Access Logging: After providing sufficient time for corrective action, update the access logging property of the relevant storage containers\n\n### Compliance Information\n  - NIST 800-53: AU-12\n  - HIPAA: Audit Controls - §164.312(b)\n  - PCI DSS: Requirement 10: Track and monitor all access to network\nresources and cardholder data\n  - GDPR: Article 30: Maintain Records of Processing Activities\n  - ISO 27001: A.10.10.1 - Audit Logging\n  - SOC 2: A1.2, CC6.1\n  - FedRAMP CCM 3.0.1: IVS-01\n  - Center for Internet Security (CIS) - GCP: Storage 5.3",
                            "resource_types": [
                              "storagecontainer"
                            ],
                            "severity": 3,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          }
                        ],
                        "failed_resources": 1,
                        "passed_insights": [
                          {
                            "description": "Identify storage containers, e.g., AWS S3 buckets, without object encryption enabled",
                            "failure": [],
                            "id": 60,
                            "name": "Storage Container Not Enforcing Encryption At Rest",
                            "notes": "## Overview\n\nEnsuring that storage containers are encrypted at rest wherever possible is an effective means at assuring the protection of the data stored on those containers.  It may not be appropriate to always enforce encryption for things that are intended to be shared to a large audience but it is generally a boon. \n\n### Remediation\n\nLeverage bot automation to notify you of storage containers that are not encrypted at rest, clean up exposed storage containers, and in certain cases, encrypt the storage container. \n\n### Recommended Bot Workflow\n\n - Mark Resource Noncompliant: Flag storage containers not enforcing encryption at rest.\n - Send Email/Slack Notification: Notify operations/security team of these storage containers.  \n - Cleanup Exposed Storage Container: Remove permissions from exposed storage containers, making them less accessible for exploitation\n - Encrypt Storage Container: Will protect vulnerable servers by mandating encryption.  **Warning: Will overwrite any pre-existing bucket policies.**\n\n\n### Compliance Information\n  - HIPAA: Encryption Controls - §164.312(a)(2)(iv)\n  - NIST 800-53: SC-28\n  - PCI DSS: Requirement 3: Protect stored cardholder data\n  - NIST Cyber Security Framework (CSF): PR.DS-1\n  - GDPR: Article 32: Data protection by Design and by Default\n  - SOC 2: C1.1, CC1.2, C1.7, CC5.6",
                            "resource_types": [
                              "storagecontainer"
                            ],
                            "severity": 4,
                            "source": "backoffice",
                            "success": [
                              "storagecontainer:6"
                            ],
                            "warn_only": false,
                            "warning": []
                          }
                        ],
                        "passed_resources": 0,
                        "skipped_insights": [
                          {
                            "description": "Identify accounts without API Accounting Config, such as AWS CloudTrail, enabled across all regions",
                            "failure": [],
                            "id": 2,
                            "name": "Cloud Account Without Global API Accounting Config",
                            "notes": "Overview\n----------\n\nGlobal API Accounting Config records API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the specific cloud service. Global API Accounting provides a history of API calls for each account, including API calls made via the management console, SDKs, command line tools, and other cloud services.\n\n\n### Remediation\n\nLeverage Bot automation to identify and monitor cloud accounts that do not have global API Accounting Config in effect\n\n### Recommended Bot Workflow\n\n - Mark Resource Noncompliant: Flag cloud accounts that do not have global API Accounting Config in effect\n - Send Email/Slack Notification: Notify operations/security team of cloud accounts that do not have global API Accounting Config in effect. Separately, using cloud badges, identify cloud account owners and notify them of the steps to enable global API Accounting Config\n\n### Amazon Web Services\n1. Login to AWS Console (with appropriate permissions to View Identity Access Management Account Settings)\n2. Click on Trails on the left navigation pane\n3. Click Get Started Now, if presented:\n   - Click Add new trail\n   - Enter a trail name in the Trail name box\n   - Set the Apply trail to all regions option to Yes\n   - Specify an S3 bucket name in the S3 bucket box\n   - Click Create\n4. If 1 or more trails already exist, select the target trail to enable for global logging:\n   - Click the edit icon (pencil) next to Apply trail to all regions\n   - Click Yes\n   - Click Save\n\n### Compliance Information\n  - NIST Cyber Security Framework (CSF): DE.AE-1, DE.CM-3, ID.AM-1\n  - HIPAA: Audit Controls - §164.312(b)\n  - NIST 800-53: AU-12\n  - PCI DSS: Requirement 10: Track and monitor all access to network\nresources and cardholder data\n  - Center for Internet Security (CIS) - AWS: Logging 2.1\n  - GDPR: Article 30: Maintain Records of Processing Activities\n  - ISO 27001: A.10.10.1 - Audit Logging\n  - SOC 2: A1.2, CC5.3, CC6.1\n  - CSA Cloud Controls Matrix (CCM): AIS-04, BCR-07, BCR-10, BCR-11, IAM-01, IAM-12, IVS-01, IVS-03\n  - AWS Financial Services Framework (FSF): CloudTrail-V116395888",
                            "resource_types": [
                              "divvyorganizationservice"
                            ],
                            "severity": 5,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify expired/soon to expire SSL certificates",
                            "failure": [],
                            "id": 8,
                            "name": "SSL Certificate Expired",
                            "notes": "## Overview\n\nSSL listeners enable load balancers, compute instances, databases and other resources to establish secure connections that encrypt sensitive information in transit.  SSL encryption affords users the ability to reasonably trust that their communications are not being intercepted by unknown parties.  SSL is also considered to be a baseline level of security, is required by PCI standards, and almost every regulatory compliance requirement that touches upon security.  Expired SSL certificates should be remedied immediately. \n\n### Remediation\n\nManual remediation is required.  \n\n### Recommended Bot Workflow\n\n- Mark Resource Non-Compliant: Expired SSL certificates should be marked as non-compliant as they might falsely give confidence of privacy protection.\n- ServiceNow Incident: Create an issue within ServiceNow. \n- Send Email/Slack Notification: Notify operations/security team of expired SSL certificates. \n\n\n### Compliance Information\n  - NIST 800-53 (Rev 4) - Do not publish: SC-8\n  - HIPAA: Encryption Controls - §164.312(a)(2)(iv)\n  - PCI DSS: Requirement 4: Encrypt transmission of cardholder data across 0\nopen, public networks\n  - GDPR: Article 25: Data protection by Design and by Default\n  - SOC 2: C1.2, C1.3, C1.7, CC5.6, CC5.7\n  - CSA Cloud Controls Matrix (CCM): EKM-03",
                            "resource_types": [
                              "servicecertificate"
                            ],
                            "severity": 4,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify accounts with API access keys present on the root account",
                            "failure": [],
                            "id": 9,
                            "name": "Cloud Root Account API Access Key Present",
                            "notes": "Overview\n----------\n\nThe root account is the most privileged user in a cloud account. API Keys provide programmatic access to a given cloud account. It is recommended that all API keys associated with the root account be removed.\n\n\n### Remediation\n\nLeverage Bot automation to identify cloud accounts that have API access keys present on the root account and alert cloud account owners\n\n### Recommended Bot Workflow\n\n - Mark Resource Noncompliant: Flag cloud accounts that have API access keys present on the root account\n - Send Email/Slack Notification: Notify operations/security team of these cloud accounts. Separately, using cloud account badges to identify owners, notify owners of the actions they need to take to remove the offending API access keys\n - Deactivate API Key: After providing enough time for cloud account owners to take corrective action, deactivate the offending API access keys\n\n### Amazon Web Services\n1. Login to AWS Console (with appropriate permissions to View Identity Access Management Account Settings)\n2. Click on <Root_Account_Name> at the top right and select Security Credentials from the drop down list\n3. On the pop out screen Click on Continue to Security Credentials\n4. Click on Access Keys (Access Key ID and Secret Access Key) \n5. Under the Status column if there are any Keys which are Active\n   a. Click on Make Inactive - (Temporarily disable Key - may be needed again)\n   b. Click Delete - (Deleted keys cannot be recovered)\n\n### Compliance Information\n  - NIST 800-53 (Rev 4) - Do not publish: AC-3(7), AC-6, AC-6(7), SA-17(7)\n  - NIST 800-53: AC-6\n  - Center for Internet Security (CIS) - AWS: Identity & Access Management 1.12\n  - HIPAA: Access Control - §164.312(a)(1)\n  - ISO 27001: A.11.5.1 - Secure log-on procedures\n  - PCI DSS: Requirement 8: Identify and authenticate access to system\ncomponents\n  - SOC 2: CC5.3, CC5.4\n  - FedRAMP CCM 3.0.1: IVS-11\n  - CSA Cloud Controls Matrix (CCM): AIS-04, EKM-01, EKM-02, EKM-03, GRM-06, IAM-01, IAM-02, IAM-04, IAM-05, IAM-10, IAM-11",
                            "resource_types": [
                              "divvyorganizationservice"
                            ],
                            "severity": 5,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Match load balancers that do not have access logging disabled",
                            "failure": [],
                            "id": 11,
                            "name": "Load Balancer Access Logging Disabled",
                            "notes": "## Overview\n\nThis insight will be triggered whenever we detect a load balancer that has not enabled logging.  Logging is crucial in detecting intrusion attempts, monitoring access, as well as helping debug access errors and system failures during and after the fact.  Almost every compliance framework will mandate logging be enabled.\n\n### Remediation\n\nEnable logging for all load balancers.\n\n### Recommended Bot Workflow\n\n - Mark Resource Noncompliant: Flag load balancers that do not have logging enabled\n - Send Email/Slack Notification: Notify operations/security team of these load balancers.  \n\n\n### Compliance Information\n  - HIPAA: Audit Controls - §164.312(b)\n  - PCI DSS: Requirement 10: Track and monitor all access to network\nresources and cardholder data\n  - NIST 800-53: AU-12\n  - GDPR: Article 30: Maintain Records of Processing Activities\n  - SOC 2: A1.2, CC5.2, CC6.1\n  - FedRAMP CCM 3.0.1: IVS-01",
                            "resource_types": [
                              "loadbalancer"
                            ],
                            "severity": 4,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify accounts which still have the root account active without two-factor protection.",
                            "failure": [],
                            "id": 20,
                            "name": "Cloud Account Without Root Account MFA Protection",
                            "notes": "Overview\n----------\n\nThe root account is the most privileged user in a cloud account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to the cloud account, (s)he will be prompted for user name and password as well as for an authentication code from a AWS MFA device.\n\nNote: When virtual MFA is used for root accounts, it is recommended that the device used is NOT a personal device, but rather a dedicated mobile device (tablet or phone) that is managed to be kept charged and secured independent of any individual personal devices. (\"non-personal virtual MFA\") This lessens the risks of losing access to the MFA due to device loss, device trade-in or if the individual owning the device is no longer employed at the company\n\n\n\n### Remediation\n\nLeverage Bot automation to identify cloud accounts that do not have root account MFA protection\n\n### Recommended Bot Workflow\n\n - Mark Resource Noncompliant: Flag cloud accounts that do not have MFA enabled on root accounts\n - Send Email/Slack Notification: Notify operations/security team of these cloud accounts. Separately, using cloud account badges to identify owners, notify owners of the actions they need to take to enable MFA on the root accounts\n\n### Amazon Web Services\n1. Login to AWS Console (with appropriate permissions to View Identity Access Management Account Settings)\n2. Choose Dashboard, and under Security Status, expand Activate MFA on your root account.\n3. Choose Activate MFA\n4. In the wizard, choose A virtual MFA device and then choose Next Step.\n5. IAM generates and displays configuration information for the virtual MFA device, including a QR code graphic. The graphic is a representation of the 'secret configuration key' that is available for manual entry on devices that do not support QR codes.\n6. Open your virtual MFA application. (For a list of apps that you can use for hosting virtual MFA devices, see Virtual MFA Applications.) If the virtual MFA application supports multiple accounts (multiple virtual MFA devices), choose the option to create a new account (a new virtual MFA device).\n7. Determine whether the MFA app supports QR codes, and then do one of the following:\n   o Use the app to scan the QR code. For example, you might choose the camera icon or choose an option similar to Scan code, and then use the device's camera to scan the code.\n   o In the Manage MFA Device wizard, choose Show secret key for manual configuration, and then type the secret configuration key into your MFA application.\n\nWhen you are finished, the virtual MFA device starts generating one-time passwords. \n1. In the Manage MFA Device wizard, in the Authentication Code 1 box, type the onetime password that currently appears in the virtual MFA device. Wait up to 30 seconds for the device to generate a new one-time password. Then type the second one-time password into the Authentication Code 2 box. Choose Active Virtual MFA.\n\n### Compliance Information\n  - HIPAA: Access Control - §164.312(a)(1)\n  - NIST 800-53 (Rev 4) - Do not publish: IA-5.a, IA-2\n  - NIST Cyber Security Framework (CSF): ID.AM-6, PR.AC-1\n  - Center for Internet Security (CIS) - AWS: Identity & Access Management 1.13\n  - PCI DSS: Requirement 8: Identify and authenticate access to system\ncomponents\n  - SOC 2: CC5.3, CC5.7\n  - NIST 800-53: PM-11\n  - CSA Cloud Controls Matrix (CCM): AIS-04, EKM-01, EKM-02, EKM-03, GRM-06, IAM-01, IAM-02, IAM-04, IAM-05, IAM-10, IAM-11, IAM-12",
                            "resource_types": [
                              "divvyorganizationservice"
                            ],
                            "severity": 5,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify database instances which are not encrypted",
                            "failure": [],
                            "id": 23,
                            "name": "Database Instance Not Encrypted",
                            "notes": "## Overview\n\nDatabase instances store sensitive information.  As such, it is crucial to keep them secure and up to compliance standards.  This insight will detect when database instances exist without encryption.  \n\nEncrypting database instance data can help you meet stricter security and encryption compliance requirements. Many cloud providers do not encrypt databases by default, and require customers to handle opt-in to this during resource creation.\n\n### Remediation\n\nLeverage Bot automation to identify, alert, and potentially enable encryption on database instances that are not encrypted.\n\n### Recommended Bot Workflow\n- Mark Resource Noncompliant: Flag unencrypted database instances\n- Send Email/Slack Notification: Notify operations/security team of these db instances. Separately, notify users of the actions they should take if they do not wish for their instances to be stopped or deleted.\n- Stop Database Instance: Schedule instance to be stopped.\n- Delete Database Instance: In extreme instances, you may schedule the resource to be deleted.\n\n\n### Compliance Information\n  - NIST 800-53: SC-28\n  - NIST Cyber Security Framework (CSF): PR.DS-1\n  - HIPAA: Encryption Controls - §164.312(a)(2)(iv)\n  - GDPR: Article 32: Data protection by Design and by Default\n  - PCI DSS: Requirement 3: Protect stored cardholder data\n  - SOC 2: C1.1, C1.2, C1.7, CC5.6\n  - CSA Cloud Controls Matrix (CCM): DSI-03, EKM-03",
                            "resource_types": [
                              "dbinstance"
                            ],
                            "severity": 4,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify encryption keys that are expired or are expiring within the next 14 days.",
                            "failure": [],
                            "id": 25,
                            "name": "Encryption Key Expired or Expiring Soon",
                            "notes": "## Overview\n\nEncryption keys that are slated to expire soon pose a risk to the applications and users that rely on those encryption keys.  To prevent loss of access to production accounts and data, expiration dates should be monitored and accounted for before expiration occurs.\n\n### Remediation\n\nIn the event that key rotation is enabled, and expiration is planned for, no remediation may be necessary.  In the event that key expiration is unexpected or unplanned for, it may be necessary to notify affected users and application owners. \n\n### Recommended Bot Workflow\n\n- Send Email/Slack Notification: Notify operations/security team of these accounts. Separately, notify users of the actions they must take if they do not wish to have their account disabled\n- Disable Key Rotation: For resources tagged or badged as appropriate, it may be worthwhile to temporarily leverage Bot Factory to disable key rotation for the affected resource\n\n### Compliance Information\n  - NIST 800-53 (Rev 4) - Do not publish: SC-12\n  - HIPAA: Encryption Controls - §164.312(a)(2)(iv)\n  - PCI DSS: Requirement 8: Identify and authenticate access to system\ncomponents",
                            "resource_types": [
                              "serviceencryptionkey"
                            ],
                            "severity": 4,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify load balancers without an SSL listener",
                            "failure": [],
                            "id": 27,
                            "name": "Load Balancer Without SSL Listener",
                            "notes": "## Overview\n\nSSL listeners enable load balancers to establish secure connections that encrypt sensitive information in transit.  SSL encryption affords users the ability to reasonably trust that their communications are not being intercepted by unknown parties.  SSL is also considered to be a baseline level of security, is required by PCI standards, and almost every regulatory compliance requirement that touches upon security. \n\n### Remediation\n\nLeverage Bot automation to identify and alert about load balancers that do not have an SSL listener.\n\n### Recommended Bot Workflow\n- Mark Resource Noncompliant: Flag load balancers that do not have an SSL listener\n- Send Email/Slack Notification: Notify operations/security team of these load balancers. Separately, notify users of follow up actions they must take.\n\n\n### Compliance Information\n  - PCI DSS: Requirement 4: Encrypt transmission of cardholder data across\nopen, public networks\n  - HIPAA: Transport Controls - §164.312(e)(2)(i)\n\n  - NIST 800-53: SC-8\n  - NIST Cyber Security Framework (CSF): PR.DS-2\n  - GDPR: Article 25: Data protection by Design and by Default\n  - SOC 2: C1.2, CC5.7\n  - CSA Cloud Controls Matrix (CCM): EKM-03",
                            "resource_types": [
                              "loadbalancer"
                            ],
                            "severity": 4,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify big data instances, e.g. AWS Redshift, that do not have encryption enabled",
                            "failure": [],
                            "id": 28,
                            "name": "Big Data Instance Encryption Not Enabled",
                            "notes": "## Overview\n\nBig Data instances store sensitive information.  As such, it is crucial to keep them secure and up to compliance standards.  This insight will detect when big data instances exist without encryption.  \n\nEncrypting big data instance data can help you meet stricter security and encryption compliance requirements. Many cloud providers do not encrypt big data instances by default, and require customers to handle opt-in to this during resource creation.\n\n### Remediation\n\nLeverage Bot automation to identify, alert, and possibly encrypt big data instances that are unencrypted.\n\n### Recommended Bot Workflow\n\n- Mark Resource Noncompliant: Flag unencrypted big data instances\n- Send Email/Slack Notification: Notify operations/security team of these db instances. Separately, notify users of the actions they should take if they do not wish for their instances to be stopped or deleted.\n- Create Big Data Instance Snapshot: Create a snapshot of a big data instance\n\n### Compliance Information\n  - HIPAA: Encryption Controls - §164.312(a)(2)(iv)\n  - NIST 800-53: SC-28\n  - NIST Cyber Security Framework (CSF): PR.DS-1\n  - PCI DSS: Requirement 3: Protect stored cardholder data\n  - GDPR: Article 32: Data protection by Design and by Default\n  - SOC 2: C1.1, CC1.2, C1.7, CC5.6",
                            "resource_types": [
                              "bigdatainstance"
                            ],
                            "severity": 4,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify Networks, e.g., AWS VPCs, that do not have network logging enabled",
                            "failure": [],
                            "id": 34,
                            "name": "Network Without Traffic Logging",
                            "notes": "Overview\n----------\n\nNetwork Traffic Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your network. Network Traffic Logs provide visibility into network traffic that traverses the network and can be used to detect anomalous traffic or insight during security workflows.\n\n\n### Remediation\n\nLeverage Bot automation to identify and monitor for Networks without traffic logging enabled. Take automated action to delete networks\n\n### Recommend Bot Workflow\n\n - Mark Resource Noncompliant: Mark Networks without traffic logging enabled\n - Send Email/Slack Notification: Notify operations/security team of Networks without traffic logging enabled. Separately, using cloud badges or resource tags, identify Network owners and notify them of the steps needed to enable traffic logging\n - Delete Resource: After providing sufficient time for corrective action, delete Network\n\n### Amazon Web Services\n1. Sign into the management console\n2. Select Services then VPC \n3. In the left navigation pane, select Your VPCs\n4. Select a VPC\n5. In the right pane, select the Flow Logs tab.\n6. If no Flow Log exists, click Create Flow Log\n7. For Filter, select Reject\n8. Enter in a Role and Destination Log Group\n9. Click Create Log Flow\n10. Click on CloudWatch Logs Group\n\n\n### Compliance Information\n  - HIPAA: Audit Controls - §164.312(b)\n  - NIST 800-53: AU-12\n  - PCI DSS: Requirement 10: Track and monitor all access to network\nresources and cardholder data\n  - NIST Cyber Security Framework (CSF): DE.CM-1\n  - Center for Internet Security (CIS) - AWS: Logging 2.9\n  - GDPR: Article 30: Maintain Records of Processing Activities\n  - ISO 27001: A.10.10.1 - Audit Logging\n  - SOC 2: A1.2, CC6.1\n  - FedRAMP CCM 3.0.1: IVS-01",
                            "resource_types": [
                              "privatenetwork"
                            ],
                            "severity": 5,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify encryption keys that have key rotation disabled",
                            "failure": [],
                            "id": 35,
                            "name": "Encryption Key Rotation Disabled",
                            "notes": "## Overview\n\nCryptographic best practices discourage extensive reuse of encryption keys, and that is doubly true for service accounts.  \n\n### Remediation\n\nEnable \n\n### Recommended Bot Workflow\n\n- Mark Resource Noncompliant: Resources without service key encryption should be marked non-compliant if the infrastructure is bound to a regulatory compliance.\n- Send Email/Slack Notification: This insight can be paired with `Service Encryption Key Expired or Expiring Soon`, and notifications can be triggered for resources that are both expired and without rotation enabled.\n- Enable Encryption Key Rotation: For resources that are not expired, rotation can be programmatically enabled through Bot Factory.  **Warning: Notifications should still be sent to ensure that keys aren't rotated without giving users a chance to prepare.**\n\n### Compliance Information\n  - NIST 800-53 (Rev 4) - Do not publish: SC-12\n  - PCI DSS: Requirement 8: Identify and authenticate access to system\ncomponents\n  - ISO 27001: A.12.3.2 - Cryptographic controls\n  - SOC 2: C1.1, CC1.2, C1.7, CC5.6",
                            "resource_types": [
                              "serviceencryptionkey"
                            ],
                            "severity": 3,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify API keys that have not been used within the past 90 days",
                            "failure": [],
                            "id": 41,
                            "name": "API Key Unused For 90 Days",
                            "notes": "Overview\n----------\n\nAccess keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to cloud accounts. Service users need their own access keys to make programmatic calls to cloud accounts from, for example, Command Line Interfaces, Tools for Windows PowerShell, SDKs, or direct HTTP calls using the APIs for individual services. It is recommended that all access keys be regularly rotated.\n\n\n### Remediation\n\nLeverage Bot automation to identify, alert owners of, and deactivate access keys that have not been used in 90 or greater days.\n\n### Recommended Bot Workflow\n\n - Mark Resource Noncompliant: Flag access keys that have not been used in 90 or greater days\n - Send Email/Slack Notification: Notify operations/security team of these access keys. Separately, using cloud badges or resource tags, identify access key owners and notify them of the requirement to use access keys more frequently than 90 or greater days. Also inform them of the requirement to rotate access keys\n - Deactivate Access Keys: After providing sufficient time to take corrective action, deactivate access keys\n\n### Amazon Web Services\n1. Login to AWS Console (with appropriate permissions to View Identity Access Management Account Settings)\n2. Click Services\n3. Click IAM\n4. Click on Users\n5. Click on Security Credentials\n6. As an Administrator, click on Make Inactive for keys that have not been rotated in 90 Days\n7. As an IAM User, click on Make Inactive or Delete for keys which have not been rotated or used in 90 Days\n8. Click on Create Access Key\n9. Update programmatic call with new Access Key credentials\n\n### Compliance Information\n  - Center for Internet Security (CIS) - AWS: Identity & Access Management 1.3\n  - HIPAA: Access Control - §164.312(a)(1)\n  - PCI DSS: Requirement 7: Restrict access to cardholder data by business\nneed to know\n  - NIST 800-53: AC-2\n  - CSA Cloud Controls Matrix (CCM): AIS-04, EKM-01, EKM-02, EKM-03, GRM-06, IAM-01, IAM-02, IAM-04, IAM-05, IAM-10, IAM-11, IAM-12\n  - NIST Cyber Security Framework (CSF): PR.AC-1\n  - NIST 800-53 (Rev 4) - Do not publish: AC-2, SC-12",
                            "resource_types": [
                              "serviceaccesskey"
                            ],
                            "severity": 4,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify volumes without encryption enabled",
                            "failure": [],
                            "id": 46,
                            "name": "Volume Encryption Not Enabled",
                            "notes": "## Overview\n\nEncrypting volume data in-transit and at rest can help you meet stricter security and encryption compliance requirements. Many cloud providers do not encrypt data at rest by default, and require customers to handle opt-in to this during resource creation. This identifies persistent volumes such as Amazon Elastic Block Storage (EBS) devices which do not have that option enabled.\n\n### Remediation\n\nMany cloud providers do not natively support the ability to toggle encryption on the fly, and therefore manual remediation is required. In most scenarios it can be easier to just rebuild an entirely new instance and ensure that the block device mapping enables the encryption option for each device. \n\n1. Create a private image of the compute resource and enable encryption for each device\n2. Launch a replacement instance using the newly created image\n3. Retire/terminate the existing legacy instance\n\n\n### Compliance Information\n  - HIPAA: Encryption Controls - §164.312(a)(2)(iv)\n  - NIST 800-53: SC-28 \n  - PCI DSS: Requirement 3: Protect stored cardholder data\n  - NIST Cyber Security Framework (CSF): PR.DS-1\n  - GDPR: Article 32: Security of processing\n  - SOC 2: C1.1, CC1.2, C1.7, CC5.6, CC5.7",
                            "resource_types": [
                              "volume"
                            ],
                            "severity": 4,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify API Accounting Configs, e.g., AWS CloudTrail, configurations without log file validation enabled",
                            "failure": [],
                            "id": 58,
                            "name": "API Accounting Config Log File Validation Disabled",
                            "notes": "Overview\n----------\n\nAPI Accounting Config log file validation creates a digitally signed digest file containing a hash of each log that API Accounting Config writes to a storage container. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after API Accounting Config delivered the log. It is recommended that file validation be enabled on all API Accounting Config logs.\n\n\n### Remediation\n\nLeverage Bot automation to identify and monitor for API Accounting Config with log file validation disabled. Take automated action to enable log file validation\n\n### Recommend Bot Workflow\n\n - Mark Resource Noncompliant: Mark API Accounting Config with log file validation disabled\n - Send Email/Slack Notification: Notify operations/security team of API Accounting Config with log file validation disabled. Separately, using cloud badges, identify API Accounting Config owners and notify them of the steps needed to enable log file validation\n - Enable Log File Validation: After providing sufficient time for corrective action, enable log file validation\n\n### Amazon Web Services\n1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/cloudtrail\n2. Click on Trails on the left navigation pane\n3. Click on target trail\n4. Within the S3 section click on the edit icon (pencil)\n5. Click Advanced\n6. Click on the Yes radio button in section Enable log file validation\n7. Click Save\n\n### Compliance Information\n  - PCI DSS: Requirement 10: Track and monitor all access to network resources and cardholder data\n  - HIPAA: Data Integrity - §164.312(c)(1)\n  - Center for Internet Security (CIS) - AWS: Logging 2.2\n  - ISO 27001: A.10.10.1 - Audit Logging\n  - NIST 800-53: AU-9\n  - FedRAMP CCM 3.0.1: IVS-01\n  - SOC 2: A1.2\n  - CSA Cloud Controls Matrix (CCM): IVS-01",
                            "resource_types": [
                              "apiaccountingconfig"
                            ],
                            "severity": 3,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identifies compute instances exposing port 22 to the world",
                            "failure": [],
                            "id": 59,
                            "name": "Instance Exposing SSH To World",
                            "notes": "## Overview\n\nSecure Shell (SSH) is a protocol for connecting to a remote system using a cryptographically secure connection over what might be an unsecured network. SSH typically uses port 22 on the host system for connections. If the security group rules governing access to an instance leave this port open, it is possible for anyone to attempt to connect to the host system. Therefore it is recommended that connections using SSH only be allowed from trusted networks. \n\n### Remediation\n\nLeverage Bot automation to identify vulnerable instances and notify the appropriate operations/security teams to review the instance. \n\n### Recommended Bot Workflow\n\n- Mark Resource Noncompliant: Flag instances that have SSH open to the world. \n- Send Email/Slack Notification: Notify operations/security team of these instances. \n\n\n### Compliance Information\n  - NIST 800-53 (Rev 4) - Do not publish: AC-6, AC-17, AC-17(1), RA-5, SC-7, SC-8, SA-17(7)\n  - NIST 800-53: AC-17\n  - NIST Cyber Security Framework (CSF): ID.RA-1, PR.DS-5\n  - GDPR: Article 25: Data protection by Design and by Default\n  - ISO 27001: A.11.4.4 - Remote diagnostic and configuration port protection\n  - PCI DSS: Requirement 1: Install and maintain a firewall configuration to\nprotect cardholder data\n  - SOC 2: C1.1, C1.2, CC5.7\n  - FedRAMP CCM 3.0.1: IVS-07\n  - Center for Internet Security (CIS) 1.0.0 - Microsoft Azure: Networking 6.2\n  - Center for Internet Security (CIS) 1.1.0 - Microsoft Azure: Networking - 6.2 - Ensure that SSH access is restricted from the internet",
                            "resource_types": [
                              "instance"
                            ],
                            "severity": 5,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify API Accounting Configs, e.g., AWS CloudTrail, that are not logging all calls",
                            "failure": [],
                            "id": 62,
                            "name": "API Accounting Config Not Logging",
                            "notes": "Overview\n----------\n\nAPI Accounting Config is a web service that records API calls made in a given cloud account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the cloud service. API Accounting Config uses storage containers for log file storage and delivery, so log files are stored durably.\n\n\n### Remediation\n\nLeverage Bot automation to identify and monitor cloud accounts that do not have API Accounting Config logging in effect\n\n### Recommend Bot Workflow\n\n - Mark Resource Noncompliant: Flag cloud accounts that do not have API Accounting Config logging in effect\n - Send Email/Slack Notification: Notify operations/security team of cloud accounts that do not have API Accounting Config logging in effect. Separately, using cloud badges, identify cloud account owners and notify them of the steps to enable API Accounting Config logging\n\n### Amazon Web Services\n1. Sign in to the AWS Management Console and open the CloudTrail console at https://console.aws.amazon.com/cloudtrail/\n2. Under All Buckets, click on the target bucket you wish to evaluate\n3. Click Properties on the top right of the console\n4. Click Trails in the left menu\n5. Click on each trail where no CloudWatch Logs are defined\n6. Go to the CloudWatch Logs section and click on Configure\n7. Define a new or select an existing log group\n8. Click on Continue\n9. Configure IAM Role which will deliver CloudTrail events to CloudWatch Logs\n   o Create/Select an IAM Role and Policy Name\n   o Click Allow to continue\n\n### Compliance Information\n  - HIPAA: Audit Controls - §164.312(b)\n  - PCI DSS: Requirement 10: Track and monitor all access to network\nresources and cardholder data\n  - NIST 800-53: AU-12\n  - Center for Internet Security (CIS) - AWS: Logging 2.4\n  - SOC 2: A1.2, CC6.1\n  - GDPR: Article 30: Maintain Records of Processing Activities\n  - FedRAMP CCM 3.0.1: IVS-01\n  - CSA Cloud Controls Matrix (CCM): AIS-04, IAM-01, IVS-01",
                            "resource_types": [
                              "apiaccountingconfig"
                            ],
                            "severity": 2,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify encryption keys that are disabled",
                            "failure": [],
                            "id": 65,
                            "name": "Encryption Key Disabled",
                            "notes": "## Overview\n\nIt is possible to enable and disable service encryption keys. It is useful to know which keys are disabled so that you may enable them or possibly delete them if they are no longer in use.\n\n### Remediation\nLeverage Bot automation to identify, alert, and potentially enable or delete service encryption keys that are disabled.\n\n### Recommended Bot Workflow\n- Mark Resource Noncompliant: Flag disabled service encryption keys\n- Send Email/Slack Notification: Notify operations team of these service encryption keys. Separately, notify users of follow up actions.\n\n\n### Compliance Information\n  - NIST 800-53 (Rev 4) - Do not publish: CM-7(1), CM-8, CM-8(2)\n  - PCI DSS: Requirement 7: Restrict access to cardholder data by business\nneed to know",
                            "resource_types": [
                              "serviceencryptionkey"
                            ],
                            "severity": 2,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify API Accounting Configs that are not encrypted",
                            "failure": [],
                            "id": 68,
                            "name": "API Accounting Config Without Encryption",
                            "notes": "Overview\n----------\n\nAPI Accounting Config is a web service that records cloud API calls for an account and makes those logs available to users and resources in accordance with IAM policies. API Accounting Config logs can be configured to leverage encryption to further protect API Accounting Config logs. It is recommended that API Accounting Config be configured to use encryption.\n\n\n### Remediation\n\nLeverage Bot automation to identify and monitor for API Accounting Configs that are not encrypted and take automated action to enable encryption\n\n### Recommend Bot Workflow\n\n - Mark Resource Noncompliant: Mark API Accounting Configs without encryption enabled\n - Send Email/Slack Notification: Notify operations/security team of API Accounting Configs that do not have encryption enabled. Separately, using cloud badges, identify cloud account owners and notify them of the steps needed to enable API Accounting Config encryption\n - Encrypt API Accounting Config: After providing sufficient time for corrective action, update the encryption property of the API Accounting Configs\n\n### Amazon Web Services\n1. Sign in to the AWS Management Console and open the CloudTrail console at https://console.aws.amazon.com/cloudtrail\n2. In the left navigation pane, choose Trails.\n3. Click on a Trail\n4. Under the S3 section click on the edit button (pencil icon)\n5. Click Advanced\n6. Select an existing CMK from the KMS key Id drop-down menu\n   o Note: Ensure the CMK is located in the same region as the S3 bucket\n   o Note: You will need to apply a KMS Key policy on the selected CMK in order for CloudTrail as a service to encrypt and decrypt log files using the CMK provided. Steps are provided here for editing the selected CMK Key policy\n7. Click Save\n8. You will see a notification message stating that you need to have decrypt permissions on the specified KMS key to decrypt log files.\n9. Click Yes\n\n### Compliance Information\n  - HIPAA: Encryption Controls - §164.312(a)(2)(iv)\n  - NIST 800-53: SC-28\n  - PCI DSS: Requirement 3: Protect stored cardholder data\n  - NIST Cyber Security Framework (CSF): PR.DS-1\n  - Center for Internet Security (CIS) - AWS: Logging 2.7\n  - GDPR: Article 30: Maintain Records of Processing Activities\n  - ISO 27001: A.10.10.3 - Protection of log information\n  - SOC 2: A1.2, C1.7, CC6.1\n  - CSA Cloud Controls Matrix (CCM): AIS-04, DSI-03, EKM-03, IVS-01",
                            "resource_types": [
                              "apiaccountingconfig"
                            ],
                            "severity": 4,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify encryption keys that are not set to rotate",
                            "failure": [],
                            "id": 71,
                            "name": "Encryption Key Not Supporting Key Rotation",
                            "notes": "Overview\n----------\n\nCloud key management services allow customers to rotate the backing key, which is used to perform cryptographic operations such as encryption and decryption. Rotating encryption keys helps reduce the potential impact of a compromised key as data encrypted with a new key cannot be accessed with a previous key that may have been exposed. It is recommended that key rotation be enabled.\n\n\n### Remediation\n\nLeverage Bot automation to identify and monitor Service Encryption Keys not supporting key rotation and take automated action to enable key rotation\n\n### Recommend Bot Workflow\n\n - Mark Resource Noncompliant: Mark Service Encryption Keys not supporting key rotation\n - Send Email/Slack Notification: Notify operations/security team of Service Encryption Keys not supporting key rotation. Separately, using cloud badges or resource tags, identify Service Encryption Key owners and notify them of the steps needed to enable Service Encryption Key rotation\n - Rotate Encryption Key: Bot action to rotate encryption keys\n\n### Amazon Web Services\n1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam.\n2. In the left navigation pane, choose Encryption Keys.\n3. Select a customer created master key (CMK)\n4. Under the Key Policy section, move down to Key Rotation.\n5. Check the Rotate this key every year checkbox.\n\n### Compliance Information\n  - NIST 800-53 (Rev 4) - Do not publish: SC-12\n  - Center for Internet Security (CIS) - AWS: Logging 2.8\n  - PCI DSS: Requirement 8: Identify and authenticate access to system\ncomponents\n  - GDPR: Article 25: Data protection by Design and by Default\n  - ISO 27001: A.12.3.2 - Cryptographic controls\n  - SOC 2: CC5.2\n  - CSA Cloud Controls Matrix (CCM): AIS-04, BCR-11, DSI-01, DSI-03, DSI-06, DSI-07, EKM-01, EKM-02, EKM-03, EKM-04, IAM-02",
                            "resource_types": [
                              "serviceencryptionkey"
                            ],
                            "severity": 4,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify security groups with ports other than 80 or 443 open to the world (0.0.0.0/0)",
                            "failure": [],
                            "id": 72,
                            "name": "Access List Exposes Non-Web Ports to World (Security Group)",
                            "notes": "Overview\n----------\n\nSecurity groups control traffic to and from your instance, load balancers, databases and more. A security group that allows public access to ports outside of standard web ports is less secure, as it is allowing access to your instance from public IPs. If you want to keep your cloud resources more secure, it is recommended to update traffic rules.\n\n### Remediation\n\nLeverage bot automation to identify and alert about potentially insecure access lists so that users can take action such as update security group rules.\n\n### Compliance Information\n  - NIST 800-53 (Rev 4) - Do not publish: AC-6, AC-17, AC-17(1), RA-5, SC-7, SC-8, SA-17(7)\n  - PCI DSS: Requirement 1: Install and maintain a firewall configuration to\nprotect cardholder data\n  - NIST 800-53: AC-17\n  - GDPR: Article 25: Data protection by Design and by Default\n  - SOC 2: C1.1, C1.2\n  - FedRAMP CCM 3.0.1: IVS-07\n  - NIST Cyber Security Framework (CSF): ID.RA-1",
                            "resource_types": [
                              "resourceaccesslist"
                            ],
                            "severity": 4,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify volumes with Protected Health Information (PHI) tags that are not encrypted\f",
                            "failure": [],
                            "id": 77,
                            "name": "Volume Encryption Not Enabled With PHI Tags",
                            "notes": "## Overview\n\nEncrypting volume data in-transit and at rest can help you meet stricter security and encryption compliance requirements.\n\n### Remediation\n\nIn AWS, unencrypted volumes cannot be converted to encrypted by configuration. A volume can be converted by following these steps:\n1. Stop EC2 instance\n2. Create a snapshot of the volume. This will be unencrypted.\n3. Copy snapshot to change it to an Encrypted Snapshot.\n4. Create EBS volume from the new Encrypted Snapshot.\n5. Attach it to EC2 instance.\n\n### Compliance Information\n  - HIPAA: Encryption Controls - §164.312(a)(2)(iv)\n  - NIST 800-53: SC-28\n  - PCI DSS: Requirement 3: Protect stored cardholder data\n  - GDPR: Article 32: Security of processing\n  - SOC 2: C1.1, C1.2, C1.3, C1.7, CC5.6",
                            "resource_types": [
                              "volume"
                            ],
                            "severity": 5,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify Access Lists (Security Groups) exposing port 22 to the world (0.0.0.0/0)",
                            "failure": [],
                            "id": 80,
                            "name": "Access List Exposes SSH to World (Security Group)",
                            "notes": "Overview\n----------\n\nAccess Lists (Security Groups) provide stateful filtering of ingress/egress network traffic to cloud resources. It is recommended that no security group allows unrestricted ingress access to port 22. \n\n\n### Remediation\n\nLeverage Bot automation to identify and monitor for Access Lists (Security Groups) with public exposure of port 22. Take automated action to delete security groups\n\n### Recommend Bot Workflow\n\n - Mark Resource Noncompliant: Mark Access Lists (Security Groups) with a public access via SSH\n - Send Email/Slack Notification: Notify operations/security team of Access Lists (Security Groups) with a public access via SSH. Separately, using cloud badges or resource tags, identify Access Lists (Security Groups) owners and notify them of the steps needed to remove public exposure of port 22\n - Delete Resource: After providing sufficient time for corrective action, delete Access Lists (Security Groups)\n\n### Amazon Web Services\n1. Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home\n2. In the left pane, click Security Groups\n3. For each security group, perform the following:\n   o Select the security group\n   o Click the Inbound Rules tab\n   o Identify the rules to be removed\n   o Click the x in the Remove column\n   o Click Save\n\n\n### Compliance Information\n  - NIST Cyber Security Framework (CSF): ID.RA-1\n  - NIST 800-53 (Rev 4) - Do not publish: AC-6, AC-17, AC-17(1), RA-5, SC-7, SC-8, SA-17(7)\n  - Center for Internet Security (CIS) - GCP: Networking 3.6\n  - NIST 800-53: AC-17\n  - PCI DSS: Requirement 1: Install and maintain a firewall configuration to\nprotect cardholder data\n  - GDPR: Article 25: Data protection by Design and by Default\n  - ISO 27001: A.11.4.4 - Remote diagnostic and configuration port protection\n  - FedRAMP CCM 3.0.1: IVS-07\n  - SOC 2: C1.2, C1.3, C1.7, CC5.6\n  - CSA Cloud Controls Matrix (CCM): GRM-01\n  - Center for Internet Security (CIS) - AWS: Networking 4.1",
                            "resource_types": [
                              "resourceaccesslist"
                            ],
                            "severity": 5,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify cloud users with any API access key older than 90 days which should be rotated",
                            "failure": [],
                            "id": 82,
                            "name": "Cloud User With Stale API Credentials",
                            "notes": "Overview\n---\n\nCloud users can access cloud resources using different types of credentials, such as passwords or access keys.  It is recommended that all unused credentials be removed or deactivated to enforce secure best practices.\n\n### Remediation\n\nLeverage bot automation to identify, alert, and potentially disable users from Cloud Accounts whose credentials have become stale. \n\n### Recommended Bot Workflow\n\n- Mark Resources Noncompliant: Flag service users whose credentials have expired or become stale\n- ServiceNow: Create an incident within ServiceNow to be handled by your IT support\n- Send Email/Slack Notification: Notify operations/security team of these accounts.  Separately, notify account owners of the actions they must take to prevent account disablement.\n- Disable Service User: After providing sufficient time to take corrective action, disable service user accounts\n\n\n\n### Compliance Information\n  - NIST 800-53: AC-2\n  - HIPAA: Access Control - §164.312(a)(1)\n  - NIST Cyber Security Framework (CSF): PR.AC-1\n  - PCI DSS: Requirement 7: Restrict access to cardholder data by business\nneed to know\n  - ISO 27001: A.11.6.1 - Information access restriction\n  - FedRAMP CCM 3.0.1: IVS-11\n  - SOC 2: C1.2",
                            "resource_types": [
                              "serviceuser"
                            ],
                            "severity": 4,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify Access Lists (Security Groups) exposing port 3389 to the world (0.0.0.0/0)\n",
                            "failure": [],
                            "id": 85,
                            "name": "Access List Exposes Windows RDP to World (Security Group)",
                            "notes": "Overview\n----------\n\nAccess Lists (Security Groups) provide stateful filtering of ingress/egress network traffic to cloud resources. It is recommended that no security group allows unrestricted ingress access to port 3389. \n\n\n### Remediation\n\nLeverage Bot automation to identify and monitor for Access Lists (Security Groups) with public exposure of port 3389. Take automated action to delete security groups\n\n### Recommend Bot Workflow\n\n - Mark Resource Noncompliant: Mark Access Lists (Security Groups) with a public access via Windows RDP\n - Send Email/Slack Notification: Notify operations/security team of Access Lists (Security Groups) with a public access via Windows RDP. Separately, using cloud badges or resource tags, identify Access Lists (Security Groups) owners and notify them of the steps needed to remove public exposure of port 3389\n - Delete Resource: After providing sufficient time for corrective action, delete Access Lists (Security Groups)\n\n### Compliance Information\n  - NIST 800-53 (Rev 4) - Do not publish: AC-6, AC-17, AC-17(1), RA-5, SC-7, SC-8, SA-17(7)\n  - NIST 800-53: AC-17\n  - PCI DSS: Requirement 1: Install and maintain a firewall configuration to\nprotect cardholder data\n  - NIST Cyber Security Framework (CSF): ID.RA-1\n  - Center for Internet Security (CIS) - AWS: Networking 4.2\n  - GDPR: Article 25: Data protection by Design and by Default\n  - ISO 27001: A.11.4.4 - Remote diagnostic and configuration port protection\n  - SOC 2: C1.1, C1.2\n  - FedRAMP CCM 3.0.1: IVS-07\n  - CSA Cloud Controls Matrix (CCM): GRM-01\n  - Center for Internet Security (CIS) - GCP: Networking 3.7",
                            "resource_types": [
                              "resourceaccesslist"
                            ],
                            "severity": 5,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify snapshots with Protected Health Information (PHI) tags that are not encrypted\n",
                            "failure": [],
                            "id": 91,
                            "name": "Snapshot With PHI Unencrypted",
                            "notes": "## Overview\n\nSnapshots are a point-in-time archive of a data volume. Ensuring the data in encrypted at rest allows for additional protection if the snapshot inadvertently becomes accessible to unauthorized parities. On certain cloud platforms, AWS for example, unencrypted snapshots can be made public allowing unintentional access.\n\n### Remediation\n\nAWS allows creating encrypted copies of a snapshot. The unencrypted snapshot must then be deleted.\n\n### Recommended Bot Workflow\n\n- Mark Resource Noncompliant: Flag unencrypted snapshots.\n- Send Email/Slack Notification: Notify operations/owner of snapshot.\n\n### Compliance Information\n  - HIPAA: Encryption Controls - §164.312(a)(2)(iv)\n  - NIST 800-53: SC-28\n  - PCI DSS: Requirement 3: Protect stored cardholder data\n  - GDPR: Article 32: Security of processing\n  - SOC 2: C1.1, CC1.2, C1.7, CC5.6, CC5.7",
                            "resource_types": [
                              "snapshot"
                            ],
                            "severity": 5,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identify compute instances with a public IP address and that is exposing SSH",
                            "failure": [],
                            "id": 94,
                            "name": "Instance With a Public IP Exposing SSH",
                            "notes": "Overview\n----------\n\nSecurity groups provide stateful filtering of ingress/egress network traffic to cloud resources. It is recommended that no security group allows unrestricted ingress access to port 22. \n\n\n### Remediation\n\nLeverage Bot automation to identify and monitor for Instances for public exposure of port 22. Take automated action to modify Instance security groups, disassociate public IPs, or modify lifecycle state by stopping or (backing up and then) terminating Instances\n\n### Recommend Bot Workflow\n\n - Mark Resource Noncompliant: Mark instances with a public IP address and that is exposing SSH\n - Send Email/Slack Notification: Notify operations/security team of instances with a public IP address and that is exposing SSH. Separately, using cloud badges or resource tags, identify Instance owners and notify them of the steps needed to disable public exposure of port 22\n - Modify Security Groups: After providing sufficient time for corrective action, modify the Instances' security groups\n - Disassociate Public IP: After providing sufficient time for corrective action, disassociate the Instances' public IP\n - Stop Instance: After providing sufficient time for corrective action, stop Instances\n - Terminate Instance: After providing sufficient time for corrective action, Create Image of Instances and then terminate\n\n### Amazon Web Services\n1. Login to the AWS Management Console at https://console.aws.amazon.com/vpc/home\n2. In the left pane, click Security Groups\n3. For each security group, perform the following:\n   o Select the security group\n   o Click the Inbound Rules tab\n   o Identify the rules to be removed\n   o Click the x in the Remove column\n   o Click Save\n\n### Compliance Information\n  - NIST 800-53 (Rev 4) - Do not publish: AC-6, AC-17, AC-17(1), RA-5, SC-7, SC-8, SA-17(7)\n  - PCI DSS: Requirement 1: Install and maintain a firewall configuration to\nprotect cardholder data\n  - NIST Cyber Security Framework (CSF): ID.RA-1\n  - Center for Internet Security (CIS) - AWS: Networking 4.1\n  - NIST 800-53: CM-7\n  - GDPR: Article 25: Data protection by Design and by Default\n  - SOC 2: C1.2, C1.3, C1.7, CC5.6",
                            "resource_types": [
                              "instance"
                            ],
                            "severity": 5,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Match load balancers with an SSL and HTTP listener",
                            "failure": [],
                            "id": 98,
                            "name": "Load Balancer With SSL and HTTP Listener",
                            "notes": "## Overview\n\nLoad balancers can be configured to send traffic over an insecure connection (HTTP) or over a secure connection (SSL). When accepting connections from external sources, it is best practice to use a secure SSL connection to ensure that data being transmitted is encrypted in transit. This insight finds load balancers that have both insecure and secure connections enabled. \n\n### Remediation\n\nUse bot automation to flag the matched resources and notify the appropriate staff to take action. \n\n### Suggested Bot Workflow\n\n- Mark Resource Non-compliant: Flag the resource as non-compliant within the tool\n- Send Slack Message / Send Delayed Email: Notify the resource owner, operations team, or security team of the resource so they can take action. \n\n\n### Compliance Information\n  - NIST 800-53: SC-8\n  - HIPAA: Transport Controls - §164.312(e)(2)(i)\n\n  - PCI DSS: Requirement 4: Encrypt transmission of cardholder data across\nopen, public networks\n  - GDPR: Article 25: Data protection by Design and by Default\n  - SOC 2: C1.2, C1.7, CC5.7\n  - FedRAMP CCM 3.0.1: IVS-10",
                            "resource_types": [
                              "loadbalancer"
                            ],
                            "severity": 3,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identifies distributed tables (including DynamoDB) with data-at-rest encryption disabled",
                            "failure": [],
                            "id": 140,
                            "name": "Distributed Table Encryption Disabled",
                            "notes": "## Overview\n\nEncrypting volume data at rest can help you meet stricter security and encryption compliance requirements. Many cloud providers do not encrypt data at rest by default, and require customers to handle opt-in to this during resource creation. This identifies persistent volumes on Workspace Devices which do not have that option enabled.\n\n### Remediation\n\nMany cloud providers do not natively support the ability to toggle encryption on the fly, and therefore manual remediation is required. In most scenarios it can be easier to just rebuild an entirely new instance and ensure that the block device mapping enables the encryption option for each device. \n\n1. Create a new distributed table with encryption enabled\n2. Launch the replacement distributed table\n3. Retire/terminate the unencrypted distributed table\n\n### Compliance Information\n  - PCI DSS: Requirement 3: Protect stored cardholder data\n  - GDPR: Article 32: Data protection by Design and by Default\n  - HIPAA: Encryption Controls - §164.312(a)(2)(iv)\n  - FedRAMP CCM 3.0.1: IVS-10\n  - SOC 2: C1.7, CC5.6\n  - NIST 800-53: SC-28\n  - CSA Cloud Controls Matrix (CCM): DSI-03, EKM-03\n  - NIST Cyber Security Framework (CSF): PR.DS-1",
                            "resource_types": [
                              "distributedtable"
                            ],
                            "severity": 4,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          },
                          {
                            "description": "Identifies Distributed Table Clusters that are network accessible to anyone in the world",
                            "failure": [],
                            "id": 142,
                            "name": "Distributed Table Cluster Open to World",
                            "notes": "Overview\n----------\n\nDistributed Tables can have access policies attached to define who can access the objects stored within. These policies can be extremely stringent or can be permissive and allow access to anyone in the World. It is strongly discouraged to open access to the public as doing so can result in exposure of PII and other sensitive data. \n\n### Remediation\n\nLeverage bot automation to notify you of distributed table clustesr with overly permissive access policies, then manually clean up exposed table clusters.\n\n### Recommended Bot Workflow\n\n- Mark Resource Noncompliant\n- Send Email/Slack Notification\n\n### Compliance Information\n  - NIST 800-53 (Rev 4) - Do not publish: AC-6, AC-17, AC-17(1), RA-5, SC-7, SC-8, SA-17(7)\n  - ISO 27001: A.11.4.4 - Remote diagnostic and configuration port protection\n  - GDPR: Article 25: Data protection by Design and by Default\n  - PCI DSS: Requirement 1: Install and maintain a firewall configuration to\nprotect cardholder data\n  - SOC 2: CC5.7\n  - FedRAMP CCM 3.0.1: IVS-01, IVS-11\n  - NIST 800-53: AC-17\n  - NIST Cyber Security Framework (CSF): ID.RA-1, PR.DS-5\n  - HIPAA: Access Control - §164.312(a)(1)",
                            "resource_types": [
                              "distributedtablecluster"
                            ],
                            "severity": 5,
                            "source": "backoffice",
                            "success": [],
                            "warn_only": false,
                            "warning": []
                          }
                        ],
                        "skipped_resources": 0,
                        "total_insights": 31,
                        "total_resources": 1,
                        "warned_insights": [],
                        "warned_resources": 0
                      },
                      "errors": [],
                      "message": "Your InsightCloudSec IaC Scan failed with 1 failed resources, 0 resource with warnings, 0 unanalyzed resources, and 0 error(s).",
                      "resource_mapping": {
                        "storagecontainer:6": {
                          "address": "aws_s3_bucket.bucket",
                          "id": 6,
                          "name": "my-tf-test-bucket",
                          "provider_id": null,
                          "region": "eu-north-1",
                          "type": "storagecontainer"
                        }
                      },
                      "scan_results": "http://localhost:8001/iac/home/builds/12",
                      "stacktrace": null,
                      "status": "failure",
                      "success": false
                    }
              schema:
                oneOf:
                  - title: Example with `?readable=true`
                    type: object
                    properties:
                      build_id:
                        type: integer
                        example: 9
                        default: 0
                      config_name:
                        type: string
                        example: tests config1
                      message:
                        type: string
                        example: Your InsightCloudSec IaC Scan failed with 1 failed resources, 0 resource with warnings, 0 unanalyzed resources, and 0 error(s).
                      scan_results:
                        type: string
                        example: http://localhost:8001/iac/home/builds/9
                      success:
                        type: boolean
                        example: false
                        default: true
                      status:
                        type: string
                        example: failure
                      errors:
                        type: array
                      resources:
                        type: array
                        items:
                          type: object
                          properties:
                            resource_source:
                              type: string
                              example: terraform
                            resource_address:
                              type: string
                              example: aws_s3_bucket.bucket
                            resource_name:
                              type: string
                              example: my-tf-test-bucket
                            resource_type:
                              type: string
                              example: storagecontainer
                            resource_region:
                              type: string
                              example: eu-north-1
                            passed_rules:
                              type: array
                              items:
                                type: object
                                properties:
                                  rule_name:
                                    type: string
                                    example: Storage Container Not Enforcing Encryption At Rest
                                  rule_description:
                                    type: string
                                    example: Identify storage containers, e.g., AWS S3 buckets, without object encryption enabled
                                  rule_detail:
                                    type: string
                                    example: '## Overview -- Ensuring that storage containers are encrypted at rest wherever possible is an effective means at assuring the protection of the data stored on those containers. It may not be appropriate to always enforce encryption for things that are intended to be shared to a large audience but it is generally a boon. ### Remediation -- Leverage bot automation to notify you of storage containers that are not encrypted at rest, clean up exposed storage containers, and in certain cases, encrypt the storage container. ### Recommended Bot Workflow -- - Mark Resource Noncompliant: Flag storage containers not enforcing encryption at rest. - Send Email/Slack Notification: Notify operations/security team of these storage containers. - Cleanup Exposed Storage Container: Remove permissions from exposed storage containers, making them less accessible for exploitation - Encrypt Storage Container: Will protect vulnerable servers by mandating encryption. **Warning: Will overwrite any pre-existing bucket policies.** ### Compliance Information -- - HIPAA: Encryption Controls - §164.312(a)(2)(iv) - NIST 800-53: SC-28 - PCI DSS: Requirement 3: Protect stored cardholder data - NIST Cyber Security Framework (CSF): PR.DS-1 - GDPR: Article 32: Data protection by Design and by Default - SOC 2: C1.1, CC1.2, C1.7, CC5.6'
                            warning_rules:
                              type: array
                            failed_rules:
                              type: array
                              items:
                                type: object
                                properties:
                                  rule_name:
                                    type: string
                                    example: Storage Container Without Access Logging
                                  rule_description:
                                    type: string
                                    example: Identify storage containers, such as AWS S3, without access logging enabled
                                  rule_detail:
                                    type: string
                                    example: 'Overview ---------- Storage Container Access Logging maintains a log of each access request to your storage containers, assisting in determining, preventing and diagnosing invalid access and data leakage concerns. It is recommended that storage container access logging be enabled wherever sensitive data is held. ### Remediation -- Leverage Bot automation to identify and monitor storage containers storing API Accounting Config logs to ensure they have access logging enabled ### Recommend Bot Workflow -- - Mark Resource Noncompliant: Mark API Accounting Configs that have logs in storage containers without access logging enabled - Send Email/Slack Notification: Notify operations/security team of API Accounting Configs that have logs in storage containers without access logging enabled. Separately, using cloud badges, identify cloud account owners and notify them of the steps to enable access logging on storage containers storing API Accounting Config logs - Enabled Access Logging: After providing sufficient time for corrective action, update the access logging property of the relevant storage containers ### Compliance Information -- - NIST 800-53: AU-12 - HIPAA: Audit Controls - §164.312(b) - PCI DSS: Requirement 10: Track and monitor all access to network resources and cardholder data - GDPR: Article 30: Maintain Records of Processing Activities - ISO 27001: A.10.10.1 - Audit Logging - SOC 2: A1.2, CC6.1 - FedRAMP CCM 3.0.1: IVS-01 - Center for Internet Security (CIS) - GCP: Storage 5.3'
                      stacktrace: {}
                  - title: Example without `?readable=true`
                    type: object
                    properties:
                      build_id:
                        type: integer
                        example: 12
                        default: 0
                      config_name:
                        type: string
                        example: tests config1
                      details:
                        type: object
                        properties:
                          failed_insights:
                            type: array
                            items:
                              type: object
                              properties:
                                description:
                                  type: string
                                  example: Identify storage containers, such as AWS S3, without access logging enabled
                                failure:
                                  type: array
                                  items:
                                    type: string
                                    example: storagecontainer:6
                                id:
                                  type: integer
                                  example: 90
                                  default: 0
                                name:
                                  type: string
                                  example: Storage Container Without Access Logging
                                notes:
                                  type: string
                                  example: |-
                                    Overview
                                    ----------

                                    Storage Container Access Logging maintains a log of each access request to your storage containers, assisting in determining, preventing and diagnosing invalid access and data leakage concerns.  It is recommended that storage container access logging be enabled wherever sensitive data is held.

                                    ### Remediation

                                    Leverage Bot automation to identify and monitor storage containers storing API Accounting Config logs to ensure they have access logging enabled

                                    ### Recommend Bot Workflow

                                     - Mark Resource Noncompliant: Mark API Accounting Configs that have logs in storage containers without access logging enabled
                                     - Send Email/Slack Notification: Notify operations/security team of  API Accounting Configs that have logs in storage containers without access logging enabled. Separately, using cloud badges, identify cloud account owners and notify them of the steps to enable access logging on storage containers storing API Accounting Config logs
                                     - Enabled Access Logging: After providing sufficient time for corrective action, update the access logging property of the relevant storage containers

                                    ### Compliance Information
                                      - NIST 800-53: AU-12
                                      - HIPAA: Audit Controls - §164.312(b)
                                      - PCI DSS: Requirement 10: Track and monitor all access to network
                                    resources and cardholder data
                                      - GDPR: Article 30: Maintain Records of Processing Activities
                                      - ISO 27001: A.10.10.1 - Audit Logging
                                      - SOC 2: A1.2, CC6.1
                                      - FedRAMP CCM 3.0.1: IVS-01
                                      - Center for Internet Security (CIS) - GCP: Storage 5.3
                                resource_types:
                                  type: array
                                  items:
                                    type: string
                                    example: storagecontainer
                                severity:
                                  type: integer
                                  example: 3
                                  default: 0
                                source:
                                  type: string
                                  example: backoffice
                                success:
                                  type: array
                                warn_only:
                                  type: boolean
                                  example: false
                                  default: true
                                warning:
                                  type: array
                          failed_resources:
                            type: integer
                            example: 1
                            default: 0
                          passed_insights:
                            type: array
                            items:
                              type: object
                              properties:
                                description:
                                  type: string
                                  example: Identify storage containers, e.g., AWS S3 buckets, without object encryption enabled
                                failure:
                                  type: array
                                id:
                                  type: integer
                                  example: 60
                                  default: 0
                                name:
                                  type: string
                                  example: Storage Container Not Enforcing Encryption At Rest
                                notes:
                                  type: string
                                  example: |-
                                    ## Overview

                                    Ensuring that storage containers are encrypted at rest wherever possible is an effective means at assuring the protection of the data stored on those containers.  It may not be appropriate to always enforce encryption for things that are intended to be shared to a large audience but it is generally a boon. 

                                    ### Remediation

                                    Leverage bot automation to notify you of storage containers that are not encrypted at rest, clean up exposed storage containers, and in certain cases, encrypt the storage container. 

                                    ### Recommended Bot Workflow

                                     - Mark Resource Noncompliant: Flag storage containers not enforcing encryption at rest.
                                     - Send Email/Slack Notification: Notify operations/security team of these storage containers.  
                                     - Cleanup Exposed Storage Container: Remove permissions from exposed storage containers, making them less accessible for exploitation
                                     - Encrypt Storage Container: Will protect vulnerable servers by mandating encryption.  **Warning: Will overwrite any pre-existing bucket policies.**


                                    ### Compliance Information
                                      - HIPAA: Encryption Controls - §164.312(a)(2)(iv)
                                      - NIST 800-53: SC-28
                                      - PCI DSS: Requirement 3: Protect stored cardholder data
                                      - NIST Cyber Security Framework (CSF): PR.DS-1
                                      - GDPR: Article 32: Data protection by Design and by Default
                                      - SOC 2: C1.1, CC1.2, C1.7, CC5.6
                                resource_types:
                                  type: array
                                  items:
                                    type: string
                                    example: storagecontainer
                                severity:
                                  type: integer
                                  example: 4
                                  default: 0
                                source:
                                  type: string
                                  example: backoffice
                                success:
                                  type: array
                                  items:
                                    type: string
                                    example: storagecontainer:6
                                warn_only:
                                  type: boolean
                                  example: false
                                  default: true
                                warning:
                                  type: array
                          passed_resources:
                            type: integer
                            example: 0
                            default: 0
                          skipped_insights:
                            type: array
                            items:
                              type: object
                              properties:
                                description:
                                  type: string
                                  example: Identify accounts without API Accounting Config, such as AWS CloudTrail, enabled across all regions
                                failure:
                                  type: array
                                id:
                                  type: integer
                                  example: 2
                                  default: 0
                                name:
                                  type: string
                                  example: Cloud Account Without Global API Accounting Config
                                notes:
                                  type: string
                                  example: |-
                                    Overview
                                    ----------

                                    Global API Accounting Config records API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the specific cloud service. Global API Accounting provides a history of API calls for each account, including API calls made via the management console, SDKs, command line tools, and other cloud services.


                                    ### Remediation

                                    Leverage Bot automation to identify and monitor cloud accounts that do not have global API Accounting Config in effect

                                    ### Recommended Bot Workflow

                                     - Mark Resource Noncompliant: Flag cloud accounts that do not have global API Accounting Config in effect
                                     - Send Email/Slack Notification: Notify operations/security team of cloud accounts that do not have global API Accounting Config in effect. Separately, using cloud badges, identify cloud account owners and notify them of the steps to enable global API Accounting Config

                                    ### Amazon Web Services
                                    1. Login to AWS Console (with appropriate permissions to View Identity Access Management Account Settings)
                                    2. Click on Trails on the left navigation pane
                                    3. Click Get Started Now, if presented:
                                       - Click Add new trail
                                       - Enter a trail name in the Trail name box
                                       - Set the Apply trail to all regions option to Yes
                                       - Specify an S3 bucket name in the S3 bucket box
                                       - Click Create
                                    4. If 1 or more trails already exist, select the target trail to enable for global logging:
                                       - Click the edit icon (pencil) next to Apply trail to all regions
                                       - Click Yes
                                       - Click Save

                                    ### Compliance Information
                                      - NIST Cyber Security Framework (CSF): DE.AE-1, DE.CM-3, ID.AM-1
                                      - HIPAA: Audit Controls - §164.312(b)
                                      - NIST 800-53: AU-12
                                      - PCI DSS: Requirement 10: Track and monitor all access to network
                                    resources and cardholder data
                                      - Center for Internet Security (CIS) - AWS: Logging 2.1
                                      - GDPR: Article 30: Maintain Records of Processing Activities
                                      - ISO 27001: A.10.10.1 - Audit Logging
                                      - SOC 2: A1.2, CC5.3, CC6.1
                                      - CSA Cloud Controls Matrix (CCM): AIS-04, BCR-07, BCR-10, BCR-11, IAM-01, IAM-12, IVS-01, IVS-03
                                      - AWS Financial Services Framework (FSF): CloudTrail-V116395888
                                resource_types:
                                  type: array
                                  items:
                                    type: string
                                    example: divvyorganizationservice
                                severity:
                                  type: integer
                                  example: 5
                                  default: 0
                                source:
                                  type: string
                                  example: backoffice
                                success:
                                  type: array
                                warn_only:
                                  type: boolean
                                  example: false
                                  default: true
                                warning:
                                  type: array
                          skipped_resources:
                            type: integer
                            example: 0
                            default: 0
                          total_insights:
                            type: integer
                            example: 31
                            default: 0
                          total_resources:
                            type: integer
                            example: 1
                            default: 0
                          warned_insights:
                            type: array
                          warned_resources:
                            type: integer
                            example: 0
                            default: 0
                      errors:
                        type: array
                      message:
                        type: string
                        example: Your InsightCloudSec IaC Scan failed with 1 failed resources, 0 resource with warnings, 0 unanalyzed resources, and 0 error(s).
                      resource_mapping:
                        type: object
                        properties:
                          storagecontainer:6:
                            type: object
                            properties:
                              address:
                                type: string
                                example: aws_s3_bucket.bucket
                              id:
                                type: integer
                                example: 6
                                default: 0
                              name:
                                type: string
                                example: my-tf-test-bucket
                              provider_id: {}
                              region:
                                type: string
                                example: eu-north-1
                              type:
                                type: string
                                example: storagecontainer
                      scan_results:
                        type: string
                        example: http://localhost:8001/iac/home/builds/12
                      stacktrace: {}
                      status:
                        type: string
                        example: failure
                      success:
                        type: boolean
                        example: false
                        default: true
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
  /public/resource/enrichment:
    get:
      summary: List Enriched Resource Details (Individual)
      description: Lists enriched details about a given resource, including dependencies, properties, Insight findings, threat findings, application context information, permissions, vulnerabilities, and related resources.
      operationId: list-enriched-resource-details
      parameters:
        - name: provider_id
          in: query
          description: A unique, CSP-specific identifier for the resource. A `provider_id` or `namespace_id` must be provided; `provider_id` will override `namespace_id` if both are provided.
          schema:
            type: string
        - name: namespace_id
          in: query
          description: A unique, CSP-specific namespace identifier. A `provider_id` or `namespace_id` must be provided; `provider_id` will override `namespace_id` if both are provided.
          schema:
            type: string
        - name: filters
          in: query
          description: 'A comma-delimited list of names for the enriched details about a given resource. For example: `resource_details,vulnerabilities`.'
          schema:
            type: string
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: |-
                    {
                      "resource_details": {
                        "dependencies": {
                          "networkinterface": [
                            {
                              "id": "ja-gcp-hva.nic0",
                              "name": "nic0",
                              "resource_id": "networkinterface:6:europe-west1:ja-gcp-hva.nic0:",
                              "type": "networkinterface"
                            }
                          ],
                          "privatenetwork": [
                            {
                              "id": "15354827186006192505",
                              "name": "default",
                              "resource_id": "privatenetwork:6::15354827186006192505:",
                              "type": "privatenetwork"
                            }
                          ],
                          "resourceaccesslist": [
                            {
                              "id": "3537706110417665757",
                              "name": "test-blocked-rdp",
                              "resource_id": "resourceaccesslist:6::3537706110417665757:",
                              "type": "resourceaccesslist"
                            },
                            {
                              "id": "5121977450226834962",
                              "name": "test-deny",
                              "resource_id": "resourceaccesslist:6::5121977450226834962:",
                              "type": "resourceaccesslist"
                            },
                            {
                              "id": "8519192485236936413",
                              "name": "r7-vpn-allow-ssh",
                              "resource_id": "resourceaccesslist:6::8519192485236936413:",
                              "type": "resourceaccesslist"
                            }
                          ],
                          "servicerole": [
                            {
                              "id": "110744443020505229478",
                              "name": "317115057204@project.gserviceaccount.com",
                              "resource_id": "servicerole:6:110744443020505229478:",
                              "type": "servicerole"
                            }
                          ],
                          "volume": [
                            {
                              "id": "ja-gcp-hva",
                              "name": "ja-gcp-hva",
                              "resource_id": "volume:6:europe-west1:ja-gcp-hva:",
                              "type": "volume"
                            }
                          ]
                        },
                        "details": {
                          "instance": {
                            "common": {
                              "account": "GCP",
                              "account_id": "divvy-development",
                              "account_status": "REFRESH",
                              "auto_id": 105,
                              "availability_zone": "europe-west1-b",
                              "cloud": "GCE",
                              "creation_timestamp": "2023-03-29 10:09:12",
                              "direct_link": "https://console.cloud.google.com/compute/instancesDetail/zones/europe-west1-b/instances/ja-gcp-hva?project=divvy-development",
                              "discovered_timestamp": "2023-04-03 09:26:38",
                              "last_harvested_timestamp": "2023-06-11T07:19:12",
                              "modified_timestamp": "2023-04-04 16:35:52",
                              "noncompliance": [
                                
                              ],
                              "organization_service_id": 6,
                              "properties": {
                                "property_list": [
                                  {
                                    "name": "divvy.default_service_account",
                                    "parent_resource_id": "instance:6:europe-west1:ja-gcp-hva:",
                                    "type_hint": "bool",
                                    "value": "1"
                                  },
                                  {
                                    "name": "divvy.full_access_scope",
                                    "parent_resource_id": "instance:6:europe-west1:ja-gcp-hva:",
                                    "type_hint": "bool",
                                    "value": "0"
                                  }
                                ]
                              },
                              "provider_id": "ja-gcp-hva",
                              "region": "europe-west1",
                              "resource_id": "instance:6:europe-west1:ja-gcp-hva:",
                              "resource_name": "ja-gcp-hva",
                              "resource_type": "instance",
                              "tags": {
                                "ja": "hva"
                              }
                            },
                            "create_time": "2023-03-29 10:09:12",
                            "image_id": "7157337275614620995",
                            "instance_id": "ja-gcp-hva",
                            "instance_type": "e2-micro",
                            "launch_time": "2023-03-29 10:09:21",
                            "network_interfaces": [
                              {
                                "common": {
                                  "account": "GCP",
                                  "account_id": "divvy-development",
                                  "account_status": "REFRESH",
                                  "auto_id": 138,
                                  "cloud": "GCE",
                                  "creation_timestamp": "None",
                                  "discovered_timestamp": "2023-04-03 09:26:38",
                                  "modified_timestamp": "2023-04-03 09:26:38",
                                  "organization_service_id": 6,
                                  "provider_id": "ja-gcp-hva.nic0",
                                  "region": "europe-west1",
                                  "resource_id": "networkinterface:6:europe-west1:ja-gcp-hva.nic0:",
                                  "resource_name": "nic0",
                                  "resource_type": "networkinterface",
                                  "tags": {
                                    "ja": "hva"
                                  }
                                },
                                "device_index": 0,
                                "instance_id": "ja-gcp-hva",
                                "instance_resource_id": "instance:6:europe-west1:ja-gcp-hva:",
                                "ip_addresses": [
                                  {
                                    "ip_address": "35.233.43.175",
                                    "ip_address_type": "Ipv4PublicAddress"
                                  },
                                  {
                                    "ip_address": "10.240.0.3",
                                    "ip_address_type": "Ipv4PrivateAddress"
                                  }
                                ],
                                "network_interface_id": "ja-gcp-hva.nic0",
                                "network_resource_id": "privatenetwork:6::15354827186006192505:",
                                "private_ip_address": "10.240.0.3"
                              }
                            ],
                            "network_resource_id": "privatenetwork:6::15354827186006192505:",
                            "object_id": "7800351496809853097",
                            "platform": "linux",
                            "private_ip_address": "10.240.0.3",
                            "public_ip_address": "35.233.43.175",
                            "role_resource_id": "servicerole:6:110744443020505229478:",
                            "state": "running",
                            "termination_protection": false,
                            "security_account_email": "security@rapid7.com",
                            "vulnerability_sources": [
                              
                            ]
                          },
                          "resource_type": "instance"
                        }
                      },
                      "vulnerabilities": {
                        "CRITICAL": {
                          "count": 2,
                          "vulnerabilities": [
                            {
                              "cvss_score": 9.8,
                              "description": "CVE-2023-5178 - linux",
                              "name": "CVE-2023-5178",
                              "package": "",
                              "severity": "CRITICAL",
                              "source": "inspectorv2",
                              "uri": "https://security-tracker.debian.org/tracker/CVE-2023-5178"
                            },
                            {
                              "cvss_score": 7.8,
                              "description": "CVE-2022-3520 - vim, xxd and 1 more",
                              "name": "CVE-2022-3520",
                              "package": "",
                              "severity": "CRITICAL",
                              "source": "inspectorv2",
                              "uri": "https://people.canonical.com/~ubuntu-security/cve/2022/CVE-2022-3520.html"
                            }
                          ]
                        }
                      },
                      "resource_insights": {
                        "Critical": {
                          "count": 1,
                          "insights": [
                            {
                              "author": "InsightCloudSec",
                              "description": "Identify Compute Instances With a Public IP Address That is Exposing Windows RDP",
                              "identified_on": "2023-06-01 16:48:57",
                              "insight_id": 281,
                              "name": "Instance with a Public IP Exposing RDP",
                              "notes": "## Overview\nSecurity groups provide stateful filtering of ingress/egress network traffic to cloud resources. It is recommended that no security group allows unrestricted ingress access to port 3389.\n\nThis Insight identities compute instances with a public IP address and that is exposing Windows RDP.\n\n### Supported Clouds\n**This Insight supports the following clouds:**\n* Amazon Web Services, Amazon Web Services China, Amazon Web Services Government\n* Microsoft Azure\n* Google Cloud Platform\n\n**Supported Infrastructure as Code Clouds:**\n* Amazon Web Services\n* Microsoft Azure\n* Google Cloud Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n\n## Recommended Remediation\nLeverage Bot automation to identify and monitor for compute instances that are exposing RDP via port 3389 and have a public IP address attached.\n### Bot Recommendations\n* Mark Resource Noncompliant: Flag compute instances that have been identified as having RDP exposed and a public IP address attached.\n* Send Email/Instant Notification: Notify operations/security team of the compute instances that are exposing RDP and have a public IP address attached. Separately, using cloud badges, identify cloud account owners and notify them of the non-compliant compute instances and the steps required to disable RDP and/or remove the public IP address.\n\n\n### Remediation Reference Links\nFor more information on Identifying compute instances with a public IP address and that is exposing Windows RDP, follow these links:\n\n**Amazon Web Services**\n\n- https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/authorizing-access-to-an-instance.html\n\n**Microsoft Azure**\n\n - https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview\n\n**Google Cloud Platform**\n\n- https://cloud.google.com/vpc/docs/firewalls\n\n### Compliance Information\n  - NIST 800-53 (Rev 4): AC-17, AC-17(1), AC-6, RA-5, SA-17(7), SC-7, SC-8\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - HIPAA: Access Control - § 164.312(a)(1), No ePHI Should Be Publicly Accessible\n  - SOC 2: CC5.2, CC6.1, CC6.3, CC6.6\n  - PCI DSS Pack: 6.6, 7.1, 7.2, Requirement 1.3\n  - NIST Cybersecurity Framework: DE.CM-7, PR.AC-3, PR.AC-4, PR.AC-5, PR.DS-5\n  - HITRUST v9.4: 0724.07a3Organizational.4, 0814.01n1Organizational.12, 0818.01w3System.12, 0855.01wCMSOrganizational.2, 0856.01wFTIOrganizational.4, 0857.01wHIXOrganizational.1, 11123.01qPCIOrganizational.3, 1114.01h1Organizational.123, 1117.01j1Organizational.23, 1118.01j2Organizational.124, 11192.01cHIXSystem.2, 1164.01cHIESystem.1, 1165.01cPCISystem.1, 1179.01j3Organizational.1, 1403.05i1Organizational.67, 1424.05j2Organizational.5, 1427.05jFTIOrganizational.3, 1802.08b1Organizational.3, 19141.06c1Organizational.7, 19153.06dFTIOrganizational.12, 19910.06cSROrganizational.2\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b, 500.14.a\n  - NIST 800-53 (Rev 5): AC-4, AC-4 (21), AC-6, AC-17, AC-17 (1), AC-21, CM-7, CM-7 (1), SC-7, SC-7 (3), SC-7 (4), SC-7 (5), SC-7 (9), SC-7 (10), SC-7 (11), SC-7 (16), SC-7 (20), SC-7 (21)\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.13.1, 3.13.2\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - Microsoft Cloud Security Benchmark: NS-1, NS-2, NS-3\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                              "severity": "Critical",
                              "source": "core"
                            }
                          ]
                        },
                        "High": {
                          "count": 3,
                          "insights": [
                            {
                              "author": "InsightCloudSec",
                              "description": "Identify instances that have RDP access open to the public",
                              "identified_on": "2023-06-01 16:48:57",
                              "insight_id": 166,
                              "name": "Instance Exposing RDP to the Public",
                              "notes": "## Overview\nThe potential security problem with using RDP over the Internet is that attackers can use various brute force techniques to gain access to Azure Virtual Machines. Once the attackers gain access, they can use your virtual machine as a launch point for compromising other machines on your Azure Virtual Network or even attack networked devices outside of Azure.\n\nThis Insight identifies instances that have RDP access open to the public.\n### Supported Clouds\n\n**This Insight supports the following clouds:**\n\n* Alibaba Cloud\n* Amazon Web Services, Amazon Web Services China, Amazon Web Services Gov\n* Microsoft Azure, Microsoft Azure China, Microsoft Azure Gov\n* Google Cloud Platform\n\n\n**This Insight supports the following Infrastructure as Code clouds:**\n\n* Amazon Web Services\n* Microsoft Azure\n* Google Cloud Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n## Recommended Remediation\nDisable RDP access on Network Security Groups from the Internet.\n\n### Bot Recommendations\n*  Mark Resource Noncompliant: Flag Instances with RDP access open to the public.\n* Send Email/Instant Notification: Notify operations/security team of the Instances with RDP open for public access. Separately, using cloud badges, identify cloud account owners and notify them of the steps needed to remove public RDP access by following the CIS manual remediation steps as outlined below.\n\n### CIS Recommended Remediation Steps\n\n**Microsoft Azure**\n\nDisable direct RDP access to your Azure Virtual Machines from the Internet. After direct RDP access from the Internet is disabled, you have other options you can use to access these virtual machines for remote management:\n - [Point-to-site VPN](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal)\n - [Site-to-site VPN](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal)\n - [ExpressRoute](https://docs.microsoft.com/en-us/azure/expressroute/)\n\n### Remediation Reference Links\nFor more information on specific steps to identify and remediate instances that have RDP access open to the public, follow these links:\n\n* Alibaba Cloud - https://www.alibabacloud.com/help/en/doc-detail/96468.html\n\n* Amazon Web Services - https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/authorizing-access-to-an-instance.html\n\n* Microsoft Azure - https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview\n\n* Google Cloud Platform - https://cloud.google.com/compute/docs/instances/access-overview\n\n### Compliance Information\n  - NIST Cybersecurity Framework (Legacy): PR.DS-5\n  - CIS - Azure 1.0.0 (Legacy): Networking 6.1\n  - CIS - Azure 1.1.0: Networking - 6.1 - Ensure that RDP access is restricted from the internet\n  - NIST 800-53 (Rev 4): AC-17, AC-17(1), AC-6, RA-5, SA-17(7), SC-7, SC-8\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - HIPAA: Access Control - § 164.312(a)(1), No ePHI Should Be Publicly Accessible\n  - SOC 2: CC5.2, CC6.1, CC6.3, CC6.6\n  - PCI DSS Pack: 6.6, 7.1, 7.2, Requirement 1.3\n  - NIST Cybersecurity Framework: DE.CM-7, PR.AC-3, PR.AC-4, PR.AC-5, PR.DS-5\n  - HITRUST v9.4: 0724.07a3Organizational.4, 0814.01n1Organizational.12, 0818.01w3System.12, 0855.01wCMSOrganizational.2, 0856.01wFTIOrganizational.4, 0857.01wHIXOrganizational.1, 11123.01qPCIOrganizational.3, 1114.01h1Organizational.123, 1117.01j1Organizational.23, 1118.01j2Organizational.124, 11192.01cHIXSystem.2, 1164.01cHIESystem.1, 1165.01cPCISystem.1, 1179.01j3Organizational.1, 1403.05i1Organizational.67, 1424.05j2Organizational.5, 1427.05jFTIOrganizational.3, 1802.08b1Organizational.3, 19141.06c1Organizational.7, 19153.06dFTIOrganizational.12, 19910.06cSROrganizational.2\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b, 500.14.a\n  - NIST 800-53 (Rev 5): AC-4, AC-4 (21), AC-6, AC-17, AC-17 (1), AC-21, CM-7, CM-7 (1), SC-7, SC-7 (3), SC-7 (4), SC-7 (5), SC-7 (9), SC-7 (10), SC-7 (11), SC-7 (16), SC-7 (20), SC-7 (21)\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.13.1, 3.13.2\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - Microsoft Cloud Security Benchmark: NS-2\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                              "severity": "High",
                              "source": "core"
                            },
                            {
                              "author": "InsightCloudSec",
                              "description": "Identify select resource types on Google Cloud Platform which run on legacy network services which do not contain advanced networking features found in more advanced VPC configurations.",
                              "identified_on": "2023-06-01 16:48:57",
                              "insight_id": 389,
                              "name": "Cloud Resource Associated with Legacy Network (GCP)",
                              "notes": "## Overview\nLegacy networks are not recommended. Many newer Google Cloud features are not supported in legacy networks. Instead, use Virtual Private Cloud (VPC) networks. For more information, see the VPC network overview.\n\nLegacy networks have a single RFC 1918 range, which you specify when you create the network. The network is global in scope and spans all cloud regions.\n\nIn a legacy network, instance IP addresses are not grouped by region or zone. One IP address can appear in one region, and the following IP address can be in a different region. Any given range of IPs can be spread across all regions, and the IP addresses of instances created within a region are not necessarily contiguous.\n\n*The IPv4Range field for creating legacy networks is deprecated and will shut down on June 1, 2021. After that date, you won't be able to create legacy networks. However, existing legacy networks won't be affected and will continue to operate normally.*\n\nThis Insight identifies select resource types on Google Cloud Platform which run on legacy network services which do not contain advanced networking features found in more advanced VPC configurations.\n\n### Supported Clouds\n\n**This Insight supports the following clouds:**\n\n* Google Cloud Platform\n\n**This Insight supports the following Infrastructure as Code clouds:**\n\n* Google Cloud Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n\n## Recommended Remediation\nEliminate Google Cloud Platform legacy network services which do not contain advanced networking features found in more advanced VPC configurations.\n\n### Bot Recommendations\n* Mark Resource Noncompliant: Flag Cloud Resources that are associated with a Legacy Network.\n* Send Email/Instant Notification: Notify operations/security team of the Cloud Resources that are associated with a Legacy Network.  Separately, using cloud badges, identify cloud account owners and notify them of the non-compliant cloud resources and the steps required to modify the Cloud Resources that are associated with a Legacy Network.\n\n### Remediation Reference Links\nFor more information on specific steps to identify and remediate select resource types on Google Cloud Platform which run on legacy network services which do not contain advanced networking features found in more advanced VPC configurations, please follow this link:\n\n* Google Cloud Platform - https://cloud.google.com/vpc/docs/using-legacy\n\n### Compliance Information\n  - ISO 27001:2013: A.13.1.1 - Network controls\n  - PCI DSS Pack: Requirement 6\n  - NIST Cybersecurity Framework: PR.IP-2\n  - HITRUST v9.4: 0805.01m1Organizational.12, 0809.01n2Organizational.1234\n  - ACSC Essential 8: ISM Patch Operating Systems\n  - ISO 27001:2022: 8.20: Network security",
                              "severity": "High",
                              "source": "core"
                            },
                            {
                              "author": "InsightCloudSec",
                              "description": "Instance with public IP address and any port exposure to 0.0.0.0/0",
                              "identified_on": "2023-06-01 16:48:57",
                              "insight_id": 408,
                              "name": "Instance with Public IP Address and any Port Exposure to 0.0.0.0/0",
                              "notes": "## Overview\nInstances should rarely be exposed to the whole internet on any port. A wide amount of exposure increases the risk of the instance being compromised or used in a non-desirable way.\n\nThis Insight identifies an Instance with public IP address and any port exposure to 0.0.0.0/0.\n### Supported Clouds\n\n**This Insight supports the following clouds:**\n\n* Amazon Web Services, Amazon Web Services China, Amazon Web Services Gov\n* Microsoft Azure, Microsoft Azure China, Microsoft Azure Gov\n* Google Cloud Platform\n\n**This Insight supports the following Infrastructure as Code clouds:**\n\n* Amazon Web Services\n* Microsoft Azure\n* Google Cloud Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n## Recommended Remediation\nEdit the scope of the instance's security group to remove the wide-open network access.\n### Bot Recommendations\n*  Mark Resource Noncompliant: Flag Instances with a public IP address and port exposure to 0.0.0.0/0.\n* Send Email/Instant Notification: Notify operations/security team of the Instances with a public IP address and port exposure to the Internet (0.0.0.0/0). Separately, using cloud badges, identify cloud account owners and notify them of the steps needed to remove port exposure to 0.0.0.0/0 by following the CIS manual remediation steps as outlined below.\n\n\n### CIS Recommended Remediation Steps\n\n**Google Cloud Platform**\n\n**From Console:**\n\n1. Go to the `VM instances` page.\n2. Click on the instance name to go to the `Instance detail page`.\n3. Click `Edit`.\n4. For each Network interface, ensure that `External IP` is set to `None`.\n5. Click `Done` and then click `Save`.\n\n**From Command Line:**\n\n1. Describe the instance properties:\n\n```\ngcloud compute instances describe INSTANCE_NAME --zone=ZONE\n```\n\n2. Identify the access config name that contains the external IP address. This access config appears in the following format:\n\n```\nnetworkInterfaces:\n- accessConfigs:\n - kind: compute#accessConfig\n name: External NAT\n natIP: 130.211.181.55\n type: ONE_TO_ONE_NAT\n```\n\n2. Delete the access config.\n\n```\ngcloud compute instances delete-access-config INSTANCE_NAME --zone=ZONE --access-config-name \"\"ACCESS_CONFIG_NAME\"\"\n```\n\nIn the above example, the `ACCESS_CONFIG_NAME` is `External NAT`. The name of your access config might be different.\n\n**Prevention:**\n\nYou can configure the `Define allowed external IPs for VM instances` Organization Policy to prevent VMs from being configured with public IP addresses. Learn more at: https://console.cloud.google.com/orgpolicies/compute-vmExternalIpAccess\n\n### Remediation Reference Links\n\nFor more information on specific steps to identify and remediate an Instance with public IP address and any port exposure to 0.0.0.0/0, follow these links:\n\n* Amazon Web Services - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/authorizing-access-to-an-instance.html\nhttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html\n\n* Microsoft Azure - https://docs.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses\nhttps://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal\n\n* Google Cloud Platform - https://cloud.google.com/compute/docs/ip-addresses\nhttps://cloud.google.com/vpc/docs/firewalls\n\n### Compliance Information\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - CIS - GCP 1.1.0: Virtual Machines 4.9\n  - HIPAA: Access Control - § 164.312(a)(1), No ePHI Should Be Publicly Accessible\n  - SOC 2: CC5.2, CC6.1, CC6.3, CC6.6\n  - PCI DSS Pack: 6.6, 7.1, 7.2, Requirement 1.3\n  - NIST Cybersecurity Framework: DE.CM-7, PR.AC-3, PR.AC-4, PR.AC-5, PR.DS-5\n  - HITRUST v9.4: 0724.07a3Organizational.4, 0814.01n1Organizational.12, 0818.01w3System.12, 0855.01wCMSOrganizational.2, 0856.01wFTIOrganizational.4, 0857.01wHIXOrganizational.1, 11123.01qPCIOrganizational.3, 1114.01h1Organizational.123, 1117.01j1Organizational.23, 1118.01j2Organizational.124, 11192.01cHIXSystem.2, 1164.01cHIESystem.1, 1165.01cPCISystem.1, 1179.01j3Organizational.1, 1403.05i1Organizational.67, 1424.05j2Organizational.5, 1427.05jFTIOrganizational.3, 1802.08b1Organizational.3, 19141.06c1Organizational.7, 19153.06dFTIOrganizational.12, 19910.06cSROrganizational.2\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b, 500.14.a\n  - NIST 800-53 (Rev 5): CM-7, CM-7 (1)\n  - FFEIC: D3.PC.IM.B.3 All ports are monitored., D3.PC.IM.B.6 Ports, functions, protocols and services are prohibited if no longer needed for business purposes.\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.4.7, 3.13.1, 3.13.2, 3.13.6\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - Microsoft Cloud Security Benchmark: NS-1, NS-2\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1037, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                              "severity": "High",
                              "source": "core"
                            }
                          ]
                        },
                        "Info": {
                          "count": 2,
                          "insights": [
                            {
                              "author": "InsightCloudSec",
                              "description": "Match instances with an ephemeral public IP address",
                              "identified_on": "2023-06-01 16:48:57",
                              "insight_id": 4,
                              "name": "Instance Has Ephemeral Public IP",
                              "notes": "## Overview\n\nCompute instances can have static or dynamic (ephemeral) public IP addresses associated with them. Static addresses will remain intact and persist through lifecycle actions such as stop/start. This can be essential when the resource is used for direct connectivity and does not sit behind a load balancer. Ephemeral addresses will commonly change, and can result in a loss of connectivity to the system if it is routinely stopped/started.\n\nFor some workloads such as web servers this may not represent a true problem. These systems are intended to be ephemeral and in many cases should not have a public IP at all. This Insight can be reconfigured to leverage that tagging policy to identify those mission critical systems which should be updated. It is strongly encouraged to leverage a tagging policy to identify scenarios where this is acceptable.\n\n### Remediation\n\nFor production facing/critical workloads which cannot be taken offline, consider attaching an persistent public iP address. This can be done without taking the machine offline. Be aware that when doing this you may need to update DNS to point to the newly reserved IP address.\n\n### Compliance Information\n  - SOC 2 (Legacy): A1.1, C1.2, C1.3, C1.7, CC5.6\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - HIPAA: Access Control - § 164.312(a)(1), Information Access Management - § 164.308(a)(4)\n  - SOC 2: CC6.1, CC6.6\n  - PCI DSS Pack: Requirement 7\n  - NIST Cybersecurity Framework: PR.PT-5\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.13.1, 3.13.2\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                              "severity": "Info",
                              "source": "core"
                            },
                            {
                              "author": "InsightCloudSec",
                              "description": "Identifies compute instances which have an ephemeral/reserved public IP attached",
                              "identified_on": "2023-06-01 16:48:57",
                              "insight_id": 536,
                              "name": "Compute Instance With Public IP Attached",
                              "notes": "Overview\n----------\n\nCloud Service Providers (CSPs) provide customers with a way to assign ephemeral or reserved/static public IP addresses to compute instances and the network interfaces that back them for communication over the Internet. As a best practice, it is recommended that customers use these only where necessary, and opt for backend VPC communication and Load Balancers for network communication with the compute instances.\n\n### Reference Links\n\n+ https://docs.aws.amazon.com/vpc/latest/userguide/vpc-eips.html\n\n### Compliance Information\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - HITRUST v9.4: 0724.07a3Organizational.4, 0814.01n1Organizational.12, 0818.01w3System.12, 0855.01wCMSOrganizational.2, 0856.01wFTIOrganizational.4, 0857.01wHIXOrganizational.1, 11123.01qPCIOrganizational.3, 1114.01h1Organizational.123, 1117.01j1Organizational.23, 1118.01j2Organizational.124, 11192.01cHIXSystem.2, 1164.01cHIESystem.1, 1165.01cPCISystem.1, 1179.01j3Organizational.1, 1403.05i1Organizational.67, 1424.05j2Organizational.5, 1427.05jFTIOrganizational.3, 1802.08b1Organizational.3, 19141.06c1Organizational.7, 19153.06dFTIOrganizational.12, 19910.06cSROrganizational.2\n  - AWS Foundational Security Best Practices: EC2.9\n  - CIS - GCP 1.3.0: Virtual Machines 4.9\n  - CMMC Level 1: AC.1.001, AC.1.002, AC.1.003\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b\n  - ACSC Essential 8: ACSC Mitigation Strategies to Prevent Malware Delivery and Execution\n  - FFEIC: D3.PC.Im.B.1 Network perimeter defense tools (e.g., border router and firewall) are used.\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.13.1, 3.13.2\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - CIS - GCP 2.0.0: Virtual Machines 4.9\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                              "severity": "Info",
                              "source": "core"
                            }
                          ]
                        },
                        "Low": {
                          "count": 2,
                          "insights": [
                            {
                              "author": "InsightCloudSec",
                              "description": "Identify resources without the Name, Environment and Owner tag keys",
                              "identified_on": "2023-06-01 16:48:57",
                              "insight_id": 87,
                              "name": "Resource Tagging Policy 101",
                              "notes": "## Overview\n\nA resource tagging policy is critical to effective cloud administration.  While you will likely leverage tags for more than just for 'Name', 'Environment' and 'Owner' keys, they should be considered a bare minimum tagging strategy before attempting to scale.  Moreover, an effective tagging policy can be used to stack with other insights, adding context to other insights and bot actions.\n\nThis insight accepts parameters, including a list, 'tag_keys', and the boolean parameter 'match_all'.  For 'tag_keys', the default option mandates that 'Name', 'Owner', and 'Environment' are present, but if you have other tags defined, this insight is appropriate for identifying instances missing those tags.\n\n### Remediation\n\nLeverage bot automation and customize this insight to enforce tags are being applied to instances to conform to your tagging policy.\n\n### Recommended Bot Workflow\n\n- Create Slack / Email Notification: Notify the appropriate parties when tags are not present on instances.\n- Assign Tag to Resource: This action can be used to automatically tag resources that are missing tags, or to assign ephemeral tags to trigger further review.\n- Add To Resource Group: An 'Untagged' Resource Group provides an easy mechanism for reviewing untagged instances.\n- Mark Resource Non-Compliant: If a resource is untagged, and that violates your resource tagging policy, you can mark it as non-compliant.\n\n### Compliance Information\n  - SOC 2 (Legacy): CC6.2\n  - FedRAMP CCM 3.0.1: DSI-01, IVS-08\n  - NIST 800-53 (Rev 4): CM-8(4), CM-8(9) CM-8(2)\n  - ISO 27001:2013: A.8.2.1 - Classification of information, A.8.2.2 - Labelling of information\n  - SOC 2: CC6.1\n  - PCI DSS Pack: Requirement 2.4\n  - NIST Cybersecurity Framework: PR.DS-3\n  - CSA CCM V4: DCS-05, DSP-04, DSP-17\n  - Microsoft Cloud Security Benchmark: DP-1\n  - ISO 27001:2022: 5.12: Classification of information, 5.13: Labeling of information",
                              "severity": "Low",
                              "source": "core"
                            },
                            {
                              "author": "InsightCloudSec",
                              "description": "Identify resources running in locations outside of the Continental United States (OCONUS)",
                              "identified_on": "2023-06-01 16:48:57",
                              "insight_id": 96,
                              "name": "Resource Audit Not In Continental US",
                              "notes": "## Overview\n\nEnsuring all cloud resources are within an approved set of regions has a number of benefits.\n\n- Some compliance frameworks require limiting regions to a single country. This insight limits to the Continental United States.\n- Non-standard regions for a company are not frequently monitored. Resources launched in these non-standard regions may incur larger costs if not identified early.\n- Geographic latency may be a primary concern and instances much be located close to their intended network audience.\n\nThe best course of action may be to disable or delete resources after taking an image or snapshot moved to an approved region.\n\n### Supported Clouds\n\nThis Insight supports the following Clouds:\n- ALICLOUD\n- AWS\n- AWS China\n- AWS Gov\n- Microsoft Azure\n- Google\n- Oracle\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n\n### Bot Notification and/or Remediation Workflow\n\n - Create a bot from the insight\n - Refine the bot's selection criteria as needed via scope and/or additional filters\n - Mark those identified resources **Noncompliant** and add an action to notify resource owners based upon resource tags and/or cloud badges\n - Consider **Scheduled Deletion** preceded by backup actions, if available\n - Have the bot run daily or upon resource creation/modification\n\n### Compliance Information\n  - NIST 800-171: 3.3.1\n  - CSA CCM V4: IAM-12",
                              "severity": "Low",
                              "source": "core"
                            }
                          ]
                        },
                        "Medium": {
                          "count": 1,
                          "insights": [
                            {
                              "author": "InsightCloudSec",
                              "description": "Identifies instances that are configured to use the default service account",
                              "identified_on": "2023-06-01 16:48:57",
                              "insight_id": 478,
                              "name": "Instance Configured to Use Default Service Account",
                              "notes": "Overview\n----------\n\nIf an attacker compromises a VM using the default Compute Engine service account, the attacker will gain access to its role, which is Editor. The attacker may then escalate privileges and gain access to your entire project.\n\nTo defend against these privilege escalations, we recommend creating a new service account and assigning only the permissions needed by your instance. This approach aligns with the principle of least privilege access.\n\n### Exception\n\nVMs created by GKE should be excluded. These VMs have names that start with gke- and are labeled goog-gke-node.\n\n### Supported Clouds\n\nThis Insight supports the following Clouds:\n - Google Compute Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n\n### Bot Notification and/or Remediation Workflow\n\n - Create a bot from the insight\n - Refine the bot's selection criteria as needed via scope and/or additional filters\n - Mark those identified resources **Noncompliant** and add an action to notify resource owners based upon resource tags and/or cloud badges\n - Have the bot run daily or upon resource creation/modification\n\n### Remediation\n\n***From GCP Console:***\n\n1. Go to the `VM instances` page\n2. Click on the instance name to go to its VM instance details page\n3. Click `Stop` and then click `Edit`\n4. Under the section `Service Account`, select a service account other that the default\nCompute Engine service account. You may first need to create a new service\naccount\n5. Click `Save` and then click `Start`\n\n***From Command Line:***\n\n1. Stop the instance\n```\ngcloud compute instances stop INSTANCE_NAME\n```\n\n2. Update the instance\n```\ngcloud compute instances set-service-account INSTANCE_NAME --service-account=SERVICE_ACCOUNT\n```\n\n3. Restart the instance\n```\ngcloud compute instances start INSTANCE_NAME\n```\n\n### Remediation Reference Links\n\n* [GCP Service accounts](https://cloud.google.com/compute/docs/access/service-accounts)\n\n### Compliance Information\n  - CIS - GCP 1.1.0: Virtual Machines 4.1\n  - SOC 2: CC6.1\n  - PCI DSS Pack: Requirement 7\n  - NIST Cybersecurity Framework: PR.AC-1\n  - HITRUST v9.4: 1107.01b1System.2\n  - CIS - GCP 1.3.0: Virtual Machines 4.1\n  - ACSC Essential 8: ISM Restrict Administrative Privileges\n  - CIS - GCP 2.0.0: Virtual Machines 4.1",
                              "severity": "Medium",
                              "source": "core"
                            }
                          ]
                        }
                      },
                      "threat_findings": {
                        "high": {
                          "count": 1,
                          "threat_findings": [
                            {
                              "name": "Policy:IAMUser/S3BucketSharedExternally",
                              "resource_id": "storagecontainer:1:us-east-1:mledezma-ics-edh-889956758113-ccd299a4:",
                              "severity": "high",
                              "direct_link": "https://docs.aws.amazon.com/macie/latest/user/findings-types.html#findings-policy-types",
                              "affected_resource_id": "storagecontainer:1:us-east-1:mledezma-ics-edh-889956758113-ccd299a4:",
                              "finding_id": "fad37349-115a-4730-ad10-6e73ca72356d",
                              "count": 1,
                              "event_first_seen": "2023-04-30 06:08:42",
                              "event_last_seen": "2023-04-30 06:08:42",
                              "details": {
                                "accountId": "889956758113",
                                "archived": false,
                                "category": "POLICY",
                                "count": 1,
                                "createdAt": "2023-04-30 06:08:42.895000+00:00",
                                "description": "The access control list (ACL) or bucket policy for the Amazon S3 bucket allows the bucket to be shared with an AWS account that isn\u2019t part of your Amazon Macie organization.",
                                "id": "fad37349-115a-4730-ad10-6e73ca72356d",
                                "partition": "aws",
                                "policyDetails": {
                                  "action": {
                                    "actionType": "AWS_API_CALL",
                                    "apiCallDetails": {
                                      "api": "PutBucketPolicy",
                                      "apiServiceName": "s3.amazonaws.com",
                                      "firstSeen": "2023-04-30 06:05:27+00:00",
                                      "lastSeen": "2023-04-30 06:05:27+00:00"
                                    }
                                  },
                                  "actor": {
                                    "ipAddressDetails": {
                                      "ipAddressV4": "208.118.227.19",
                                      "ipCity": {
                                        "name": "Boston"
                                      },
                                      "ipCountry": {
                                        "code": "US",
                                        "name": "United States"
                                      },
                                      "ipGeoLocation": {
                                        "lat": 42.364,
                                        "lon": -71.0265
                                      },
                                      "ipOwner": {
                                        "asn": "27552",
                                        "asnOrg": "TWDX",
                                        "isp": "TowardEX Technologies International",
                                        "org": "TowardEX Technologies International"
                                      }
                                    },
                                    "userIdentity": {
                                      "assumedRole": {
                                        "accessKeyId": "ASIA46NMOOJQ462N2CM2",
                                        "accountId": "889956758113",
                                        "arn": "arn:aws:sts::889956758113:assumed-role/developer/mbelostoky@rapid7.com",
                                        "principalId": "AROA46NMOOJQRDNDBSNI3:mbelostoky@rapid7.com",
                                        "sessionContext": {
                                          "attributes": {
                                            "creationDate": "2023-04-30 05:47:59+00:00",
                                            "mfaAuthenticated": false
                                          },
                                          "sessionIssuer": {
                                            "accountId": "889956758113",
                                            "arn": "arn:aws:iam::889956758113:role/assumable/developer",
                                            "principalId": "AROA46NMOOJQRDNDBSNI3",
                                            "type": "Role",
                                            "userName": "developer"
                                          }
                                        }
                                      },
                                      "type": "AssumedRole"
                                    }
                                  }
                                },
                                "region": "us-east-1",
                                "resourcesAffected": {
                                  "s3Bucket": {
                                    "allowsUnencryptedObjectUploads": "TRUE",
                                    "arn": "arn:aws:s3:::mledezma-ics-edh-889956758113-ccd299a4",
                                    "createdAt": "2023-04-17 20:31:27+00:00",
                                    "defaultServerSideEncryption": {
                                      "encryptionType": "AES256"
                                    },
                                    "name": "mledezma-ics-edh-889956758113-ccd299a4",
                                    "owner": {
                                      "displayName": "amazon+divvycloud-dev",
                                      "id": "aebb57892f65291629ac4408d76d7fb2855a365a1237d26f5fc561a646f4c533"
                                    },
                                    "publicAccess": {
                                      "effectivePermission": "NOT_PUBLIC",
                                      "permissionConfiguration": {
                                        "accountLevelPermissions": {
                                          "blockPublicAccess": {
                                            "blockPublicAcls": true,
                                            "blockPublicPolicy": true,
                                            "ignorePublicAcls": true,
                                            "restrictPublicBuckets": true
                                          }
                                        },
                                        "bucketLevelPermissions": {
                                          "accessControlList": {
                                            "allowsPublicReadAccess": false,
                                            "allowsPublicWriteAccess": false
                                          },
                                          "blockPublicAccess": {
                                            "blockPublicAcls": true,
                                            "blockPublicPolicy": true,
                                            "ignorePublicAcls": true,
                                            "restrictPublicBuckets": true
                                          },
                                          "bucketPolicy": {
                                            "allowsPublicReadAccess": false,
                                            "allowsPublicWriteAccess": false
                                          }
                                        }
                                      }
                                    },
                                    "tags": [
                                      
                                    ]
                                  }
                                },
                                "sample": false,
                                "schemaVersion": "1.0",
                                "severity": {
                                  "description": "High",
                                  "score": 3
                                },
                                "title": "The S3 bucket is shared with an external AWS account.",
                                "type": "Policy:IAMUser/S3BucketSharedExternally",
                                "updatedAt": "2023-04-30 06:08:42.895000+00:00"
                              },
                              "finding_source": "AWS Macie"
                            }
                          ]
                        }
                      },
                      "application_context": [
                        {
                          "app": {
                            "accounts": 1,
                            "application": "ICS QA Team",
                            "block_storage_gb": 0,
                            "business_critical": false,
                            "category": "other",
                            "clouds": [
                              "AZURE_ARM"
                            ],
                            "cores": 0,
                            "is_favourite": false,
                            "name": null,
                            "object_storage_bytes": 0,
                            "poc": null,
                            "resource_count": 3
                          },
                          "tags": {
                            "Application": {
                              "value": "ICS Selenium Automation",
                              "user_defiened": true
                            },
                            "Owner": {
                              "value": "ICS QA Team",
                              "user_defiened": true
                            }
                          }
                        }
                      ],
                      "permissions": [
                        {
                          "action": "compute.snapshots.getIamPolicy",
                          "count": 1,
                          "last_executed_date": "2023-05-31 17:39:07.217902",
                          "permission": "compute.snapshots.getIamPolicy",
                          "status": "Used"
                        },
                        {
                          "action": "monitoring.dashboards.get",
                          "count": 1,
                          "last_executed_date": "2023-05-31 17:39:07.217902",
                          "permission": "monitoring.dashboards.get",
                          "status": "Used"
                        },
                        {
                          "action": "cloudbuild.builds.list",
                          "count": 1,
                          "last_executed_date": "2023-05-31 17:39:07.217902",
                          "permission": "cloudbuild.builds.list",
                          "status": "Used"
                        },
                        {
                          "permission": "gkeonprem.bareMetalAdminClusters.setIamPolicy",
                          "status": "Unused"
                        },
                        {
                          "permission": "networkconnectivity.spokes.create",
                          "status": "Unused"
                        },
                        {
                          "permission": "pubsublite.operations.get",
                          "status": "Unused"
                        },
                        {
                          "permission": "essentialcontacts.contacts.create",
                          "status": "Unused"
                        },
                        {
                          "permission": "eventarc.googleChannelConfigs.get",
                          "status": "Unused"
                        }
                      ],
                      "related_resources": [
                        {
                          "cloud_type_id": "GCE",
                          "id": "ja-gcp-hva.nic0",
                          "info": {
                            "description_template": "{source} has network interface {target}",
                            "extra_info": {
                              
                            },
                            "label": "HAS_NETWORK_INTERFACE",
                            "other_resource_type": "networkinterface",
                            "resource_type": "instance",
                            "source": true,
                            "source_or_target": "source"
                          },
                          "name": "nic0",
                          "resource_id": "networkinterface:6:europe-west1:ja-gcp-hva.nic0:",
                          "type": "networkinterface"
                        },
                        {
                          "cloud_type_id": "GCE",
                          "id": "15354827186006192505",
                          "info": {
                            "description_template": "{source} contains instance {target}",
                            "extra_info": {
                              
                            },
                            "label": "CONTAINS_INSTANCE",
                            "other_resource_type": "privatenetwork",
                            "resource_type": "instance",
                            "source": false,
                            "source_or_target": "target"
                          },
                          "name": "default",
                          "resource_id": "privatenetwork:6::15354827186006192505:",
                          "type": "privatenetwork"
                        },
                        {
                          "cloud_type_id": "GCE",
                          "id": "110744443020505229478",
                          "info": {
                            "description_template": "{source} has role {target}",
                            "extra_info": {
                              
                            },
                            "label": "HAS_ROLE",
                            "other_resource_type": "servicerole",
                            "resource_type": "instance",
                            "source": true,
                            "source_or_target": "source"
                          },
                          "name": "317115057204@project.gserviceaccount.com",
                          "resource_id": "servicerole:6:110744443020505229478:",
                          "type": "servicerole"
                        },
                        {
                          "cloud_type_id": "GCE",
                          "id": "ja-gcp-hva",
                          "info": {
                            "description_template": "{source} has volume {target}",
                            "extra_info": {
                              
                            },
                            "label": "HAS_VOLUME",
                            "other_resource_type": "volume",
                            "resource_type": "instance",
                            "source": true,
                            "source_or_target": "source"
                          },
                          "name": "ja-gcp-hva",
                          "resource_id": "volume:6:europe-west1:ja-gcp-hva:",
                          "type": "volume"
                        },
                        {
                          "id": "3537706110417665757",
                          "name": "test-blocked-rdp",
                          "resource_id": "resourceaccesslist:6::3537706110417665757:",
                          "type": "resourceaccesslist"
                        },
                        {
                          "id": "5121977450226834962",
                          "name": "test-deny",
                          "resource_id": "resourceaccesslist:6::5121977450226834962:",
                          "type": "resourceaccesslist"
                        },
                        {
                          "id": "8519192485236936413",
                          "name": "r7-vpn-allow-ssh",
                          "resource_id": "resourceaccesslist:6::8519192485236936413:",
                          "type": "resourceaccesslist"
                        }
                      ],
                      "attack_path": {
                        "High": {
                          "count": 1,
                          "paths": [
                            {
                              "author": "rapid7",
                              "category_description": "This attack path definition looks for any publicly-available instances and checks to see if any of them have a high/critical vulnerability severity. This can lead to the instance being exploited, so it should be treated as high priority.",
                              "category_id": "apa.publicly_high_vuln_sev_esc",
                              "category_impact": "An attacker may be able to access the instance via the internet and exploit the vulnerability to execute code.",
                              "category_labels": [
                                "Compute Abuse"
                              ],
                              "category_name": "Publicly Exposed Compute Instance with High/Critical vulnerabilities",
                              "category_remediation": "1. Click on the instance node for the attack path to view details about the node.\n2. Find the vulnerabilities tab to see vulnerabilites.\n3. From there you can find out where the vuln scan came from ie Inspector, IVM, HVA.\n4. Refer to the originating scanner's content for instructions to remediate.\n",
                              "discovered_timestamp": "2024-05-21T18:08:05",
                              "id": 93800,
                              "path_length": 7,
                              "risk_score": 800.0,
                              "severity": "High",
                              "source_resource_id": "internet:internet",
                              "source_resource_name": "Internet",
                              "source_resource_type": "internet",
                              "target_account_id": "014578312761",
                              "target_account_name": "AWS-SSE",
                              "target_account_type": "AWS",
                              "target_application_id": null,
                              "target_application_name": null,
                              "target_organization_service_id": 1496,
                              "target_resource_id": "instance:1496:ap-southeast-2:i-05b3dbcd997404213:",
                              "target_resource_name": "k8-master",
                              "target_resource_type": "instance"
                            }
                          ]
                        }
                      },
                      "errors": [
                        
                      ]
                    }
              schema:
                type: object
                properties:
                  resource_details:
                    type: object
                    properties:
                      dependencies:
                        type: object
                        properties:
                          networkinterface:
                            type: array
                            items:
                              type: object
                              properties:
                                id:
                                  type: string
                                  example: network-interface-id
                                name:
                                  type: string
                                  example: nic0
                                resource_id:
                                  type: string
                                  example: 'networkinterface:6:europe-west1:network-interface-id:'
                                type:
                                  type: string
                                  example: networkinterface
                          privatenetwork:
                            type: array
                            items:
                              type: object
                              properties:
                                id:
                                  type: string
                                  example: '12345678912345678901'
                                name:
                                  type: string
                                  example: default
                                resource_id:
                                  type: string
                                  example: 'privatenetwork:6::12345678912345678901:'
                                type:
                                  type: string
                                  example: privatenetwork
                          resourceaccesslist:
                            type: array
                            items:
                              type: object
                              properties:
                                id:
                                  type: string
                                  example: '12345678912345678901'
                                name:
                                  type: string
                                  example: r7-vpn-allow-ssh
                                resource_id:
                                  type: string
                                  example: 'resourceaccesslist:6::12345678912345678901:'
                                type:
                                  type: string
                                  example: resourceaccesslist
                          servicerole:
                            type: array
                            items:
                              type: object
                              properties:
                                id:
                                  type: string
                                  example: '12345678912345678901'
                                name:
                                  type: string
                                  example: 123456789123@project.gserviceaccount.com
                                resource_id:
                                  type: string
                                  example: 'servicerole:6:12345678912345678901:'
                                type:
                                  type: string
                                  example: servicerole
                          volume:
                            type: array
                            items:
                              type: object
                              properties:
                                id:
                                  type: string
                                  example: volume-id
                                name:
                                  type: string
                                  example: volume-name
                                resource_id:
                                  type: string
                                  example: 'volume:6:europe-west1:volume-id:'
                                type:
                                  type: string
                                  example: volume
                      details:
                        type: object
                        properties:
                          instance:
                            type: object
                            properties:
                              common:
                                type: object
                                properties:
                                  account:
                                    type: string
                                    example: GCP
                                  account_id:
                                    type: string
                                    example: account-id
                                  account_status:
                                    type: string
                                    example: REFRESH
                                  auto_id:
                                    type: integer
                                    example: 105
                                    default: 0
                                  availability_zone:
                                    type: string
                                    example: europe-west1-b
                                  cloud:
                                    type: string
                                    example: GCE
                                  creation_timestamp:
                                    type: string
                                    example: '2023-03-29 10:09:12'
                                  direct_link:
                                    type: string
                                    example: https://console.cloud.google.com/compute/instancesDetail/zones/europe-west1-b/instances/volume-id?project=my-project
                                  discovered_timestamp:
                                    type: string
                                    example: '2023-04-03 09:26:38'
                                  last_harvested_timestamp:
                                    type: string
                                    example: '2023-06-11T07:19:12'
                                  modified_timestamp:
                                    type: string
                                    example: '2023-04-04 16:35:52'
                                  noncompliance:
                                    type: array
                                  organization_service_id:
                                    type: integer
                                    example: 6
                                    default: 0
                                  properties:
                                    type: object
                                    properties:
                                      property_list:
                                        type: array
                                        items:
                                          type: object
                                          properties:
                                            name:
                                              type: string
                                              example: divvy.default_service_account
                                            parent_resource_id:
                                              type: string
                                              example: 'instance:6:europe-west1:volume-id:'
                                            type_hint:
                                              type: string
                                              example: bool
                                            value:
                                              type: string
                                              example: '1'
                                  provider_id:
                                    type: string
                                    example: volume-id
                                  region:
                                    type: string
                                    example: europe-west1
                                  resource_id:
                                    type: string
                                    example: 'instance:6:europe-west1:volume-id:'
                                  resource_name:
                                    type: string
                                    example: volume-id
                                  resource_type:
                                    type: string
                                    example: instance
                                  tags:
                                    type: object
                                    properties:
                                      ja:
                                        type: string
                                        example: hva
                                  security_account_email:
                                    type: string
                                    example: security@rapid7.com
                              create_time:
                                type: string
                                example: '2023-03-29 10:09:12'
                              image_id:
                                type: string
                                example: '7157337275614620995'
                              instance_id:
                                type: string
                                example: volume-id
                              instance_type:
                                type: string
                                example: e2-micro
                              launch_time:
                                type: string
                                example: '2023-03-29 10:09:21'
                              network_interfaces:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    common:
                                      type: object
                                      properties:
                                        account:
                                          type: string
                                          example: GCP
                                        account_id:
                                          type: string
                                          example: account-id
                                        account_status:
                                          type: string
                                          example: REFRESH
                                        auto_id:
                                          type: integer
                                          example: 138
                                          default: 0
                                        cloud:
                                          type: string
                                          example: GCE
                                        creation_timestamp:
                                          type: string
                                          example: None
                                        discovered_timestamp:
                                          type: string
                                          example: '2023-04-03 09:26:38'
                                        modified_timestamp:
                                          type: string
                                          example: '2023-04-03 09:26:38'
                                        organization_service_id:
                                          type: integer
                                          example: 6
                                          default: 0
                                        provider_id:
                                          type: string
                                          example: network-interface-id
                                        region:
                                          type: string
                                          example: europe-west1
                                        resource_id:
                                          type: string
                                          example: 'networkinterface:6:europe-west1:network-interface-id:'
                                        resource_name:
                                          type: string
                                          example: network-interface-name
                                        resource_type:
                                          type: string
                                          example: networkinterface
                                        tags:
                                          type: object
                                          properties:
                                            ja:
                                              type: string
                                              example: hva
                                    device_index:
                                      type: integer
                                      example: 0
                                      default: 0
                                    instance_id:
                                      type: string
                                      example: volume-id
                                    instance_resource_id:
                                      type: string
                                      example: 'instance:6:europe-west1:volume-id:'
                                    ip_addresses:
                                      type: array
                                      items:
                                        type: object
                                        properties:
                                          ip_address:
                                            type: string
                                            example: 123.123.123.123
                                          ip_address_type:
                                            type: string
                                            example: Ipv4PublicAddress
                                    network_interface_id:
                                      type: string
                                      example: network-interface-id
                                    network_resource_id:
                                      type: string
                                      example: 'privatenetwork:6::12345678912345678901:'
                                    private_ip_address:
                                      type: string
                                      example: 123.123.123.123
                              network_resource_id:
                                type: string
                                example: 'privatenetwork:6::12345678912345678901:'
                              object_id:
                                type: string
                                example: '12345678912345678901'
                              platform:
                                type: string
                                example: linux
                              private_ip_address:
                                type: string
                                example: 123.123.123.123
                              public_ip_address:
                                type: string
                                example: 123.123.123.123
                              role_resource_id:
                                type: string
                                example: 'servicerole:6:12345678912345678901:'
                              state:
                                type: string
                                example: running
                              termination_protection:
                                type: boolean
                                example: false
                                default: true
                              vulnerability_sources:
                                type: array
                          resource_type:
                            type: string
                            example: instance
                  vulnerabilities:
                    type: object
                    properties:
                      count:
                        type: integer
                        example: 1
                      vulnerabilities:
                        type: array
                        items:
                          type: object
                          properties:
                            cvss_score:
                              type: integer
                              example: 9.8
                            description:
                              type: string
                              example: CVE-2023-5178 - linux
                            name:
                              type: string
                              example: CVE-2023-5178
                            package:
                              type: string
                              example: pack
                            severity:
                              type: string
                              example: CRITICAL
                            source:
                              type: string
                              example: inspectorv2
                            uri:
                              type: string
                              example: https://security-tracker.debian.org/tracker/CVE-2023-5178
                  resource_insights:
                    type: object
                    properties:
                      Critical:
                        type: object
                        properties:
                          count:
                            type: integer
                            example: 1
                            default: 0
                          insights:
                            type: array
                            items:
                              type: object
                              properties:
                                author:
                                  type: string
                                  example: InsightCloudSec
                                description:
                                  type: string
                                  example: Identify Compute Instances With a Public IP Address That is Exposing Windows RDP
                                identified_on:
                                  type: string
                                  example: '2023-06-01 16:48:57'
                                insight_id:
                                  type: integer
                                  example: 281
                                  default: 0
                                name:
                                  type: string
                                  example: Instance with a Public IP Exposing RDP
                                notes:
                                  type: string
                                  example: |-
                                    ## Overview
                                    Security groups provide stateful filtering of ingress/egress network traffic to cloud resources. It is recommended that no security group allows unrestricted ingress access to port 3389.

                                    This Insight identities compute instances with a public IP address and that is exposing Windows RDP.

                                    ### Supported Clouds
                                    **This Insight supports the following clouds:**
                                    * Amazon Web Services, Amazon Web Services China, Amazon Web Services Government
                                    * Microsoft Azure
                                    * Google Cloud Platform

                                    **Supported Infrastructure as Code Clouds:**
                                    * Amazon Web Services
                                    * Microsoft Azure
                                    * Google Cloud Platform

                                    Supported clouds are specific to this Insight and may vary for any associated filter(s).

                                    ## Recommended Remediation
                                    Leverage Bot automation to identify and monitor for compute instances that are exposing RDP via port 3389 and have a public IP address attached.
                                    ### Bot Recommendations
                                    * Mark Resource Noncompliant: Flag compute instances that have been identified as having RDP exposed and a public IP address attached.
                                    * Send Email/Instant Notification: Notify operations/security team of the compute instances that are exposing RDP and have a public IP address attached. Separately, using cloud badges, identify cloud account owners and notify them of the non-compliant compute instances and the steps required to disable RDP and/or remove the public IP address.


                                    ### Remediation Reference Links
                                    For more information on Identifying compute instances with a public IP address and that is exposing Windows RDP, follow these links:

                                    **Amazon Web Services**

                                    - https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/authorizing-access-to-an-instance.html

                                    **Microsoft Azure**

                                     - https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

                                    **Google Cloud Platform**

                                    - https://cloud.google.com/vpc/docs/firewalls

                                    ### Compliance Information
                                      - NIST 800-53 (Rev 4): AC-17, AC-17(1), AC-6, RA-5, SA-17(7), SC-7, SC-8
                                      - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction
                                      - HIPAA: Access Control - § 164.312(a)(1), No ePHI Should Be Publicly Accessible
                                      - SOC 2: CC5.2, CC6.1, CC6.3, CC6.6
                                      - PCI DSS Pack: 6.6, 7.1, 7.2, Requirement 1.3
                                      - NIST Cybersecurity Framework: DE.CM-7, PR.AC-3, PR.AC-4, PR.AC-5, PR.DS-5
                                      - HITRUST v9.4: 0724.07a3Organizational.4, 0814.01n1Organizational.12, 0818.01w3System.12, 0855.01wCMSOrganizational.2, 0856.01wFTIOrganizational.4, 0857.01wHIXOrganizational.1, 11123.01qPCIOrganizational.3, 1114.01h1Organizational.123, 1117.01j1Organizational.23, 1118.01j2Organizational.124, 11192.01cHIXSystem.2, 1164.01cHIESystem.1, 1165.01cPCISystem.1, 1179.01j3Organizational.1, 1403.05i1Organizational.67, 1424.05j2Organizational.5, 1427.05jFTIOrganizational.3, 1802.08b1Organizational.3, 19141.06c1Organizational.7, 19153.06dFTIOrganizational.12, 19910.06cSROrganizational.2
                                      - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b, 500.14.a
                                      - NIST 800-53 (Rev 5): AC-4, AC-4 (21), AC-6, AC-17, AC-17 (1), AC-21, CM-7, CM-7 (1), SC-7, SC-7 (3), SC-7 (4), SC-7 (5), SC-7 (9), SC-7 (10), SC-7 (11), SC-7 (16), SC-7 (20), SC-7 (21)
                                      - NIST 800-171: 3.1.1, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.13.1, 3.13.2
                                      - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09
                                      - Microsoft Cloud Security Benchmark: NS-1, NS-2, NS-3
                                      - MITRE Att&ck Mitigation Pack: M1015, M1039, M1035, M1030
                                      - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks
                                      - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture
                                severity:
                                  type: string
                                  example: Critical
                                source:
                                  type: string
                                  example: core
                  threat_findings:
                    type: object
                    properties:
                      high:
                        type: object
                        properties:
                          count:
                            type: integer
                            example: 1
                            default: 0
                          threat_findings:
                            type: array
                            items:
                              type: object
                              properties:
                                name:
                                  type: string
                                  example: Policy:IAMUser/S3BucketSharedExternally
                                resource_id:
                                  type: string
                                  example: 'storagecontainer:1:us-east-1:storage-container-id:'
                                severity:
                                  type: string
                                  example: high
                                direct_link:
                                  type: string
                                  example: https://docs.aws.amazon.com/macie/latest/user/findings-types.html#findings-policy-types
                                affected_resource_id:
                                  type: string
                                  example: 'storagecontainer:1:us-east-1:storage-container-id:'
                                finding_id:
                                  type: string
                                  example: finding-id
                                count:
                                  type: integer
                                  example: 1
                                  default: 0
                                event_first_seen:
                                  type: string
                                  example: '2023-04-30 06:08:42'
                                event_last_seen:
                                  type: string
                                  example: '2023-04-30 06:08:42'
                                details:
                                  type: object
                                  properties:
                                    accountId:
                                      type: string
                                      example: '123456789123'
                                    archived:
                                      type: boolean
                                      example: false
                                      default: true
                                    category:
                                      type: string
                                      example: POLICY
                                    count:
                                      type: integer
                                      example: 1
                                      default: 0
                                    createdAt:
                                      type: string
                                      example: '2023-04-30 06:08:42.895000+00:00'
                                    description:
                                      type: string
                                      example: The access control list (ACL) or bucket policy for the Amazon S3 bucket allows the bucket to be shared with an AWS account that isn’t part of your Amazon Macie organization.
                                    id:
                                      type: string
                                      example: finding-id
                                    partition:
                                      type: string
                                      example: aws
                                    policyDetails:
                                      type: object
                                      properties:
                                        action:
                                          type: object
                                          properties:
                                            actionType:
                                              type: string
                                              example: AWS_API_CALL
                                            apiCallDetails:
                                              type: object
                                              properties:
                                                api:
                                                  type: string
                                                  example: PutBucketPolicy
                                                apiServiceName:
                                                  type: string
                                                  example: s3.amazonaws.com
                                                firstSeen:
                                                  type: string
                                                  example: '2023-04-30 06:05:27+00:00'
                                                lastSeen:
                                                  type: string
                                                  example: '2023-04-30 06:05:27+00:00'
                                        actor:
                                          type: object
                                          properties:
                                            ipAddressDetails:
                                              type: object
                                              properties:
                                                ipAddressV4:
                                                  type: string
                                                  example: 123.123.123.123
                                                ipCity:
                                                  type: object
                                                  properties:
                                                    name:
                                                      type: string
                                                      example: Somewhere
                                                ipCountry:
                                                  type: object
                                                  properties:
                                                    code:
                                                      type: string
                                                      example: US
                                                    name:
                                                      type: string
                                                      example: United States
                                                ipGeoLocation:
                                                  type: object
                                                  properties:
                                                    lat:
                                                      type: integer
                                                      example: 0
                                                      default: 0
                                                    lon:
                                                      type: integer
                                                      example: 0
                                                      default: 0
                                                ipOwner:
                                                  type: object
                                                  properties:
                                                    asn:
                                                      type: string
                                                      example: '12345'
                                                    asnOrg:
                                                      type: string
                                                      example: ABCD
                                                    isp:
                                                      type: string
                                                      example: ABCD Corp.
                                                    org:
                                                      type: string
                                                      example: ABCD Corp.
                                            userIdentity:
                                              type: object
                                              properties:
                                                assumedRole:
                                                  type: object
                                                  properties:
                                                    accessKeyId:
                                                      type: string
                                                      example: ACCESSKEY
                                                    accountId:
                                                      type: string
                                                      example: '123456789123'
                                                    arn:
                                                      type: string
                                                      example: arn:aws:sts::123456789123:assumed-role/developer/john-do@rapid7.com
                                                    principalId:
                                                      type: string
                                                      example: principal-id:john-doe@rapid7.com
                                                    sessionContext:
                                                      type: object
                                                      properties:
                                                        attributes:
                                                          type: object
                                                          properties:
                                                            creationDate:
                                                              type: string
                                                              example: '2023-04-30 05:47:59+00:00'
                                                            mfaAuthenticated:
                                                              type: boolean
                                                              example: false
                                                              default: true
                                                        sessionIssuer:
                                                          type: object
                                                          properties:
                                                            accountId:
                                                              type: string
                                                              example: '123456789123'
                                                            arn:
                                                              type: string
                                                              example: arn:aws:iam::123456789123:role/assumable/developer
                                                            principalId:
                                                              type: string
                                                              example: principal-id
                                                            type:
                                                              type: string
                                                              example: Role
                                                            userName:
                                                              type: string
                                                              example: developer
                                                type:
                                                  type: string
                                                  example: AssumedRole
                                    region:
                                      type: string
                                      example: us-east-1
                                    resourcesAffected:
                                      type: object
                                      properties:
                                        s3Bucket:
                                          type: object
                                          properties:
                                            allowsUnencryptedObjectUploads:
                                              type: string
                                              example: 'TRUE'
                                            arn:
                                              type: string
                                              example: arn:aws:s3:::storage-container-id
                                            createdAt:
                                              type: string
                                              example: '2023-04-17 20:31:27+00:00'
                                            defaultServerSideEncryption:
                                              type: object
                                              properties:
                                                encryptionType:
                                                  type: string
                                                  example: AES256
                                            name:
                                              type: string
                                              example: storage-container-id
                                            owner:
                                              type: object
                                              properties:
                                                displayName:
                                                  type: string
                                                  example: amazon+rapid7+owner
                                                id:
                                                  type: string
                                                  example: owner-id
                                            publicAccess:
                                              type: object
                                              properties:
                                                effectivePermission:
                                                  type: string
                                                  example: NOT_PUBLIC
                                                permissionConfiguration:
                                                  type: object
                                                  properties:
                                                    accountLevelPermissions:
                                                      type: object
                                                      properties:
                                                        blockPublicAccess:
                                                          type: object
                                                          properties:
                                                            blockPublicAcls:
                                                              type: boolean
                                                              example: true
                                                              default: true
                                                            blockPublicPolicy:
                                                              type: boolean
                                                              example: true
                                                              default: true
                                                            ignorePublicAcls:
                                                              type: boolean
                                                              example: true
                                                              default: true
                                                            restrictPublicBuckets:
                                                              type: boolean
                                                              example: true
                                                              default: true
                                                    bucketLevelPermissions:
                                                      type: object
                                                      properties:
                                                        accessControlList:
                                                          type: object
                                                          properties:
                                                            allowsPublicReadAccess:
                                                              type: boolean
                                                              example: false
                                                              default: true
                                                            allowsPublicWriteAccess:
                                                              type: boolean
                                                              example: false
                                                              default: true
                                                        blockPublicAccess:
                                                          type: object
                                                          properties:
                                                            blockPublicAcls:
                                                              type: boolean
                                                              example: true
                                                              default: true
                                                            blockPublicPolicy:
                                                              type: boolean
                                                              example: true
                                                              default: true
                                                            ignorePublicAcls:
                                                              type: boolean
                                                              example: true
                                                              default: true
                                                            restrictPublicBuckets:
                                                              type: boolean
                                                              example: true
                                                              default: true
                                                        bucketPolicy:
                                                          type: object
                                                          properties:
                                                            allowsPublicReadAccess:
                                                              type: boolean
                                                              example: false
                                                              default: true
                                                            allowsPublicWriteAccess:
                                                              type: boolean
                                                              example: false
                                                              default: true
                                            tags:
                                              type: array
                                    sample:
                                      type: boolean
                                      example: false
                                      default: true
                                    schemaVersion:
                                      type: string
                                      example: '1.0'
                                    severity:
                                      type: object
                                      properties:
                                        description:
                                          type: string
                                          example: High
                                        score:
                                          type: integer
                                          example: 3
                                          default: 0
                                    title:
                                      type: string
                                      example: The S3 bucket is shared with an external AWS account.
                                    type:
                                      type: string
                                      example: Policy:IAMUser/S3BucketSharedExternally
                                    updatedAt:
                                      type: string
                                      example: '2023-04-30 06:08:42.895000+00:00'
                                finding_source:
                                  type: string
                                  example: AWS Macie
                  application_context:
                    type: array
                    items:
                      type: object
                      properties:
                        app:
                          type: object
                          properties:
                            accounts:
                              type: integer
                              example: 1
                              default: 0
                            application:
                              type: string
                              example: ICS application
                            block_storage_gb:
                              type: integer
                              example: 0
                              default: 0
                            business_critical:
                              type: boolean
                              example: false
                              default: true
                            category:
                              type: string
                              example: other
                            clouds:
                              type: array
                              items:
                                type: string
                                example: AZURE_ARM
                            cores:
                              type: integer
                              example: 0
                              default: 0
                            is_favourite:
                              type: boolean
                              example: false
                              default: true
                            name: {}
                            object_storage_bytes:
                              type: integer
                              example: 0
                              default: 0
                            poc: {}
                            resource_count:
                              type: integer
                              example: 3
                              default: 0
                        tags:
                          type: object
                          properties:
                            Application:
                              type: object
                              properties:
                                value:
                                  type: string
                                  example: ICS Automation
                                user_defiened:
                                  type: boolean
                                  example: true
                                  default: true
                            Owner:
                              type: object
                              properties:
                                value:
                                  type: string
                                  example: ICS QA Team
                                user_defiened:
                                  type: boolean
                                  example: true
                                  default: true
                  permissions:
                    type: array
                    items:
                      type: object
                      properties:
                        action:
                          type: string
                          example: compute.snapshots.getIamPolicy
                        count:
                          type: integer
                          example: 1
                          default: 0
                        last_executed_date:
                          type: string
                          example: '2023-05-31 17:39:07.217902'
                        permission:
                          type: string
                          example: compute.snapshots.getIamPolicy
                        status:
                          type: string
                          example: Used
                  related_resources:
                    type: array
                    items:
                      type: object
                      properties:
                        cloud_type_id:
                          type: string
                          example: GCE
                        id:
                          type: string
                          example: network-interface-id
                        info:
                          type: object
                          properties:
                            description_template:
                              type: string
                              example: '{source} has network interface {target}'
                            extra_info:
                              type: object
                              properties: {}
                            label:
                              type: string
                              example: HAS_NETWORK_INTERFACE
                            other_resource_type:
                              type: string
                              example: networkinterface
                            resource_type:
                              type: string
                              example: instance
                            source:
                              type: boolean
                              example: true
                              default: true
                            source_or_target:
                              type: string
                              example: source
                        name:
                          type: string
                          example: nic0
                        resource_id:
                          type: string
                          example: 'networkinterface:6:europe-west1:network-interface-id:'
                        type:
                          type: string
                          example: networkinterface
                  attack_path:
                    type: object
                    properties:
                      Critical:
                        type: object
                        properties:
                          count:
                            type: integer
                            example: 1
                            default: 0
                          paths:
                            type: array
                            items:
                              type: object
                              properties:
                                author:
                                  type: string
                                  example: rapid7
                                category_description:
                                  type: string
                                  example: This attack path definition looks for any publicly-available instances and checks to see if any of them have a high/critical vulnerability severity. This can lead to the instance being exploited, so it should be treated as high priority.
                                category_id:
                                  type: string
                                  example: apa.publicly_high_vuln_sev_esc
                                category_impact:
                                  type: string
                                  example: An attacker may be able to access the instance via the internet and exploit the vulnerability to execute code.
                                category_labels:
                                  type: array
                                  items:
                                    type: string
                                    example: Compute Abuse
                                category_name:
                                  type: string
                                  example: Publicly Exposed Compute Instance with High/Critical vulnerabilities
                                category_remediation:
                                  type: string
                                  example: |
                                    1. Click on the instance node for the attack path to view details about the node.
                                    2. Find the vulnerabilities tab to see vulnerabilites.
                                    3. From there you can find out where the vuln scan came from ie Inspector, IVM, HVA.
                                    4. Refer to the originating scanner's content for instructions to remediate.
                                discovered_timestamp:
                                  type: string
                                  example: '2024-05-21T18:08:05'
                                id:
                                  type: integer
                                  example: 10000
                                path_length:
                                  type: integer
                                  example: 7
                                risk_score:
                                  type: number
                                  example: 800
                                severity:
                                  type: string
                                  example: High
                                source_resource_id:
                                  type: string
                                  example: internet:internet
                                source_resource_name:
                                  type: string
                                  example: Internet
                                source_resource_type:
                                  type: string
                                  example: internet
                                target_account_id:
                                  type: string
                                  example: '123456789123'
                                target_account_name:
                                  type: string
                                  example: AWS-SSE
                                target_account_type:
                                  type: string
                                  example: AWS
                                target_application_id:
                                  type: string
                                target_application_name:
                                  type: string
                                target_organization_service_id:
                                  type: string
                                  example: '1234'
                                target_resource_id:
                                  type: string
                                  example: 'instance:1111:ap-southeast-2:i-11b1dbcd111111111:'
                                target_resource_name:
                                  type: string
                                  example: k8-master
                                target_resource_type:
                                  type: string
                                  example: instance
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
    post:
      summary: List Enriched Resource Details (Multiple)
      description: Lists enriched details about multiple given resources, including dependencies, properties, Insight findings, threat findings, application context information, permissions, vulnerabilities, attack path, and related resources.
      operationId: list-enriched-resource-details-multiple
      parameters:
        - name: filters
          in: query
          description: 'A comma-delimited list of names for the enriched details about a given resource. For example: `resource_details,vulnerabilities`.'
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                provider_ids:
                  type: array
                  description: A list of unique, CSP-specific identifiers for resources. A list of `provider_ids` or `namespace_ids` must be provided; `provider_ids` will override `namespace_ids` if both are provided.
                  items:
                    type: string
                namespace_ids:
                  type: array
                  description: A list of unique, CSP-specific namespace identifiers for resources. A list of `provider_ids` or `namespace_ids` must be provided; `provider_ids` will override `namespace_ids` if both are provided.
                  items:
                    type: string
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value: |-
                    {
                      "i-0053b891b939e3471": {
                        "resource_details": {
                          "dependencies": {
                            "networkinterface": [
                              {
                                "id": "ja-gcp-hva.nic0",
                                "name": "nic0",
                                "resource_id": "networkinterface:6:europe-west1:ja-gcp-hva.nic0:",
                                "type": "networkinterface"
                              }
                            ],
                            "privatenetwork": [
                              {
                                "id": "15354827186006192505",
                                "name": "default",
                                "resource_id": "privatenetwork:6::15354827186006192505:",
                                "type": "privatenetwork"
                              }
                            ],
                            "resourceaccesslist": [
                              {
                                "id": "3537706110417665757",
                                "name": "test-blocked-rdp",
                                "resource_id": "resourceaccesslist:6::3537706110417665757:",
                                "type": "resourceaccesslist"
                              },
                              {
                                "id": "5121977450226834962",
                                "name": "test-deny",
                                "resource_id": "resourceaccesslist:6::5121977450226834962:",
                                "type": "resourceaccesslist"
                              },
                              {
                                "id": "8519192485236936413",
                                "name": "r7-vpn-allow-ssh",
                                "resource_id": "resourceaccesslist:6::8519192485236936413:",
                                "type": "resourceaccesslist"
                              }
                            ],
                            "servicerole": [
                              {
                                "id": "110744443020505229478",
                                "name": "317115057204@project.gserviceaccount.com",
                                "resource_id": "servicerole:6:110744443020505229478:",
                                "type": "servicerole"
                              }
                            ],
                            "volume": [
                              {
                                "id": "ja-gcp-hva",
                                "name": "ja-gcp-hva",
                                "resource_id": "volume:6:europe-west1:ja-gcp-hva:",
                                "type": "volume"
                              }
                            ]
                          },
                          "details": {
                            "instance": {
                              "common": {
                                "account": "GCP",
                                "account_id": "divvy-development",
                                "account_status": "REFRESH",
                                "auto_id": 105,
                                "availability_zone": "europe-west1-b",
                                "cloud": "GCE",
                                "creation_timestamp": "2023-03-29 10:09:12",
                                "direct_link": "https://console.cloud.google.com/compute/instancesDetail/zones/europe-west1-b/instances/ja-gcp-hva?project=divvy-development",
                                "discovered_timestamp": "2023-04-03 09:26:38",
                                "last_harvested_timestamp": "2023-06-11T07:19:12",
                                "modified_timestamp": "2023-04-04 16:35:52",
                                "noncompliance": [
                                  
                                ],
                                "organization_service_id": 6,
                                "properties": {
                                  "property_list": [
                                    {
                                      "name": "divvy.default_service_account",
                                      "parent_resource_id": "instance:6:europe-west1:ja-gcp-hva:",
                                      "type_hint": "bool",
                                      "value": "1"
                                    },
                                    {
                                      "name": "divvy.full_access_scope",
                                      "parent_resource_id": "instance:6:europe-west1:ja-gcp-hva:",
                                      "type_hint": "bool",
                                      "value": "0"
                                    }
                                  ]
                                },
                                "provider_id": "ja-gcp-hva",
                                "region": "europe-west1",
                                "resource_id": "instance:6:europe-west1:ja-gcp-hva:",
                                "resource_name": "ja-gcp-hva",
                                "resource_type": "instance",
                                "tags": {
                                  "ja": "hva"
                                }
                              },
                              "create_time": "2023-03-29 10:09:12",
                              "image_id": "7157337275614620995",
                              "instance_id": "ja-gcp-hva",
                              "instance_type": "e2-micro",
                              "launch_time": "2023-03-29 10:09:21",
                              "network_interfaces": [
                                {
                                  "common": {
                                    "account": "GCP",
                                    "account_id": "divvy-development",
                                    "account_status": "REFRESH",
                                    "auto_id": 138,
                                    "cloud": "GCE",
                                    "creation_timestamp": "None",
                                    "discovered_timestamp": "2023-04-03 09:26:38",
                                    "modified_timestamp": "2023-04-03 09:26:38",
                                    "organization_service_id": 6,
                                    "provider_id": "ja-gcp-hva.nic0",
                                    "region": "europe-west1",
                                    "resource_id": "networkinterface:6:europe-west1:ja-gcp-hva.nic0:",
                                    "resource_name": "nic0",
                                    "resource_type": "networkinterface",
                                    "tags": {
                                      "ja": "hva"
                                    }
                                  },
                                  "device_index": 0,
                                  "instance_id": "ja-gcp-hva",
                                  "instance_resource_id": "instance:6:europe-west1:ja-gcp-hva:",
                                  "ip_addresses": [
                                    {
                                      "ip_address": "35.233.43.175",
                                      "ip_address_type": "Ipv4PublicAddress"
                                    },
                                    {
                                      "ip_address": "10.240.0.3",
                                      "ip_address_type": "Ipv4PrivateAddress"
                                    }
                                  ],
                                  "network_interface_id": "ja-gcp-hva.nic0",
                                  "network_resource_id": "privatenetwork:6::15354827186006192505:",
                                  "private_ip_address": "10.240.0.3"
                                }
                              ],
                              "network_resource_id": "privatenetwork:6::15354827186006192505:",
                              "object_id": "7800351496809853097",
                              "platform": "linux",
                              "private_ip_address": "10.240.0.3",
                              "public_ip_address": "35.233.43.175",
                              "role_resource_id": "servicerole:6:110744443020505229478:",
                              "state": "running",
                              "termination_protection": false,
                              "security_account_email": "security@rapid7.com",
                              "vulnerability_sources": [
                                
                              ]
                            },
                            "resource_type": "instance"
                          }
                        },
                        "vulnerabilities": {
                          "CRITICAL": {
                            "count": 2,
                            "vulnerabilities": [
                              {
                                "cvss_score": 9.8,
                                "description": "CVE-2023-5178 - linux",
                                "name": "CVE-2023-5178",
                                "package": "",
                                "severity": "CRITICAL",
                                "source": "inspectorv2",
                                "uri": "https://security-tracker.debian.org/tracker/CVE-2023-5178"
                              },
                              {
                                "cvss_score": 7.8,
                                "description": "CVE-2022-3520 - vim, xxd and 1 more",
                                "name": "CVE-2022-3520",
                                "package": "",
                                "severity": "CRITICAL",
                                "source": "inspectorv2",
                                "uri": "https://people.canonical.com/~ubuntu-security/cve/2022/CVE-2022-3520.html"
                              }
                            ]
                          }
                        },
                        "resource_insights": {
                          "Critical": {
                            "count": 1,
                            "insights": [
                              {
                                "author": "InsightCloudSec",
                                "description": "Identify Compute Instances With a Public IP Address That is Exposing Windows RDP",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 281,
                                "name": "Instance with a Public IP Exposing RDP",
                                "notes": "## Overview\nSecurity groups provide stateful filtering of ingress/egress network traffic to cloud resources. It is recommended that no security group allows unrestricted ingress access to port 3389.\n\nThis Insight identities compute instances with a public IP address and that is exposing Windows RDP.\n\n### Supported Clouds\n**This Insight supports the following clouds:**\n* Amazon Web Services, Amazon Web Services China, Amazon Web Services Government\n* Microsoft Azure\n* Google Cloud Platform\n\n**Supported Infrastructure as Code Clouds:**\n* Amazon Web Services\n* Microsoft Azure\n* Google Cloud Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n\n## Recommended Remediation\nLeverage Bot automation to identify and monitor for compute instances that are exposing RDP via port 3389 and have a public IP address attached.\n### Bot Recommendations\n* Mark Resource Noncompliant: Flag compute instances that have been identified as having RDP exposed and a public IP address attached.\n* Send Email/Instant Notification: Notify operations/security team of the compute instances that are exposing RDP and have a public IP address attached. Separately, using cloud badges, identify cloud account owners and notify them of the non-compliant compute instances and the steps required to disable RDP and/or remove the public IP address.\n\n\n### Remediation Reference Links\nFor more information on Identifying compute instances with a public IP address and that is exposing Windows RDP, follow these links:\n\n**Amazon Web Services**\n\n- https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/authorizing-access-to-an-instance.html\n\n**Microsoft Azure**\n\n - https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview\n\n**Google Cloud Platform**\n\n- https://cloud.google.com/vpc/docs/firewalls\n\n### Compliance Information\n  - NIST 800-53 (Rev 4): AC-17, AC-17(1), AC-6, RA-5, SA-17(7), SC-7, SC-8\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - HIPAA: Access Control - § 164.312(a)(1), No ePHI Should Be Publicly Accessible\n  - SOC 2: CC5.2, CC6.1, CC6.3, CC6.6\n  - PCI DSS Pack: 6.6, 7.1, 7.2, Requirement 1.3\n  - NIST Cybersecurity Framework: DE.CM-7, PR.AC-3, PR.AC-4, PR.AC-5, PR.DS-5\n  - HITRUST v9.4: 0724.07a3Organizational.4, 0814.01n1Organizational.12, 0818.01w3System.12, 0855.01wCMSOrganizational.2, 0856.01wFTIOrganizational.4, 0857.01wHIXOrganizational.1, 11123.01qPCIOrganizational.3, 1114.01h1Organizational.123, 1117.01j1Organizational.23, 1118.01j2Organizational.124, 11192.01cHIXSystem.2, 1164.01cHIESystem.1, 1165.01cPCISystem.1, 1179.01j3Organizational.1, 1403.05i1Organizational.67, 1424.05j2Organizational.5, 1427.05jFTIOrganizational.3, 1802.08b1Organizational.3, 19141.06c1Organizational.7, 19153.06dFTIOrganizational.12, 19910.06cSROrganizational.2\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b, 500.14.a\n  - NIST 800-53 (Rev 5): AC-4, AC-4 (21), AC-6, AC-17, AC-17 (1), AC-21, CM-7, CM-7 (1), SC-7, SC-7 (3), SC-7 (4), SC-7 (5), SC-7 (9), SC-7 (10), SC-7 (11), SC-7 (16), SC-7 (20), SC-7 (21)\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.13.1, 3.13.2\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - Microsoft Cloud Security Benchmark: NS-1, NS-2, NS-3\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                                "severity": "Critical",
                                "source": "core"
                              }
                            ]
                          },
                          "High": {
                            "count": 3,
                            "insights": [
                              {
                                "author": "InsightCloudSec",
                                "description": "Identify instances that have RDP access open to the public",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 166,
                                "name": "Instance Exposing RDP to the Public",
                                "notes": "## Overview\nThe potential security problem with using RDP over the Internet is that attackers can use various brute force techniques to gain access to Azure Virtual Machines. Once the attackers gain access, they can use your virtual machine as a launch point for compromising other machines on your Azure Virtual Network or even attack networked devices outside of Azure.\n\nThis Insight identifies instances that have RDP access open to the public.\n### Supported Clouds\n\n**This Insight supports the following clouds:**\n\n* Alibaba Cloud\n* Amazon Web Services, Amazon Web Services China, Amazon Web Services Gov\n* Microsoft Azure, Microsoft Azure China, Microsoft Azure Gov\n* Google Cloud Platform\n\n\n**This Insight supports the following Infrastructure as Code clouds:**\n\n* Amazon Web Services\n* Microsoft Azure\n* Google Cloud Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n## Recommended Remediation\nDisable RDP access on Network Security Groups from the Internet.\n\n### Bot Recommendations\n*  Mark Resource Noncompliant: Flag Instances with RDP access open to the public.\n* Send Email/Instant Notification: Notify operations/security team of the Instances with RDP open for public access. Separately, using cloud badges, identify cloud account owners and notify them of the steps needed to remove public RDP access by following the CIS manual remediation steps as outlined below.\n\n### CIS Recommended Remediation Steps\n\n**Microsoft Azure**\n\nDisable direct RDP access to your Azure Virtual Machines from the Internet. After direct RDP access from the Internet is disabled, you have other options you can use to access these virtual machines for remote management:\n - [Point-to-site VPN](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal)\n - [Site-to-site VPN](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal)\n - [ExpressRoute](https://docs.microsoft.com/en-us/azure/expressroute/)\n\n### Remediation Reference Links\nFor more information on specific steps to identify and remediate instances that have RDP access open to the public, follow these links:\n\n* Alibaba Cloud - https://www.alibabacloud.com/help/en/doc-detail/96468.html\n\n* Amazon Web Services - https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/authorizing-access-to-an-instance.html\n\n* Microsoft Azure - https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview\n\n* Google Cloud Platform - https://cloud.google.com/compute/docs/instances/access-overview\n\n### Compliance Information\n  - NIST Cybersecurity Framework (Legacy): PR.DS-5\n  - CIS - Azure 1.0.0 (Legacy): Networking 6.1\n  - CIS - Azure 1.1.0: Networking - 6.1 - Ensure that RDP access is restricted from the internet\n  - NIST 800-53 (Rev 4): AC-17, AC-17(1), AC-6, RA-5, SA-17(7), SC-7, SC-8\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - HIPAA: Access Control - § 164.312(a)(1), No ePHI Should Be Publicly Accessible\n  - SOC 2: CC5.2, CC6.1, CC6.3, CC6.6\n  - PCI DSS Pack: 6.6, 7.1, 7.2, Requirement 1.3\n  - NIST Cybersecurity Framework: DE.CM-7, PR.AC-3, PR.AC-4, PR.AC-5, PR.DS-5\n  - HITRUST v9.4: 0724.07a3Organizational.4, 0814.01n1Organizational.12, 0818.01w3System.12, 0855.01wCMSOrganizational.2, 0856.01wFTIOrganizational.4, 0857.01wHIXOrganizational.1, 11123.01qPCIOrganizational.3, 1114.01h1Organizational.123, 1117.01j1Organizational.23, 1118.01j2Organizational.124, 11192.01cHIXSystem.2, 1164.01cHIESystem.1, 1165.01cPCISystem.1, 1179.01j3Organizational.1, 1403.05i1Organizational.67, 1424.05j2Organizational.5, 1427.05jFTIOrganizational.3, 1802.08b1Organizational.3, 19141.06c1Organizational.7, 19153.06dFTIOrganizational.12, 19910.06cSROrganizational.2\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b, 500.14.a\n  - NIST 800-53 (Rev 5): AC-4, AC-4 (21), AC-6, AC-17, AC-17 (1), AC-21, CM-7, CM-7 (1), SC-7, SC-7 (3), SC-7 (4), SC-7 (5), SC-7 (9), SC-7 (10), SC-7 (11), SC-7 (16), SC-7 (20), SC-7 (21)\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.13.1, 3.13.2\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - Microsoft Cloud Security Benchmark: NS-2\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                                "severity": "High",
                                "source": "core"
                              },
                              {
                                "author": "InsightCloudSec",
                                "description": "Identify select resource types on Google Cloud Platform which run on legacy network services which do not contain advanced networking features found in more advanced VPC configurations.",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 389,
                                "name": "Cloud Resource Associated with Legacy Network (GCP)",
                                "notes": "## Overview\nLegacy networks are not recommended. Many newer Google Cloud features are not supported in legacy networks. Instead, use Virtual Private Cloud (VPC) networks. For more information, see the VPC network overview.\n\nLegacy networks have a single RFC 1918 range, which you specify when you create the network. The network is global in scope and spans all cloud regions.\n\nIn a legacy network, instance IP addresses are not grouped by region or zone. One IP address can appear in one region, and the following IP address can be in a different region. Any given range of IPs can be spread across all regions, and the IP addresses of instances created within a region are not necessarily contiguous.\n\n*The IPv4Range field for creating legacy networks is deprecated and will shut down on June 1, 2021. After that date, you won't be able to create legacy networks. However, existing legacy networks won't be affected and will continue to operate normally.*\n\nThis Insight identifies select resource types on Google Cloud Platform which run on legacy network services which do not contain advanced networking features found in more advanced VPC configurations.\n\n### Supported Clouds\n\n**This Insight supports the following clouds:**\n\n* Google Cloud Platform\n\n**This Insight supports the following Infrastructure as Code clouds:**\n\n* Google Cloud Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n\n## Recommended Remediation\nEliminate Google Cloud Platform legacy network services which do not contain advanced networking features found in more advanced VPC configurations.\n\n### Bot Recommendations\n* Mark Resource Noncompliant: Flag Cloud Resources that are associated with a Legacy Network.\n* Send Email/Instant Notification: Notify operations/security team of the Cloud Resources that are associated with a Legacy Network.  Separately, using cloud badges, identify cloud account owners and notify them of the non-compliant cloud resources and the steps required to modify the Cloud Resources that are associated with a Legacy Network.\n\n### Remediation Reference Links\nFor more information on specific steps to identify and remediate select resource types on Google Cloud Platform which run on legacy network services which do not contain advanced networking features found in more advanced VPC configurations, please follow this link:\n\n* Google Cloud Platform - https://cloud.google.com/vpc/docs/using-legacy\n\n### Compliance Information\n  - ISO 27001:2013: A.13.1.1 - Network controls\n  - PCI DSS Pack: Requirement 6\n  - NIST Cybersecurity Framework: PR.IP-2\n  - HITRUST v9.4: 0805.01m1Organizational.12, 0809.01n2Organizational.1234\n  - ACSC Essential 8: ISM Patch Operating Systems\n  - ISO 27001:2022: 8.20: Network security",
                                "severity": "High",
                                "source": "core"
                              },
                              {
                                "author": "InsightCloudSec",
                                "description": "Instance with public IP address and any port exposure to 0.0.0.0/0",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 408,
                                "name": "Instance with Public IP Address and any Port Exposure to 0.0.0.0/0",
                                "notes": "## Overview\nInstances should rarely be exposed to the whole internet on any port. A wide amount of exposure increases the risk of the instance being compromised or used in a non-desirable way.\n\nThis Insight identifies an Instance with public IP address and any port exposure to 0.0.0.0/0.\n### Supported Clouds\n\n**This Insight supports the following clouds:**\n\n* Amazon Web Services, Amazon Web Services China, Amazon Web Services Gov\n* Microsoft Azure, Microsoft Azure China, Microsoft Azure Gov\n* Google Cloud Platform\n\n**This Insight supports the following Infrastructure as Code clouds:**\n\n* Amazon Web Services\n* Microsoft Azure\n* Google Cloud Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n## Recommended Remediation\nEdit the scope of the instance's security group to remove the wide-open network access.\n### Bot Recommendations\n*  Mark Resource Noncompliant: Flag Instances with a public IP address and port exposure to 0.0.0.0/0.\n* Send Email/Instant Notification: Notify operations/security team of the Instances with a public IP address and port exposure to the Internet (0.0.0.0/0). Separately, using cloud badges, identify cloud account owners and notify them of the steps needed to remove port exposure to 0.0.0.0/0 by following the CIS manual remediation steps as outlined below.\n\n\n### CIS Recommended Remediation Steps\n\n**Google Cloud Platform**\n\n**From Console:**\n\n1. Go to the `VM instances` page.\n2. Click on the instance name to go to the `Instance detail page`.\n3. Click `Edit`.\n4. For each Network interface, ensure that `External IP` is set to `None`.\n5. Click `Done` and then click `Save`.\n\n**From Command Line:**\n\n1. Describe the instance properties:\n\n```\ngcloud compute instances describe INSTANCE_NAME --zone=ZONE\n```\n\n2. Identify the access config name that contains the external IP address. This access config appears in the following format:\n\n```\nnetworkInterfaces:\n- accessConfigs:\n - kind: compute#accessConfig\n name: External NAT\n natIP: 130.211.181.55\n type: ONE_TO_ONE_NAT\n```\n\n2. Delete the access config.\n\n```\ngcloud compute instances delete-access-config INSTANCE_NAME --zone=ZONE --access-config-name \"\"ACCESS_CONFIG_NAME\"\"\n```\n\nIn the above example, the `ACCESS_CONFIG_NAME` is `External NAT`. The name of your access config might be different.\n\n**Prevention:**\n\nYou can configure the `Define allowed external IPs for VM instances` Organization Policy to prevent VMs from being configured with public IP addresses. Learn more at: https://console.cloud.google.com/orgpolicies/compute-vmExternalIpAccess\n\n### Remediation Reference Links\n\nFor more information on specific steps to identify and remediate an Instance with public IP address and any port exposure to 0.0.0.0/0, follow these links:\n\n* Amazon Web Services - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/authorizing-access-to-an-instance.html\nhttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html\n\n* Microsoft Azure - https://docs.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses\nhttps://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal\n\n* Google Cloud Platform - https://cloud.google.com/compute/docs/ip-addresses\nhttps://cloud.google.com/vpc/docs/firewalls\n\n### Compliance Information\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - CIS - GCP 1.1.0: Virtual Machines 4.9\n  - HIPAA: Access Control - § 164.312(a)(1), No ePHI Should Be Publicly Accessible\n  - SOC 2: CC5.2, CC6.1, CC6.3, CC6.6\n  - PCI DSS Pack: 6.6, 7.1, 7.2, Requirement 1.3\n  - NIST Cybersecurity Framework: DE.CM-7, PR.AC-3, PR.AC-4, PR.AC-5, PR.DS-5\n  - HITRUST v9.4: 0724.07a3Organizational.4, 0814.01n1Organizational.12, 0818.01w3System.12, 0855.01wCMSOrganizational.2, 0856.01wFTIOrganizational.4, 0857.01wHIXOrganizational.1, 11123.01qPCIOrganizational.3, 1114.01h1Organizational.123, 1117.01j1Organizational.23, 1118.01j2Organizational.124, 11192.01cHIXSystem.2, 1164.01cHIESystem.1, 1165.01cPCISystem.1, 1179.01j3Organizational.1, 1403.05i1Organizational.67, 1424.05j2Organizational.5, 1427.05jFTIOrganizational.3, 1802.08b1Organizational.3, 19141.06c1Organizational.7, 19153.06dFTIOrganizational.12, 19910.06cSROrganizational.2\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b, 500.14.a\n  - NIST 800-53 (Rev 5): CM-7, CM-7 (1)\n  - FFEIC: D3.PC.IM.B.3 All ports are monitored., D3.PC.IM.B.6 Ports, functions, protocols and services are prohibited if no longer needed for business purposes.\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.4.7, 3.13.1, 3.13.2, 3.13.6\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - Microsoft Cloud Security Benchmark: NS-1, NS-2\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1037, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                                "severity": "High",
                                "source": "core"
                              }
                            ]
                          },
                          "Info": {
                            "count": 2,
                            "insights": [
                              {
                                "author": "InsightCloudSec",
                                "description": "Match instances with an ephemeral public IP address",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 4,
                                "name": "Instance Has Ephemeral Public IP",
                                "notes": "## Overview\n\nCompute instances can have static or dynamic (ephemeral) public IP addresses associated with them. Static addresses will remain intact and persist through lifecycle actions such as stop/start. This can be essential when the resource is used for direct connectivity and does not sit behind a load balancer. Ephemeral addresses will commonly change, and can result in a loss of connectivity to the system if it is routinely stopped/started.\n\nFor some workloads such as web servers this may not represent a true problem. These systems are intended to be ephemeral and in many cases should not have a public IP at all. This Insight can be reconfigured to leverage that tagging policy to identify those mission critical systems which should be updated. It is strongly encouraged to leverage a tagging policy to identify scenarios where this is acceptable.\n\n### Remediation\n\nFor production facing/critical workloads which cannot be taken offline, consider attaching an persistent public iP address. This can be done without taking the machine offline. Be aware that when doing this you may need to update DNS to point to the newly reserved IP address.\n\n### Compliance Information\n  - SOC 2 (Legacy): A1.1, C1.2, C1.3, C1.7, CC5.6\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - HIPAA: Access Control - § 164.312(a)(1), Information Access Management - § 164.308(a)(4)\n  - SOC 2: CC6.1, CC6.6\n  - PCI DSS Pack: Requirement 7\n  - NIST Cybersecurity Framework: PR.PT-5\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.13.1, 3.13.2\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                                "severity": "Info",
                                "source": "core"
                              },
                              {
                                "author": "InsightCloudSec",
                                "description": "Identifies compute instances which have an ephemeral/reserved public IP attached",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 536,
                                "name": "Compute Instance With Public IP Attached",
                                "notes": "Overview\n----------\n\nCloud Service Providers (CSPs) provide customers with a way to assign ephemeral or reserved/static public IP addresses to compute instances and the network interfaces that back them for communication over the Internet. As a best practice, it is recommended that customers use these only where necessary, and opt for backend VPC communication and Load Balancers for network communication with the compute instances.\n\n### Reference Links\n\n+ https://docs.aws.amazon.com/vpc/latest/userguide/vpc-eips.html\n\n### Compliance Information\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - HITRUST v9.4: 0724.07a3Organizational.4, 0814.01n1Organizational.12, 0818.01w3System.12, 0855.01wCMSOrganizational.2, 0856.01wFTIOrganizational.4, 0857.01wHIXOrganizational.1, 11123.01qPCIOrganizational.3, 1114.01h1Organizational.123, 1117.01j1Organizational.23, 1118.01j2Organizational.124, 11192.01cHIXSystem.2, 1164.01cHIESystem.1, 1165.01cPCISystem.1, 1179.01j3Organizational.1, 1403.05i1Organizational.67, 1424.05j2Organizational.5, 1427.05jFTIOrganizational.3, 1802.08b1Organizational.3, 19141.06c1Organizational.7, 19153.06dFTIOrganizational.12, 19910.06cSROrganizational.2\n  - AWS Foundational Security Best Practices: EC2.9\n  - CIS - GCP 1.3.0: Virtual Machines 4.9\n  - CMMC Level 1: AC.1.001, AC.1.002, AC.1.003\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b\n  - ACSC Essential 8: ACSC Mitigation Strategies to Prevent Malware Delivery and Execution\n  - FFEIC: D3.PC.Im.B.1 Network perimeter defense tools (e.g., border router and firewall) are used.\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.13.1, 3.13.2\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - CIS - GCP 2.0.0: Virtual Machines 4.9\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                                "severity": "Info",
                                "source": "core"
                              }
                            ]
                          },
                          "Low": {
                            "count": 2,
                            "insights": [
                              {
                                "author": "InsightCloudSec",
                                "description": "Identify resources without the Name, Environment and Owner tag keys",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 87,
                                "name": "Resource Tagging Policy 101",
                                "notes": "## Overview\n\nA resource tagging policy is critical to effective cloud administration.  While you will likely leverage tags for more than just for 'Name', 'Environment' and 'Owner' keys, they should be considered a bare minimum tagging strategy before attempting to scale.  Moreover, an effective tagging policy can be used to stack with other insights, adding context to other insights and bot actions.\n\nThis insight accepts parameters, including a list, 'tag_keys', and the boolean parameter 'match_all'.  For 'tag_keys', the default option mandates that 'Name', 'Owner', and 'Environment' are present, but if you have other tags defined, this insight is appropriate for identifying instances missing those tags.\n\n### Remediation\n\nLeverage bot automation and customize this insight to enforce tags are being applied to instances to conform to your tagging policy.\n\n### Recommended Bot Workflow\n\n- Create Slack / Email Notification: Notify the appropriate parties when tags are not present on instances.\n- Assign Tag to Resource: This action can be used to automatically tag resources that are missing tags, or to assign ephemeral tags to trigger further review.\n- Add To Resource Group: An 'Untagged' Resource Group provides an easy mechanism for reviewing untagged instances.\n- Mark Resource Non-Compliant: If a resource is untagged, and that violates your resource tagging policy, you can mark it as non-compliant.\n\n### Compliance Information\n  - SOC 2 (Legacy): CC6.2\n  - FedRAMP CCM 3.0.1: DSI-01, IVS-08\n  - NIST 800-53 (Rev 4): CM-8(4), CM-8(9) CM-8(2)\n  - ISO 27001:2013: A.8.2.1 - Classification of information, A.8.2.2 - Labelling of information\n  - SOC 2: CC6.1\n  - PCI DSS Pack: Requirement 2.4\n  - NIST Cybersecurity Framework: PR.DS-3\n  - CSA CCM V4: DCS-05, DSP-04, DSP-17\n  - Microsoft Cloud Security Benchmark: DP-1\n  - ISO 27001:2022: 5.12: Classification of information, 5.13: Labeling of information",
                                "severity": "Low",
                                "source": "core"
                              },
                              {
                                "author": "InsightCloudSec",
                                "description": "Identify resources running in locations outside of the Continental United States (OCONUS)",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 96,
                                "name": "Resource Audit Not In Continental US",
                                "notes": "## Overview\n\nEnsuring all cloud resources are within an approved set of regions has a number of benefits.\n\n- Some compliance frameworks require limiting regions to a single country. This insight limits to the Continental United States.\n- Non-standard regions for a company are not frequently monitored. Resources launched in these non-standard regions may incur larger costs if not identified early.\n- Geographic latency may be a primary concern and instances much be located close to their intended network audience.\n\nThe best course of action may be to disable or delete resources after taking an image or snapshot moved to an approved region.\n\n### Supported Clouds\n\nThis Insight supports the following Clouds:\n- ALICLOUD\n- AWS\n- AWS China\n- AWS Gov\n- Microsoft Azure\n- Google\n- Oracle\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n\n### Bot Notification and/or Remediation Workflow\n\n - Create a bot from the insight\n - Refine the bot's selection criteria as needed via scope and/or additional filters\n - Mark those identified resources **Noncompliant** and add an action to notify resource owners based upon resource tags and/or cloud badges\n - Consider **Scheduled Deletion** preceded by backup actions, if available\n - Have the bot run daily or upon resource creation/modification\n\n### Compliance Information\n  - NIST 800-171: 3.3.1\n  - CSA CCM V4: IAM-12",
                                "severity": "Low",
                                "source": "core"
                              }
                            ]
                          },
                          "Medium": {
                            "count": 1,
                            "insights": [
                              {
                                "author": "InsightCloudSec",
                                "description": "Identifies instances that are configured to use the default service account",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 478,
                                "name": "Instance Configured to Use Default Service Account",
                                "notes": "Overview\n----------\n\nIf an attacker compromises a VM using the default Compute Engine service account, the attacker will gain access to its role, which is Editor. The attacker may then escalate privileges and gain access to your entire project.\n\nTo defend against these privilege escalations, we recommend creating a new service account and assigning only the permissions needed by your instance. This approach aligns with the principle of least privilege access.\n\n### Exception\n\nVMs created by GKE should be excluded. These VMs have names that start with gke- and are labeled goog-gke-node.\n\n### Supported Clouds\n\nThis Insight supports the following Clouds:\n - Google Compute Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n\n### Bot Notification and/or Remediation Workflow\n\n - Create a bot from the insight\n - Refine the bot's selection criteria as needed via scope and/or additional filters\n - Mark those identified resources **Noncompliant** and add an action to notify resource owners based upon resource tags and/or cloud badges\n - Have the bot run daily or upon resource creation/modification\n\n### Remediation\n\n***From GCP Console:***\n\n1. Go to the `VM instances` page\n2. Click on the instance name to go to its VM instance details page\n3. Click `Stop` and then click `Edit`\n4. Under the section `Service Account`, select a service account other that the default\nCompute Engine service account. You may first need to create a new service\naccount\n5. Click `Save` and then click `Start`\n\n***From Command Line:***\n\n1. Stop the instance\n```\ngcloud compute instances stop INSTANCE_NAME\n```\n\n2. Update the instance\n```\ngcloud compute instances set-service-account INSTANCE_NAME --service-account=SERVICE_ACCOUNT\n```\n\n3. Restart the instance\n```\ngcloud compute instances start INSTANCE_NAME\n```\n\n### Remediation Reference Links\n\n* [GCP Service accounts](https://cloud.google.com/compute/docs/access/service-accounts)\n\n### Compliance Information\n  - CIS - GCP 1.1.0: Virtual Machines 4.1\n  - SOC 2: CC6.1\n  - PCI DSS Pack: Requirement 7\n  - NIST Cybersecurity Framework: PR.AC-1\n  - HITRUST v9.4: 1107.01b1System.2\n  - CIS - GCP 1.3.0: Virtual Machines 4.1\n  - ACSC Essential 8: ISM Restrict Administrative Privileges\n  - CIS - GCP 2.0.0: Virtual Machines 4.1",
                                "severity": "Medium",
                                "source": "core"
                              }
                            ]
                          }
                        },
                        "threat_findings": {
                          "high": {
                            "count": 1,
                            "threat_findings": [
                              {
                                "name": "Policy:IAMUser/S3BucketSharedExternally",
                                "resource_id": "storagecontainer:1:us-east-1:mledezma-ics-edh-889956758113-ccd299a4:",
                                "severity": "high",
                                "direct_link": "https://docs.aws.amazon.com/macie/latest/user/findings-types.html#findings-policy-types",
                                "affected_resource_id": "storagecontainer:1:us-east-1:mledezma-ics-edh-889956758113-ccd299a4:",
                                "finding_id": "fad37349-115a-4730-ad10-6e73ca72356d",
                                "count": 1,
                                "event_first_seen": "2023-04-30 06:08:42",
                                "event_last_seen": "2023-04-30 06:08:42",
                                "details": {
                                  "accountId": "889956758113",
                                  "archived": false,
                                  "category": "POLICY",
                                  "count": 1,
                                  "createdAt": "2023-04-30 06:08:42.895000+00:00",
                                  "description": "The access control list (ACL) or bucket policy for the Amazon S3 bucket allows the bucket to be shared with an AWS account that isn\u2019t part of your Amazon Macie organization.",
                                  "id": "fad37349-115a-4730-ad10-6e73ca72356d",
                                  "partition": "aws",
                                  "policyDetails": {
                                    "action": {
                                      "actionType": "AWS_API_CALL",
                                      "apiCallDetails": {
                                        "api": "PutBucketPolicy",
                                        "apiServiceName": "s3.amazonaws.com",
                                        "firstSeen": "2023-04-30 06:05:27+00:00",
                                        "lastSeen": "2023-04-30 06:05:27+00:00"
                                      }
                                    },
                                    "actor": {
                                      "ipAddressDetails": {
                                        "ipAddressV4": "208.118.227.19",
                                        "ipCity": {
                                          "name": "Boston"
                                        },
                                        "ipCountry": {
                                          "code": "US",
                                          "name": "United States"
                                        },
                                        "ipGeoLocation": {
                                          "lat": 42.364,
                                          "lon": -71.0265
                                        },
                                        "ipOwner": {
                                          "asn": "27552",
                                          "asnOrg": "TWDX",
                                          "isp": "TowardEX Technologies International",
                                          "org": "TowardEX Technologies International"
                                        }
                                      },
                                      "userIdentity": {
                                        "assumedRole": {
                                          "accessKeyId": "ASIA46NMOOJQ462N2CM2",
                                          "accountId": "889956758113",
                                          "arn": "arn:aws:sts::889956758113:assumed-role/developer/mbelostoky@rapid7.com",
                                          "principalId": "AROA46NMOOJQRDNDBSNI3:mbelostoky@rapid7.com",
                                          "sessionContext": {
                                            "attributes": {
                                              "creationDate": "2023-04-30 05:47:59+00:00",
                                              "mfaAuthenticated": false
                                            },
                                            "sessionIssuer": {
                                              "accountId": "889956758113",
                                              "arn": "arn:aws:iam::889956758113:role/assumable/developer",
                                              "principalId": "AROA46NMOOJQRDNDBSNI3",
                                              "type": "Role",
                                              "userName": "developer"
                                            }
                                          }
                                        },
                                        "type": "AssumedRole"
                                      }
                                    }
                                  },
                                  "region": "us-east-1",
                                  "resourcesAffected": {
                                    "s3Bucket": {
                                      "allowsUnencryptedObjectUploads": "TRUE",
                                      "arn": "arn:aws:s3:::mledezma-ics-edh-889956758113-ccd299a4",
                                      "createdAt": "2023-04-17 20:31:27+00:00",
                                      "defaultServerSideEncryption": {
                                        "encryptionType": "AES256"
                                      },
                                      "name": "mledezma-ics-edh-889956758113-ccd299a4",
                                      "owner": {
                                        "displayName": "amazon+divvycloud-dev",
                                        "id": "aebb57892f65291629ac4408d76d7fb2855a365a1237d26f5fc561a646f4c533"
                                      },
                                      "publicAccess": {
                                        "effectivePermission": "NOT_PUBLIC",
                                        "permissionConfiguration": {
                                          "accountLevelPermissions": {
                                            "blockPublicAccess": {
                                              "blockPublicAcls": true,
                                              "blockPublicPolicy": true,
                                              "ignorePublicAcls": true,
                                              "restrictPublicBuckets": true
                                            }
                                          },
                                          "bucketLevelPermissions": {
                                            "accessControlList": {
                                              "allowsPublicReadAccess": false,
                                              "allowsPublicWriteAccess": false
                                            },
                                            "blockPublicAccess": {
                                              "blockPublicAcls": true,
                                              "blockPublicPolicy": true,
                                              "ignorePublicAcls": true,
                                              "restrictPublicBuckets": true
                                            },
                                            "bucketPolicy": {
                                              "allowsPublicReadAccess": false,
                                              "allowsPublicWriteAccess": false
                                            }
                                          }
                                        }
                                      },
                                      "tags": [
                                        
                                      ]
                                    }
                                  },
                                  "sample": false,
                                  "schemaVersion": "1.0",
                                  "severity": {
                                    "description": "High",
                                    "score": 3
                                  },
                                  "title": "The S3 bucket is shared with an external AWS account.",
                                  "type": "Policy:IAMUser/S3BucketSharedExternally",
                                  "updatedAt": "2023-04-30 06:08:42.895000+00:00"
                                },
                                "finding_source": "AWS Macie"
                              }
                            ]
                          }
                        },
                        "application_context": [
                          {
                            "app": {
                              "accounts": 1,
                              "application": "ICS QA Team",
                              "block_storage_gb": 0,
                              "business_critical": false,
                              "category": "other",
                              "clouds": [
                                "AZURE_ARM"
                              ],
                              "cores": 0,
                              "is_favourite": false,
                              "name": null,
                              "object_storage_bytes": 0,
                              "poc": null,
                              "resource_count": 3
                            },
                            "tags": {
                              "Application": {
                                "value": "ICS Selenium Automation",
                                "user_defiened": true
                              },
                              "Owner": {
                                "value": "ICS QA Team",
                                "user_defiened": true
                              }
                            }
                          }
                        ],
                        "permissions": [
                          {
                            "action": "compute.snapshots.getIamPolicy",
                            "count": 1,
                            "last_executed_date": "2023-05-31 17:39:07.217902",
                            "permission": "compute.snapshots.getIamPolicy",
                            "status": "Used"
                          },
                          {
                            "action": "monitoring.dashboards.get",
                            "count": 1,
                            "last_executed_date": "2023-05-31 17:39:07.217902",
                            "permission": "monitoring.dashboards.get",
                            "status": "Used"
                          },
                          {
                            "action": "cloudbuild.builds.list",
                            "count": 1,
                            "last_executed_date": "2023-05-31 17:39:07.217902",
                            "permission": "cloudbuild.builds.list",
                            "status": "Used"
                          },
                          {
                            "permission": "gkeonprem.bareMetalAdminClusters.setIamPolicy",
                            "status": "Unused"
                          },
                          {
                            "permission": "networkconnectivity.spokes.create",
                            "status": "Unused"
                          },
                          {
                            "permission": "pubsublite.operations.get",
                            "status": "Unused"
                          },
                          {
                            "permission": "essentialcontacts.contacts.create",
                            "status": "Unused"
                          },
                          {
                            "permission": "eventarc.googleChannelConfigs.get",
                            "status": "Unused"
                          }
                        ],
                        "related_resources": [
                          {
                            "cloud_type_id": "GCE",
                            "id": "ja-gcp-hva.nic0",
                            "info": {
                              "description_template": "{source} has network interface {target}",
                              "extra_info": {
                                
                              },
                              "label": "HAS_NETWORK_INTERFACE",
                              "other_resource_type": "networkinterface",
                              "resource_type": "instance",
                              "source": true,
                              "source_or_target": "source"
                            },
                            "name": "nic0",
                            "resource_id": "networkinterface:6:europe-west1:ja-gcp-hva.nic0:",
                            "type": "networkinterface"
                          },
                          {
                            "cloud_type_id": "GCE",
                            "id": "15354827186006192505",
                            "info": {
                              "description_template": "{source} contains instance {target}",
                              "extra_info": {
                                
                              },
                              "label": "CONTAINS_INSTANCE",
                              "other_resource_type": "privatenetwork",
                              "resource_type": "instance",
                              "source": false,
                              "source_or_target": "target"
                            },
                            "name": "default",
                            "resource_id": "privatenetwork:6::15354827186006192505:",
                            "type": "privatenetwork"
                          },
                          {
                            "cloud_type_id": "GCE",
                            "id": "110744443020505229478",
                            "info": {
                              "description_template": "{source} has role {target}",
                              "extra_info": {
                                
                              },
                              "label": "HAS_ROLE",
                              "other_resource_type": "servicerole",
                              "resource_type": "instance",
                              "source": true,
                              "source_or_target": "source"
                            },
                            "name": "317115057204@project.gserviceaccount.com",
                            "resource_id": "servicerole:6:110744443020505229478:",
                            "type": "servicerole"
                          },
                          {
                            "cloud_type_id": "GCE",
                            "id": "ja-gcp-hva",
                            "info": {
                              "description_template": "{source} has volume {target}",
                              "extra_info": {
                                
                              },
                              "label": "HAS_VOLUME",
                              "other_resource_type": "volume",
                              "resource_type": "instance",
                              "source": true,
                              "source_or_target": "source"
                            },
                            "name": "ja-gcp-hva",
                            "resource_id": "volume:6:europe-west1:ja-gcp-hva:",
                            "type": "volume"
                          },
                          {
                            "id": "3537706110417665757",
                            "name": "test-blocked-rdp",
                            "resource_id": "resourceaccesslist:6::3537706110417665757:",
                            "type": "resourceaccesslist"
                          },
                          {
                            "id": "5121977450226834962",
                            "name": "test-deny",
                            "resource_id": "resourceaccesslist:6::5121977450226834962:",
                            "type": "resourceaccesslist"
                          },
                          {
                            "id": "8519192485236936413",
                            "name": "r7-vpn-allow-ssh",
                            "resource_id": "resourceaccesslist:6::8519192485236936413:",
                            "type": "resourceaccesslist"
                          }
                        ],
                        "attack_path": {
                          "High": {
                            "count": 1,
                            "paths": [
                              {
                                "author": "rapid7",
                                "category_description": "This attack path definition looks for any publicly-available instances and checks to see if any of them have a high/critical vulnerability severity. This can lead to the instance being exploited, so it should be treated as high priority.",
                                "category_id": "apa.publicly_high_vuln_sev_esc",
                                "category_impact": "An attacker may be able to access the instance via the internet and exploit the vulnerability to execute code.",
                                "category_labels": [
                                  "Compute Abuse"
                                ],
                                "category_name": "Publicly Exposed Compute Instance with High/Critical vulnerabilities",
                                "category_remediation": "1. Click on the instance node for the attack path to view details about the node.\n2. Find the vulnerabilities tab to see vulnerabilites.\n3. From there you can find out where the vuln scan came from ie Inspector, IVM, HVA.\n4. Refer to the originating scanner's content for instructions to remediate.\n",
                                "discovered_timestamp": "2024-05-21T18:08:05",
                                "id": 93800,
                                "path_length": 7,
                                "risk_score": 800.0,
                                "severity": "High",
                                "source_resource_id": "internet:internet",
                                "source_resource_name": "Internet",
                                "source_resource_type": "internet",
                                "target_account_id": "014578312761",
                                "target_account_name": "AWS-SSE",
                                "target_account_type": "AWS",
                                "target_application_id": null,
                                "target_application_name": null,
                                "target_organization_service_id": 1496,
                                "target_resource_id": "instance:1496:ap-southeast-2:i-05b3dbcd997404213:",
                                "target_resource_name": "k8-master",
                                "target_resource_type": "instance"
                              }
                            ]
                          }
                        },
                        "errors": [
                          
                        ]
                      },
                      "i-0053b891b939e3472": {
                        "resource_details": {
                          "dependencies": {
                            "networkinterface": [
                              {
                                "id": "ja-gcp-hva.nic0",
                                "name": "nic0",
                                "resource_id": "networkinterface:6:europe-west1:ja-gcp-hva.nic0:",
                                "type": "networkinterface"
                              }
                            ],
                            "privatenetwork": [
                              {
                                "id": "15354827186006192505",
                                "name": "default",
                                "resource_id": "privatenetwork:6::15354827186006192505:",
                                "type": "privatenetwork"
                              }
                            ],
                            "resourceaccesslist": [
                              {
                                "id": "3537706110417665757",
                                "name": "test-blocked-rdp",
                                "resource_id": "resourceaccesslist:6::3537706110417665757:",
                                "type": "resourceaccesslist"
                              },
                              {
                                "id": "5121977450226834962",
                                "name": "test-deny",
                                "resource_id": "resourceaccesslist:6::5121977450226834962:",
                                "type": "resourceaccesslist"
                              },
                              {
                                "id": "8519192485236936413",
                                "name": "r7-vpn-allow-ssh",
                                "resource_id": "resourceaccesslist:6::8519192485236936413:",
                                "type": "resourceaccesslist"
                              }
                            ],
                            "servicerole": [
                              {
                                "id": "110744443020505229478",
                                "name": "317115057204@project.gserviceaccount.com",
                                "resource_id": "servicerole:6:110744443020505229478:",
                                "type": "servicerole"
                              }
                            ],
                            "volume": [
                              {
                                "id": "ja-gcp-hva",
                                "name": "ja-gcp-hva",
                                "resource_id": "volume:6:europe-west1:ja-gcp-hva:",
                                "type": "volume"
                              }
                            ]
                          },
                          "details": {
                            "instance": {
                              "common": {
                                "account": "GCP",
                                "account_id": "divvy-development",
                                "account_status": "REFRESH",
                                "auto_id": 105,
                                "availability_zone": "europe-west1-b",
                                "cloud": "GCE",
                                "creation_timestamp": "2023-03-29 10:09:12",
                                "direct_link": "https://console.cloud.google.com/compute/instancesDetail/zones/europe-west1-b/instances/ja-gcp-hva?project=divvy-development",
                                "discovered_timestamp": "2023-04-03 09:26:38",
                                "last_harvested_timestamp": "2023-06-11T07:19:12",
                                "modified_timestamp": "2023-04-04 16:35:52",
                                "noncompliance": [
                                  
                                ],
                                "organization_service_id": 6,
                                "properties": {
                                  "property_list": [
                                    {
                                      "name": "divvy.default_service_account",
                                      "parent_resource_id": "instance:6:europe-west1:ja-gcp-hva:",
                                      "type_hint": "bool",
                                      "value": "1"
                                    },
                                    {
                                      "name": "divvy.full_access_scope",
                                      "parent_resource_id": "instance:6:europe-west1:ja-gcp-hva:",
                                      "type_hint": "bool",
                                      "value": "0"
                                    }
                                  ]
                                },
                                "provider_id": "ja-gcp-hva",
                                "region": "europe-west1",
                                "resource_id": "instance:6:europe-west1:ja-gcp-hva:",
                                "resource_name": "ja-gcp-hva",
                                "resource_type": "instance",
                                "tags": {
                                  "ja": "hva"
                                }
                              },
                              "create_time": "2023-03-29 10:09:12",
                              "image_id": "7157337275614620995",
                              "instance_id": "ja-gcp-hva",
                              "instance_type": "e2-micro",
                              "launch_time": "2023-03-29 10:09:21",
                              "network_interfaces": [
                                {
                                  "common": {
                                    "account": "GCP",
                                    "account_id": "divvy-development",
                                    "account_status": "REFRESH",
                                    "auto_id": 138,
                                    "cloud": "GCE",
                                    "creation_timestamp": "None",
                                    "discovered_timestamp": "2023-04-03 09:26:38",
                                    "modified_timestamp": "2023-04-03 09:26:38",
                                    "organization_service_id": 6,
                                    "provider_id": "ja-gcp-hva.nic0",
                                    "region": "europe-west1",
                                    "resource_id": "networkinterface:6:europe-west1:ja-gcp-hva.nic0:",
                                    "resource_name": "nic0",
                                    "resource_type": "networkinterface",
                                    "tags": {
                                      "ja": "hva"
                                    }
                                  },
                                  "device_index": 0,
                                  "instance_id": "ja-gcp-hva",
                                  "instance_resource_id": "instance:6:europe-west1:ja-gcp-hva:",
                                  "ip_addresses": [
                                    {
                                      "ip_address": "35.233.43.175",
                                      "ip_address_type": "Ipv4PublicAddress"
                                    },
                                    {
                                      "ip_address": "10.240.0.3",
                                      "ip_address_type": "Ipv4PrivateAddress"
                                    }
                                  ],
                                  "network_interface_id": "ja-gcp-hva.nic0",
                                  "network_resource_id": "privatenetwork:6::15354827186006192505:",
                                  "private_ip_address": "10.240.0.3"
                                }
                              ],
                              "network_resource_id": "privatenetwork:6::15354827186006192505:",
                              "object_id": "7800351496809853097",
                              "platform": "linux",
                              "private_ip_address": "10.240.0.3",
                              "public_ip_address": "35.233.43.175",
                              "role_resource_id": "servicerole:6:110744443020505229478:",
                              "state": "running",
                              "termination_protection": false,
                              "vulnerability_sources": [
                                
                              ]
                            },
                            "resource_type": "instance"
                          }
                        },
                        "vulnerabilities": {
                          "CRITICAL": {
                            "count": 2,
                            "vulnerabilities": [
                              {
                                "cvss_score": 9.8,
                                "description": "CVE-2023-5178 - linux",
                                "name": "CVE-2023-5178",
                                "package": "",
                                "severity": "CRITICAL",
                                "source": "inspectorv2",
                                "uri": "https://security-tracker.debian.org/tracker/CVE-2023-5178"
                              },
                              {
                                "cvss_score": 7.8,
                                "description": "CVE-2022-3520 - vim, xxd and 1 more",
                                "name": "CVE-2022-3520",
                                "package": "",
                                "severity": "CRITICAL",
                                "source": "inspectorv2",
                                "uri": "https://people.canonical.com/~ubuntu-security/cve/2022/CVE-2022-3520.html"
                              }
                            ]
                          }
                        },
                        "resource_insights": {
                          "Critical": {
                            "count": 1,
                            "insights": [
                              {
                                "author": "InsightCloudSec",
                                "description": "Identify Compute Instances With a Public IP Address That is Exposing Windows RDP",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 281,
                                "name": "Instance with a Public IP Exposing RDP",
                                "notes": "## Overview\nSecurity groups provide stateful filtering of ingress/egress network traffic to cloud resources. It is recommended that no security group allows unrestricted ingress access to port 3389.\n\nThis Insight identities compute instances with a public IP address and that is exposing Windows RDP.\n\n### Supported Clouds\n**This Insight supports the following clouds:**\n* Amazon Web Services, Amazon Web Services China, Amazon Web Services Government\n* Microsoft Azure\n* Google Cloud Platform\n\n**Supported Infrastructure as Code Clouds:**\n* Amazon Web Services\n* Microsoft Azure\n* Google Cloud Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n\n## Recommended Remediation\nLeverage Bot automation to identify and monitor for compute instances that are exposing RDP via port 3389 and have a public IP address attached.\n### Bot Recommendations\n* Mark Resource Noncompliant: Flag compute instances that have been identified as having RDP exposed and a public IP address attached.\n* Send Email/Instant Notification: Notify operations/security team of the compute instances that are exposing RDP and have a public IP address attached. Separately, using cloud badges, identify cloud account owners and notify them of the non-compliant compute instances and the steps required to disable RDP and/or remove the public IP address.\n\n\n### Remediation Reference Links\nFor more information on Identifying compute instances with a public IP address and that is exposing Windows RDP, follow these links:\n\n**Amazon Web Services**\n\n- https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/authorizing-access-to-an-instance.html\n\n**Microsoft Azure**\n\n - https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview\n\n**Google Cloud Platform**\n\n- https://cloud.google.com/vpc/docs/firewalls\n\n### Compliance Information\n  - NIST 800-53 (Rev 4): AC-17, AC-17(1), AC-6, RA-5, SA-17(7), SC-7, SC-8\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - HIPAA: Access Control - § 164.312(a)(1), No ePHI Should Be Publicly Accessible\n  - SOC 2: CC5.2, CC6.1, CC6.3, CC6.6\n  - PCI DSS Pack: 6.6, 7.1, 7.2, Requirement 1.3\n  - NIST Cybersecurity Framework: DE.CM-7, PR.AC-3, PR.AC-4, PR.AC-5, PR.DS-5\n  - HITRUST v9.4: 0724.07a3Organizational.4, 0814.01n1Organizational.12, 0818.01w3System.12, 0855.01wCMSOrganizational.2, 0856.01wFTIOrganizational.4, 0857.01wHIXOrganizational.1, 11123.01qPCIOrganizational.3, 1114.01h1Organizational.123, 1117.01j1Organizational.23, 1118.01j2Organizational.124, 11192.01cHIXSystem.2, 1164.01cHIESystem.1, 1165.01cPCISystem.1, 1179.01j3Organizational.1, 1403.05i1Organizational.67, 1424.05j2Organizational.5, 1427.05jFTIOrganizational.3, 1802.08b1Organizational.3, 19141.06c1Organizational.7, 19153.06dFTIOrganizational.12, 19910.06cSROrganizational.2\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b, 500.14.a\n  - NIST 800-53 (Rev 5): AC-4, AC-4 (21), AC-6, AC-17, AC-17 (1), AC-21, CM-7, CM-7 (1), SC-7, SC-7 (3), SC-7 (4), SC-7 (5), SC-7 (9), SC-7 (10), SC-7 (11), SC-7 (16), SC-7 (20), SC-7 (21)\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.13.1, 3.13.2\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - Microsoft Cloud Security Benchmark: NS-1, NS-2, NS-3\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                                "severity": "Critical",
                                "source": "core"
                              }
                            ]
                          },
                          "High": {
                            "count": 3,
                            "insights": [
                              {
                                "author": "InsightCloudSec",
                                "description": "Identify instances that have RDP access open to the public",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 166,
                                "name": "Instance Exposing RDP to the Public",
                                "notes": "## Overview\nThe potential security problem with using RDP over the Internet is that attackers can use various brute force techniques to gain access to Azure Virtual Machines. Once the attackers gain access, they can use your virtual machine as a launch point for compromising other machines on your Azure Virtual Network or even attack networked devices outside of Azure.\n\nThis Insight identifies instances that have RDP access open to the public.\n### Supported Clouds\n\n**This Insight supports the following clouds:**\n\n* Alibaba Cloud\n* Amazon Web Services, Amazon Web Services China, Amazon Web Services Gov\n* Microsoft Azure, Microsoft Azure China, Microsoft Azure Gov\n* Google Cloud Platform\n\n\n**This Insight supports the following Infrastructure as Code clouds:**\n\n* Amazon Web Services\n* Microsoft Azure\n* Google Cloud Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n## Recommended Remediation\nDisable RDP access on Network Security Groups from the Internet.\n\n### Bot Recommendations\n*  Mark Resource Noncompliant: Flag Instances with RDP access open to the public.\n* Send Email/Instant Notification: Notify operations/security team of the Instances with RDP open for public access. Separately, using cloud badges, identify cloud account owners and notify them of the steps needed to remove public RDP access by following the CIS manual remediation steps as outlined below.\n\n### CIS Recommended Remediation Steps\n\n**Microsoft Azure**\n\nDisable direct RDP access to your Azure Virtual Machines from the Internet. After direct RDP access from the Internet is disabled, you have other options you can use to access these virtual machines for remote management:\n - [Point-to-site VPN](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal)\n - [Site-to-site VPN](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal)\n - [ExpressRoute](https://docs.microsoft.com/en-us/azure/expressroute/)\n\n### Remediation Reference Links\nFor more information on specific steps to identify and remediate instances that have RDP access open to the public, follow these links:\n\n* Alibaba Cloud - https://www.alibabacloud.com/help/en/doc-detail/96468.html\n\n* Amazon Web Services - https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/authorizing-access-to-an-instance.html\n\n* Microsoft Azure - https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview\n\n* Google Cloud Platform - https://cloud.google.com/compute/docs/instances/access-overview\n\n### Compliance Information\n  - NIST Cybersecurity Framework (Legacy): PR.DS-5\n  - CIS - Azure 1.0.0 (Legacy): Networking 6.1\n  - CIS - Azure 1.1.0: Networking - 6.1 - Ensure that RDP access is restricted from the internet\n  - NIST 800-53 (Rev 4): AC-17, AC-17(1), AC-6, RA-5, SA-17(7), SC-7, SC-8\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - HIPAA: Access Control - § 164.312(a)(1), No ePHI Should Be Publicly Accessible\n  - SOC 2: CC5.2, CC6.1, CC6.3, CC6.6\n  - PCI DSS Pack: 6.6, 7.1, 7.2, Requirement 1.3\n  - NIST Cybersecurity Framework: DE.CM-7, PR.AC-3, PR.AC-4, PR.AC-5, PR.DS-5\n  - HITRUST v9.4: 0724.07a3Organizational.4, 0814.01n1Organizational.12, 0818.01w3System.12, 0855.01wCMSOrganizational.2, 0856.01wFTIOrganizational.4, 0857.01wHIXOrganizational.1, 11123.01qPCIOrganizational.3, 1114.01h1Organizational.123, 1117.01j1Organizational.23, 1118.01j2Organizational.124, 11192.01cHIXSystem.2, 1164.01cHIESystem.1, 1165.01cPCISystem.1, 1179.01j3Organizational.1, 1403.05i1Organizational.67, 1424.05j2Organizational.5, 1427.05jFTIOrganizational.3, 1802.08b1Organizational.3, 19141.06c1Organizational.7, 19153.06dFTIOrganizational.12, 19910.06cSROrganizational.2\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b, 500.14.a\n  - NIST 800-53 (Rev 5): AC-4, AC-4 (21), AC-6, AC-17, AC-17 (1), AC-21, CM-7, CM-7 (1), SC-7, SC-7 (3), SC-7 (4), SC-7 (5), SC-7 (9), SC-7 (10), SC-7 (11), SC-7 (16), SC-7 (20), SC-7 (21)\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.13.1, 3.13.2\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - Microsoft Cloud Security Benchmark: NS-2\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                                "severity": "High",
                                "source": "core"
                              },
                              {
                                "author": "InsightCloudSec",
                                "description": "Identify select resource types on Google Cloud Platform which run on legacy network services which do not contain advanced networking features found in more advanced VPC configurations.",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 389,
                                "name": "Cloud Resource Associated with Legacy Network (GCP)",
                                "notes": "## Overview\nLegacy networks are not recommended. Many newer Google Cloud features are not supported in legacy networks. Instead, use Virtual Private Cloud (VPC) networks. For more information, see the VPC network overview.\n\nLegacy networks have a single RFC 1918 range, which you specify when you create the network. The network is global in scope and spans all cloud regions.\n\nIn a legacy network, instance IP addresses are not grouped by region or zone. One IP address can appear in one region, and the following IP address can be in a different region. Any given range of IPs can be spread across all regions, and the IP addresses of instances created within a region are not necessarily contiguous.\n\n*The IPv4Range field for creating legacy networks is deprecated and will shut down on June 1, 2021. After that date, you won't be able to create legacy networks. However, existing legacy networks won't be affected and will continue to operate normally.*\n\nThis Insight identifies select resource types on Google Cloud Platform which run on legacy network services which do not contain advanced networking features found in more advanced VPC configurations.\n\n### Supported Clouds\n\n**This Insight supports the following clouds:**\n\n* Google Cloud Platform\n\n**This Insight supports the following Infrastructure as Code clouds:**\n\n* Google Cloud Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n\n## Recommended Remediation\nEliminate Google Cloud Platform legacy network services which do not contain advanced networking features found in more advanced VPC configurations.\n\n### Bot Recommendations\n* Mark Resource Noncompliant: Flag Cloud Resources that are associated with a Legacy Network.\n* Send Email/Instant Notification: Notify operations/security team of the Cloud Resources that are associated with a Legacy Network.  Separately, using cloud badges, identify cloud account owners and notify them of the non-compliant cloud resources and the steps required to modify the Cloud Resources that are associated with a Legacy Network.\n\n### Remediation Reference Links\nFor more information on specific steps to identify and remediate select resource types on Google Cloud Platform which run on legacy network services which do not contain advanced networking features found in more advanced VPC configurations, please follow this link:\n\n* Google Cloud Platform - https://cloud.google.com/vpc/docs/using-legacy\n\n### Compliance Information\n  - ISO 27001:2013: A.13.1.1 - Network controls\n  - PCI DSS Pack: Requirement 6\n  - NIST Cybersecurity Framework: PR.IP-2\n  - HITRUST v9.4: 0805.01m1Organizational.12, 0809.01n2Organizational.1234\n  - ACSC Essential 8: ISM Patch Operating Systems\n  - ISO 27001:2022: 8.20: Network security",
                                "severity": "High",
                                "source": "core"
                              },
                              {
                                "author": "InsightCloudSec",
                                "description": "Instance with public IP address and any port exposure to 0.0.0.0/0",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 408,
                                "name": "Instance with Public IP Address and any Port Exposure to 0.0.0.0/0",
                                "notes": "## Overview\nInstances should rarely be exposed to the whole internet on any port. A wide amount of exposure increases the risk of the instance being compromised or used in a non-desirable way.\n\nThis Insight identifies an Instance with public IP address and any port exposure to 0.0.0.0/0.\n### Supported Clouds\n\n**This Insight supports the following clouds:**\n\n* Amazon Web Services, Amazon Web Services China, Amazon Web Services Gov\n* Microsoft Azure, Microsoft Azure China, Microsoft Azure Gov\n* Google Cloud Platform\n\n**This Insight supports the following Infrastructure as Code clouds:**\n\n* Amazon Web Services\n* Microsoft Azure\n* Google Cloud Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n## Recommended Remediation\nEdit the scope of the instance's security group to remove the wide-open network access.\n### Bot Recommendations\n*  Mark Resource Noncompliant: Flag Instances with a public IP address and port exposure to 0.0.0.0/0.\n* Send Email/Instant Notification: Notify operations/security team of the Instances with a public IP address and port exposure to the Internet (0.0.0.0/0). Separately, using cloud badges, identify cloud account owners and notify them of the steps needed to remove port exposure to 0.0.0.0/0 by following the CIS manual remediation steps as outlined below.\n\n\n### CIS Recommended Remediation Steps\n\n**Google Cloud Platform**\n\n**From Console:**\n\n1. Go to the `VM instances` page.\n2. Click on the instance name to go to the `Instance detail page`.\n3. Click `Edit`.\n4. For each Network interface, ensure that `External IP` is set to `None`.\n5. Click `Done` and then click `Save`.\n\n**From Command Line:**\n\n1. Describe the instance properties:\n\n```\ngcloud compute instances describe INSTANCE_NAME --zone=ZONE\n```\n\n2. Identify the access config name that contains the external IP address. This access config appears in the following format:\n\n```\nnetworkInterfaces:\n- accessConfigs:\n - kind: compute#accessConfig\n name: External NAT\n natIP: 130.211.181.55\n type: ONE_TO_ONE_NAT\n```\n\n2. Delete the access config.\n\n```\ngcloud compute instances delete-access-config INSTANCE_NAME --zone=ZONE --access-config-name \"\"ACCESS_CONFIG_NAME\"\"\n```\n\nIn the above example, the `ACCESS_CONFIG_NAME` is `External NAT`. The name of your access config might be different.\n\n**Prevention:**\n\nYou can configure the `Define allowed external IPs for VM instances` Organization Policy to prevent VMs from being configured with public IP addresses. Learn more at: https://console.cloud.google.com/orgpolicies/compute-vmExternalIpAccess\n\n### Remediation Reference Links\n\nFor more information on specific steps to identify and remediate an Instance with public IP address and any port exposure to 0.0.0.0/0, follow these links:\n\n* Amazon Web Services - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/authorizing-access-to-an-instance.html\nhttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html\n\n* Microsoft Azure - https://docs.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses\nhttps://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal\n\n* Google Cloud Platform - https://cloud.google.com/compute/docs/ip-addresses\nhttps://cloud.google.com/vpc/docs/firewalls\n\n### Compliance Information\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - CIS - GCP 1.1.0: Virtual Machines 4.9\n  - HIPAA: Access Control - § 164.312(a)(1), No ePHI Should Be Publicly Accessible\n  - SOC 2: CC5.2, CC6.1, CC6.3, CC6.6\n  - PCI DSS Pack: 6.6, 7.1, 7.2, Requirement 1.3\n  - NIST Cybersecurity Framework: DE.CM-7, PR.AC-3, PR.AC-4, PR.AC-5, PR.DS-5\n  - HITRUST v9.4: 0724.07a3Organizational.4, 0814.01n1Organizational.12, 0818.01w3System.12, 0855.01wCMSOrganizational.2, 0856.01wFTIOrganizational.4, 0857.01wHIXOrganizational.1, 11123.01qPCIOrganizational.3, 1114.01h1Organizational.123, 1117.01j1Organizational.23, 1118.01j2Organizational.124, 11192.01cHIXSystem.2, 1164.01cHIESystem.1, 1165.01cPCISystem.1, 1179.01j3Organizational.1, 1403.05i1Organizational.67, 1424.05j2Organizational.5, 1427.05jFTIOrganizational.3, 1802.08b1Organizational.3, 19141.06c1Organizational.7, 19153.06dFTIOrganizational.12, 19910.06cSROrganizational.2\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b, 500.14.a\n  - NIST 800-53 (Rev 5): CM-7, CM-7 (1)\n  - FFEIC: D3.PC.IM.B.3 All ports are monitored., D3.PC.IM.B.6 Ports, functions, protocols and services are prohibited if no longer needed for business purposes.\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.4.7, 3.13.1, 3.13.2, 3.13.6\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - Microsoft Cloud Security Benchmark: NS-1, NS-2\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1037, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                                "severity": "High",
                                "source": "core"
                              }
                            ]
                          },
                          "Info": {
                            "count": 2,
                            "insights": [
                              {
                                "author": "InsightCloudSec",
                                "description": "Match instances with an ephemeral public IP address",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 4,
                                "name": "Instance Has Ephemeral Public IP",
                                "notes": "## Overview\n\nCompute instances can have static or dynamic (ephemeral) public IP addresses associated with them. Static addresses will remain intact and persist through lifecycle actions such as stop/start. This can be essential when the resource is used for direct connectivity and does not sit behind a load balancer. Ephemeral addresses will commonly change, and can result in a loss of connectivity to the system if it is routinely stopped/started.\n\nFor some workloads such as web servers this may not represent a true problem. These systems are intended to be ephemeral and in many cases should not have a public IP at all. This Insight can be reconfigured to leverage that tagging policy to identify those mission critical systems which should be updated. It is strongly encouraged to leverage a tagging policy to identify scenarios where this is acceptable.\n\n### Remediation\n\nFor production facing/critical workloads which cannot be taken offline, consider attaching an persistent public iP address. This can be done without taking the machine offline. Be aware that when doing this you may need to update DNS to point to the newly reserved IP address.\n\n### Compliance Information\n  - SOC 2 (Legacy): A1.1, C1.2, C1.3, C1.7, CC5.6\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - HIPAA: Access Control - § 164.312(a)(1), Information Access Management - § 164.308(a)(4)\n  - SOC 2: CC6.1, CC6.6\n  - PCI DSS Pack: Requirement 7\n  - NIST Cybersecurity Framework: PR.PT-5\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.13.1, 3.13.2\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                                "severity": "Info",
                                "source": "core"
                              },
                              {
                                "author": "InsightCloudSec",
                                "description": "Identifies compute instances which have an ephemeral/reserved public IP attached",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 536,
                                "name": "Compute Instance With Public IP Attached",
                                "notes": "Overview\n----------\n\nCloud Service Providers (CSPs) provide customers with a way to assign ephemeral or reserved/static public IP addresses to compute instances and the network interfaces that back them for communication over the Internet. As a best practice, it is recommended that customers use these only where necessary, and opt for backend VPC communication and Load Balancers for network communication with the compute instances.\n\n### Reference Links\n\n+ https://docs.aws.amazon.com/vpc/latest/userguide/vpc-eips.html\n\n### Compliance Information\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - HITRUST v9.4: 0724.07a3Organizational.4, 0814.01n1Organizational.12, 0818.01w3System.12, 0855.01wCMSOrganizational.2, 0856.01wFTIOrganizational.4, 0857.01wHIXOrganizational.1, 11123.01qPCIOrganizational.3, 1114.01h1Organizational.123, 1117.01j1Organizational.23, 1118.01j2Organizational.124, 11192.01cHIXSystem.2, 1164.01cHIESystem.1, 1165.01cPCISystem.1, 1179.01j3Organizational.1, 1403.05i1Organizational.67, 1424.05j2Organizational.5, 1427.05jFTIOrganizational.3, 1802.08b1Organizational.3, 19141.06c1Organizational.7, 19153.06dFTIOrganizational.12, 19910.06cSROrganizational.2\n  - AWS Foundational Security Best Practices: EC2.9\n  - CIS - GCP 1.3.0: Virtual Machines 4.9\n  - CMMC Level 1: AC.1.001, AC.1.002, AC.1.003\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b\n  - ACSC Essential 8: ACSC Mitigation Strategies to Prevent Malware Delivery and Execution\n  - FFEIC: D3.PC.Im.B.1 Network perimeter defense tools (e.g., border router and firewall) are used.\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.13.1, 3.13.2\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - CIS - GCP 2.0.0: Virtual Machines 4.9\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                                "severity": "Info",
                                "source": "core"
                              }
                            ]
                          },
                          "Low": {
                            "count": 2,
                            "insights": [
                              {
                                "author": "InsightCloudSec",
                                "description": "Identify resources without the Name, Environment and Owner tag keys",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 87,
                                "name": "Resource Tagging Policy 101",
                                "notes": "## Overview\n\nA resource tagging policy is critical to effective cloud administration.  While you will likely leverage tags for more than just for 'Name', 'Environment' and 'Owner' keys, they should be considered a bare minimum tagging strategy before attempting to scale.  Moreover, an effective tagging policy can be used to stack with other insights, adding context to other insights and bot actions.\n\nThis insight accepts parameters, including a list, 'tag_keys', and the boolean parameter 'match_all'.  For 'tag_keys', the default option mandates that 'Name', 'Owner', and 'Environment' are present, but if you have other tags defined, this insight is appropriate for identifying instances missing those tags.\n\n### Remediation\n\nLeverage bot automation and customize this insight to enforce tags are being applied to instances to conform to your tagging policy.\n\n### Recommended Bot Workflow\n\n- Create Slack / Email Notification: Notify the appropriate parties when tags are not present on instances.\n- Assign Tag to Resource: This action can be used to automatically tag resources that are missing tags, or to assign ephemeral tags to trigger further review.\n- Add To Resource Group: An 'Untagged' Resource Group provides an easy mechanism for reviewing untagged instances.\n- Mark Resource Non-Compliant: If a resource is untagged, and that violates your resource tagging policy, you can mark it as non-compliant.\n\n### Compliance Information\n  - SOC 2 (Legacy): CC6.2\n  - FedRAMP CCM 3.0.1: DSI-01, IVS-08\n  - NIST 800-53 (Rev 4): CM-8(4), CM-8(9) CM-8(2)\n  - ISO 27001:2013: A.8.2.1 - Classification of information, A.8.2.2 - Labelling of information\n  - SOC 2: CC6.1\n  - PCI DSS Pack: Requirement 2.4\n  - NIST Cybersecurity Framework: PR.DS-3\n  - CSA CCM V4: DCS-05, DSP-04, DSP-17\n  - Microsoft Cloud Security Benchmark: DP-1\n  - ISO 27001:2022: 5.12: Classification of information, 5.13: Labeling of information",
                                "severity": "Low",
                                "source": "core"
                              },
                              {
                                "author": "InsightCloudSec",
                                "description": "Identify resources running in locations outside of the Continental United States (OCONUS)",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 96,
                                "name": "Resource Audit Not In Continental US",
                                "notes": "## Overview\n\nEnsuring all cloud resources are within an approved set of regions has a number of benefits.\n\n- Some compliance frameworks require limiting regions to a single country. This insight limits to the Continental United States.\n- Non-standard regions for a company are not frequently monitored. Resources launched in these non-standard regions may incur larger costs if not identified early.\n- Geographic latency may be a primary concern and instances much be located close to their intended network audience.\n\nThe best course of action may be to disable or delete resources after taking an image or snapshot moved to an approved region.\n\n### Supported Clouds\n\nThis Insight supports the following Clouds:\n- ALICLOUD\n- AWS\n- AWS China\n- AWS Gov\n- Microsoft Azure\n- Google\n- Oracle\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n\n### Bot Notification and/or Remediation Workflow\n\n - Create a bot from the insight\n - Refine the bot's selection criteria as needed via scope and/or additional filters\n - Mark those identified resources **Noncompliant** and add an action to notify resource owners based upon resource tags and/or cloud badges\n - Consider **Scheduled Deletion** preceded by backup actions, if available\n - Have the bot run daily or upon resource creation/modification\n\n### Compliance Information\n  - NIST 800-171: 3.3.1\n  - CSA CCM V4: IAM-12",
                                "severity": "Low",
                                "source": "core"
                              }
                            ]
                          },
                          "Medium": {
                            "count": 1,
                            "insights": [
                              {
                                "author": "InsightCloudSec",
                                "description": "Identifies instances that are configured to use the default service account",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 478,
                                "name": "Instance Configured to Use Default Service Account",
                                "notes": "Overview\n----------\n\nIf an attacker compromises a VM using the default Compute Engine service account, the attacker will gain access to its role, which is Editor. The attacker may then escalate privileges and gain access to your entire project.\n\nTo defend against these privilege escalations, we recommend creating a new service account and assigning only the permissions needed by your instance. This approach aligns with the principle of least privilege access.\n\n### Exception\n\nVMs created by GKE should be excluded. These VMs have names that start with gke- and are labeled goog-gke-node.\n\n### Supported Clouds\n\nThis Insight supports the following Clouds:\n - Google Compute Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n\n### Bot Notification and/or Remediation Workflow\n\n - Create a bot from the insight\n - Refine the bot's selection criteria as needed via scope and/or additional filters\n - Mark those identified resources **Noncompliant** and add an action to notify resource owners based upon resource tags and/or cloud badges\n - Have the bot run daily or upon resource creation/modification\n\n### Remediation\n\n***From GCP Console:***\n\n1. Go to the `VM instances` page\n2. Click on the instance name to go to its VM instance details page\n3. Click `Stop` and then click `Edit`\n4. Under the section `Service Account`, select a service account other that the default\nCompute Engine service account. You may first need to create a new service\naccount\n5. Click `Save` and then click `Start`\n\n***From Command Line:***\n\n1. Stop the instance\n```\ngcloud compute instances stop INSTANCE_NAME\n```\n\n2. Update the instance\n```\ngcloud compute instances set-service-account INSTANCE_NAME --service-account=SERVICE_ACCOUNT\n```\n\n3. Restart the instance\n```\ngcloud compute instances start INSTANCE_NAME\n```\n\n### Remediation Reference Links\n\n* [GCP Service accounts](https://cloud.google.com/compute/docs/access/service-accounts)\n\n### Compliance Information\n  - CIS - GCP 1.1.0: Virtual Machines 4.1\n  - SOC 2: CC6.1\n  - PCI DSS Pack: Requirement 7\n  - NIST Cybersecurity Framework: PR.AC-1\n  - HITRUST v9.4: 1107.01b1System.2\n  - CIS - GCP 1.3.0: Virtual Machines 4.1\n  - ACSC Essential 8: ISM Restrict Administrative Privileges\n  - CIS - GCP 2.0.0: Virtual Machines 4.1",
                                "severity": "Medium",
                                "source": "core"
                              }
                            ]
                          }
                        },
                        "threat_findings": {
                          "high": {
                            "count": 1,
                            "threat_findings": [
                              {
                                "name": "Policy:IAMUser/S3BucketSharedExternally",
                                "resource_id": "storagecontainer:1:us-east-1:mledezma-ics-edh-889956758113-ccd299a4:",
                                "severity": "high",
                                "direct_link": "https://docs.aws.amazon.com/macie/latest/user/findings-types.html#findings-policy-types",
                                "affected_resource_id": "storagecontainer:1:us-east-1:mledezma-ics-edh-889956758113-ccd299a4:",
                                "finding_id": "fad37349-115a-4730-ad10-6e73ca72356d",
                                "count": 1,
                                "event_first_seen": "2023-04-30 06:08:42",
                                "event_last_seen": "2023-04-30 06:08:42",
                                "details": {
                                  "accountId": "889956758113",
                                  "archived": false,
                                  "category": "POLICY",
                                  "count": 1,
                                  "createdAt": "2023-04-30 06:08:42.895000+00:00",
                                  "description": "The access control list (ACL) or bucket policy for the Amazon S3 bucket allows the bucket to be shared with an AWS account that isn\u2019t part of your Amazon Macie organization.",
                                  "id": "fad37349-115a-4730-ad10-6e73ca72356d",
                                  "partition": "aws",
                                  "policyDetails": {
                                    "action": {
                                      "actionType": "AWS_API_CALL",
                                      "apiCallDetails": {
                                        "api": "PutBucketPolicy",
                                        "apiServiceName": "s3.amazonaws.com",
                                        "firstSeen": "2023-04-30 06:05:27+00:00",
                                        "lastSeen": "2023-04-30 06:05:27+00:00"
                                      }
                                    },
                                    "actor": {
                                      "ipAddressDetails": {
                                        "ipAddressV4": "208.118.227.19",
                                        "ipCity": {
                                          "name": "Boston"
                                        },
                                        "ipCountry": {
                                          "code": "US",
                                          "name": "United States"
                                        },
                                        "ipGeoLocation": {
                                          "lat": 42.364,
                                          "lon": -71.0265
                                        },
                                        "ipOwner": {
                                          "asn": "27552",
                                          "asnOrg": "TWDX",
                                          "isp": "TowardEX Technologies International",
                                          "org": "TowardEX Technologies International"
                                        }
                                      },
                                      "userIdentity": {
                                        "assumedRole": {
                                          "accessKeyId": "ASIA46NMOOJQ462N2CM2",
                                          "accountId": "889956758113",
                                          "arn": "arn:aws:sts::889956758113:assumed-role/developer/mbelostoky@rapid7.com",
                                          "principalId": "AROA46NMOOJQRDNDBSNI3:mbelostoky@rapid7.com",
                                          "sessionContext": {
                                            "attributes": {
                                              "creationDate": "2023-04-30 05:47:59+00:00",
                                              "mfaAuthenticated": false
                                            },
                                            "sessionIssuer": {
                                              "accountId": "889956758113",
                                              "arn": "arn:aws:iam::889956758113:role/assumable/developer",
                                              "principalId": "AROA46NMOOJQRDNDBSNI3",
                                              "type": "Role",
                                              "userName": "developer"
                                            }
                                          }
                                        },
                                        "type": "AssumedRole"
                                      }
                                    }
                                  },
                                  "region": "us-east-1",
                                  "resourcesAffected": {
                                    "s3Bucket": {
                                      "allowsUnencryptedObjectUploads": "TRUE",
                                      "arn": "arn:aws:s3:::mledezma-ics-edh-889956758113-ccd299a4",
                                      "createdAt": "2023-04-17 20:31:27+00:00",
                                      "defaultServerSideEncryption": {
                                        "encryptionType": "AES256"
                                      },
                                      "name": "mledezma-ics-edh-889956758113-ccd299a4",
                                      "owner": {
                                        "displayName": "amazon+divvycloud-dev",
                                        "id": "aebb57892f65291629ac4408d76d7fb2855a365a1237d26f5fc561a646f4c533"
                                      },
                                      "publicAccess": {
                                        "effectivePermission": "NOT_PUBLIC",
                                        "permissionConfiguration": {
                                          "accountLevelPermissions": {
                                            "blockPublicAccess": {
                                              "blockPublicAcls": true,
                                              "blockPublicPolicy": true,
                                              "ignorePublicAcls": true,
                                              "restrictPublicBuckets": true
                                            }
                                          },
                                          "bucketLevelPermissions": {
                                            "accessControlList": {
                                              "allowsPublicReadAccess": false,
                                              "allowsPublicWriteAccess": false
                                            },
                                            "blockPublicAccess": {
                                              "blockPublicAcls": true,
                                              "blockPublicPolicy": true,
                                              "ignorePublicAcls": true,
                                              "restrictPublicBuckets": true
                                            },
                                            "bucketPolicy": {
                                              "allowsPublicReadAccess": false,
                                              "allowsPublicWriteAccess": false
                                            }
                                          }
                                        }
                                      },
                                      "tags": [
                                        
                                      ]
                                    }
                                  },
                                  "sample": false,
                                  "schemaVersion": "1.0",
                                  "severity": {
                                    "description": "High",
                                    "score": 3
                                  },
                                  "title": "The S3 bucket is shared with an external AWS account.",
                                  "type": "Policy:IAMUser/S3BucketSharedExternally",
                                  "updatedAt": "2023-04-30 06:08:42.895000+00:00"
                                },
                                "finding_source": "AWS Macie"
                              }
                            ]
                          }
                        },
                        "application_context": [
                          {
                            "app": {
                              "accounts": 1,
                              "application": "ICS QA Team",
                              "block_storage_gb": 0,
                              "business_critical": false,
                              "category": "other",
                              "clouds": [
                                "AZURE_ARM"
                              ],
                              "cores": 0,
                              "is_favourite": false,
                              "name": null,
                              "object_storage_bytes": 0,
                              "poc": null,
                              "resource_count": 3
                            },
                            "tags": {
                              "Application": {
                                "value": "ICS Selenium Automation",
                                "user_defiened": true
                              },
                              "Owner": {
                                "value": "ICS QA Team",
                                "user_defiened": true
                              }
                            }
                          }
                        ],
                        "permissions": [
                          {
                            "action": "compute.snapshots.getIamPolicy",
                            "count": 1,
                            "last_executed_date": "2023-05-31 17:39:07.217902",
                            "permission": "compute.snapshots.getIamPolicy",
                            "status": "Used"
                          },
                          {
                            "action": "monitoring.dashboards.get",
                            "count": 1,
                            "last_executed_date": "2023-05-31 17:39:07.217902",
                            "permission": "monitoring.dashboards.get",
                            "status": "Used"
                          },
                          {
                            "action": "cloudbuild.builds.list",
                            "count": 1,
                            "last_executed_date": "2023-05-31 17:39:07.217902",
                            "permission": "cloudbuild.builds.list",
                            "status": "Used"
                          },
                          {
                            "permission": "gkeonprem.bareMetalAdminClusters.setIamPolicy",
                            "status": "Unused"
                          },
                          {
                            "permission": "networkconnectivity.spokes.create",
                            "status": "Unused"
                          },
                          {
                            "permission": "pubsublite.operations.get",
                            "status": "Unused"
                          },
                          {
                            "permission": "essentialcontacts.contacts.create",
                            "status": "Unused"
                          },
                          {
                            "permission": "eventarc.googleChannelConfigs.get",
                            "status": "Unused"
                          }
                        ],
                        "related_resources": [
                          {
                            "cloud_type_id": "GCE",
                            "id": "ja-gcp-hva.nic0",
                            "info": {
                              "description_template": "{source} has network interface {target}",
                              "extra_info": {
                                
                              },
                              "label": "HAS_NETWORK_INTERFACE",
                              "other_resource_type": "networkinterface",
                              "resource_type": "instance",
                              "source": true,
                              "source_or_target": "source"
                            },
                            "name": "nic0",
                            "resource_id": "networkinterface:6:europe-west1:ja-gcp-hva.nic0:",
                            "type": "networkinterface"
                          },
                          {
                            "cloud_type_id": "GCE",
                            "id": "15354827186006192505",
                            "info": {
                              "description_template": "{source} contains instance {target}",
                              "extra_info": {
                                
                              },
                              "label": "CONTAINS_INSTANCE",
                              "other_resource_type": "privatenetwork",
                              "resource_type": "instance",
                              "source": false,
                              "source_or_target": "target"
                            },
                            "name": "default",
                            "resource_id": "privatenetwork:6::15354827186006192505:",
                            "type": "privatenetwork"
                          },
                          {
                            "cloud_type_id": "GCE",
                            "id": "110744443020505229478",
                            "info": {
                              "description_template": "{source} has role {target}",
                              "extra_info": {
                                
                              },
                              "label": "HAS_ROLE",
                              "other_resource_type": "servicerole",
                              "resource_type": "instance",
                              "source": true,
                              "source_or_target": "source"
                            },
                            "name": "317115057204@project.gserviceaccount.com",
                            "resource_id": "servicerole:6:110744443020505229478:",
                            "type": "servicerole"
                          },
                          {
                            "cloud_type_id": "GCE",
                            "id": "ja-gcp-hva",
                            "info": {
                              "description_template": "{source} has volume {target}",
                              "extra_info": {
                                
                              },
                              "label": "HAS_VOLUME",
                              "other_resource_type": "volume",
                              "resource_type": "instance",
                              "source": true,
                              "source_or_target": "source"
                            },
                            "name": "ja-gcp-hva",
                            "resource_id": "volume:6:europe-west1:ja-gcp-hva:",
                            "type": "volume"
                          },
                          {
                            "id": "3537706110417665757",
                            "name": "test-blocked-rdp",
                            "resource_id": "resourceaccesslist:6::3537706110417665757:",
                            "type": "resourceaccesslist"
                          },
                          {
                            "id": "5121977450226834962",
                            "name": "test-deny",
                            "resource_id": "resourceaccesslist:6::5121977450226834962:",
                            "type": "resourceaccesslist"
                          },
                          {
                            "id": "8519192485236936413",
                            "name": "r7-vpn-allow-ssh",
                            "resource_id": "resourceaccesslist:6::8519192485236936413:",
                            "type": "resourceaccesslist"
                          }
                        ],
                        "attack_path": {
                          "High": {
                            "count": 1,
                            "paths": [
                              {
                                "author": "rapid7",
                                "category_description": "This attack path definition looks for any publicly-available instances and checks to see if any of them have a high/critical vulnerability severity. This can lead to the instance being exploited, so it should be treated as high priority.",
                                "category_id": "apa.publicly_high_vuln_sev_esc",
                                "category_impact": "An attacker may be able to access the instance via the internet and exploit the vulnerability to execute code.",
                                "category_labels": [
                                  "Compute Abuse"
                                ],
                                "category_name": "Publicly Exposed Compute Instance with High/Critical vulnerabilities",
                                "category_remediation": "1. Click on the instance node for the attack path to view details about the node.\n2. Find the vulnerabilities tab to see vulnerabilites.\n3. From there you can find out where the vuln scan came from ie Inspector, IVM, HVA.\n4. Refer to the originating scanner's content for instructions to remediate.\n",
                                "discovered_timestamp": "2024-05-21T18:08:05",
                                "id": 93800,
                                "path_length": 7,
                                "risk_score": 800.0,
                                "severity": "High",
                                "source_resource_id": "internet:internet",
                                "source_resource_name": "Internet",
                                "source_resource_type": "internet",
                                "target_account_id": "014578312761",
                                "target_account_name": "AWS-SSE",
                                "target_account_type": "AWS",
                                "target_application_id": null,
                                "target_application_name": null,
                                "target_organization_service_id": 1496,
                                "target_resource_id": "instance:1496:ap-southeast-2:i-05b3dbcd997404213:",
                                "target_resource_name": "k8-master",
                                "target_resource_type": "instance"
                              }
                            ]
                          }
                        },
                        "errors": [
                          
                        ]
                      },
                      "arn:aws:access-analyzer:eu-west-1:745948225562:analyzer/ConsoleAnalyzer-4494ec85-e6b1-41b7-8ba6-47dfde7bcc87": {
                        "resource_details": {
                          "dependencies": {
                            "networkinterface": [
                              {
                                "id": "ja-gcp-hva.nic0",
                                "name": "nic0",
                                "resource_id": "networkinterface:6:europe-west1:ja-gcp-hva.nic0:",
                                "type": "networkinterface"
                              }
                            ],
                            "privatenetwork": [
                              {
                                "id": "15354827186006192505",
                                "name": "default",
                                "resource_id": "privatenetwork:6::15354827186006192505:",
                                "type": "privatenetwork"
                              }
                            ],
                            "resourceaccesslist": [
                              {
                                "id": "3537706110417665757",
                                "name": "test-blocked-rdp",
                                "resource_id": "resourceaccesslist:6::3537706110417665757:",
                                "type": "resourceaccesslist"
                              },
                              {
                                "id": "5121977450226834962",
                                "name": "test-deny",
                                "resource_id": "resourceaccesslist:6::5121977450226834962:",
                                "type": "resourceaccesslist"
                              },
                              {
                                "id": "8519192485236936413",
                                "name": "r7-vpn-allow-ssh",
                                "resource_id": "resourceaccesslist:6::8519192485236936413:",
                                "type": "resourceaccesslist"
                              }
                            ],
                            "servicerole": [
                              {
                                "id": "110744443020505229478",
                                "name": "317115057204@project.gserviceaccount.com",
                                "resource_id": "servicerole:6:110744443020505229478:",
                                "type": "servicerole"
                              }
                            ],
                            "volume": [
                              {
                                "id": "ja-gcp-hva",
                                "name": "ja-gcp-hva",
                                "resource_id": "volume:6:europe-west1:ja-gcp-hva:",
                                "type": "volume"
                              }
                            ]
                          },
                          "details": {
                            "instance": {
                              "common": {
                                "account": "GCP",
                                "account_id": "divvy-development",
                                "account_status": "REFRESH",
                                "auto_id": 105,
                                "availability_zone": "europe-west1-b",
                                "cloud": "GCE",
                                "creation_timestamp": "2023-03-29 10:09:12",
                                "direct_link": "https://console.cloud.google.com/compute/instancesDetail/zones/europe-west1-b/instances/ja-gcp-hva?project=divvy-development",
                                "discovered_timestamp": "2023-04-03 09:26:38",
                                "last_harvested_timestamp": "2023-06-11T07:19:12",
                                "modified_timestamp": "2023-04-04 16:35:52",
                                "noncompliance": [
                                  
                                ],
                                "organization_service_id": 6,
                                "properties": {
                                  "property_list": [
                                    {
                                      "name": "divvy.default_service_account",
                                      "parent_resource_id": "instance:6:europe-west1:ja-gcp-hva:",
                                      "type_hint": "bool",
                                      "value": "1"
                                    },
                                    {
                                      "name": "divvy.full_access_scope",
                                      "parent_resource_id": "instance:6:europe-west1:ja-gcp-hva:",
                                      "type_hint": "bool",
                                      "value": "0"
                                    }
                                  ]
                                },
                                "provider_id": "ja-gcp-hva",
                                "region": "europe-west1",
                                "resource_id": "instance:6:europe-west1:ja-gcp-hva:",
                                "resource_name": "ja-gcp-hva",
                                "resource_type": "instance",
                                "tags": {
                                  "ja": "hva"
                                }
                              },
                              "create_time": "2023-03-29 10:09:12",
                              "image_id": "7157337275614620995",
                              "instance_id": "ja-gcp-hva",
                              "instance_type": "e2-micro",
                              "launch_time": "2023-03-29 10:09:21",
                              "network_interfaces": [
                                {
                                  "common": {
                                    "account": "GCP",
                                    "account_id": "divvy-development",
                                    "account_status": "REFRESH",
                                    "auto_id": 138,
                                    "cloud": "GCE",
                                    "creation_timestamp": "None",
                                    "discovered_timestamp": "2023-04-03 09:26:38",
                                    "modified_timestamp": "2023-04-03 09:26:38",
                                    "organization_service_id": 6,
                                    "provider_id": "ja-gcp-hva.nic0",
                                    "region": "europe-west1",
                                    "resource_id": "networkinterface:6:europe-west1:ja-gcp-hva.nic0:",
                                    "resource_name": "nic0",
                                    "resource_type": "networkinterface",
                                    "tags": {
                                      "ja": "hva"
                                    }
                                  },
                                  "device_index": 0,
                                  "instance_id": "ja-gcp-hva",
                                  "instance_resource_id": "instance:6:europe-west1:ja-gcp-hva:",
                                  "ip_addresses": [
                                    {
                                      "ip_address": "35.233.43.175",
                                      "ip_address_type": "Ipv4PublicAddress"
                                    },
                                    {
                                      "ip_address": "10.240.0.3",
                                      "ip_address_type": "Ipv4PrivateAddress"
                                    }
                                  ],
                                  "network_interface_id": "ja-gcp-hva.nic0",
                                  "network_resource_id": "privatenetwork:6::15354827186006192505:",
                                  "private_ip_address": "10.240.0.3"
                                }
                              ],
                              "network_resource_id": "privatenetwork:6::15354827186006192505:",
                              "object_id": "7800351496809853097",
                              "platform": "linux",
                              "private_ip_address": "10.240.0.3",
                              "public_ip_address": "35.233.43.175",
                              "role_resource_id": "servicerole:6:110744443020505229478:",
                              "state": "running",
                              "termination_protection": false,
                              "vulnerability_sources": [
                                
                              ]
                            },
                            "resource_type": "instance"
                          }
                        },
                        "vulnerabilitis": {
                          "CRITICAL": {
                            "count": 2,
                            "vulnerabilities": [
                              {
                                "cvss_score": 9.8,
                                "description": "CVE-2023-5178 - linux",
                                "name": "CVE-2023-5178",
                                "package": "",
                                "severity": "CRITICAL",
                                "source": "inspectorv2",
                                "uri": "https://security-tracker.debian.org/tracker/CVE-2023-5178"
                              },
                              {
                                "cvss_score": 7.8,
                                "description": "CVE-2022-3520 - vim, xxd and 1 more",
                                "name": "CVE-2022-3520",
                                "package": "",
                                "severity": "CRITICAL",
                                "source": "inspectorv2",
                                "uri": "https://people.canonical.com/~ubuntu-security/cve/2022/CVE-2022-3520.html"
                              }
                            ]
                          }
                        },
                        "resource_insights": {
                          "Critical": {
                            "count": 1,
                            "insights": [
                              {
                                "author": "InsightCloudSec",
                                "description": "Identify Compute Instances With a Public IP Address That is Exposing Windows RDP",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 281,
                                "name": "Instance with a Public IP Exposing RDP",
                                "notes": "## Overview\nSecurity groups provide stateful filtering of ingress/egress network traffic to cloud resources. It is recommended that no security group allows unrestricted ingress access to port 3389.\n\nThis Insight identities compute instances with a public IP address and that is exposing Windows RDP.\n\n### Supported Clouds\n**This Insight supports the following clouds:**\n* Amazon Web Services, Amazon Web Services China, Amazon Web Services Government\n* Microsoft Azure\n* Google Cloud Platform\n\n**Supported Infrastructure as Code Clouds:**\n* Amazon Web Services\n* Microsoft Azure\n* Google Cloud Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n\n## Recommended Remediation\nLeverage Bot automation to identify and monitor for compute instances that are exposing RDP via port 3389 and have a public IP address attached.\n### Bot Recommendations\n* Mark Resource Noncompliant: Flag compute instances that have been identified as having RDP exposed and a public IP address attached.\n* Send Email/Instant Notification: Notify operations/security team of the compute instances that are exposing RDP and have a public IP address attached. Separately, using cloud badges, identify cloud account owners and notify them of the non-compliant compute instances and the steps required to disable RDP and/or remove the public IP address.\n\n\n### Remediation Reference Links\nFor more information on Identifying compute instances with a public IP address and that is exposing Windows RDP, follow these links:\n\n**Amazon Web Services**\n\n- https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/authorizing-access-to-an-instance.html\n\n**Microsoft Azure**\n\n - https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview\n\n**Google Cloud Platform**\n\n- https://cloud.google.com/vpc/docs/firewalls\n\n### Compliance Information\n  - NIST 800-53 (Rev 4): AC-17, AC-17(1), AC-6, RA-5, SA-17(7), SC-7, SC-8\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - HIPAA: Access Control - § 164.312(a)(1), No ePHI Should Be Publicly Accessible\n  - SOC 2: CC5.2, CC6.1, CC6.3, CC6.6\n  - PCI DSS Pack: 6.6, 7.1, 7.2, Requirement 1.3\n  - NIST Cybersecurity Framework: DE.CM-7, PR.AC-3, PR.AC-4, PR.AC-5, PR.DS-5\n  - HITRUST v9.4: 0724.07a3Organizational.4, 0814.01n1Organizational.12, 0818.01w3System.12, 0855.01wCMSOrganizational.2, 0856.01wFTIOrganizational.4, 0857.01wHIXOrganizational.1, 11123.01qPCIOrganizational.3, 1114.01h1Organizational.123, 1117.01j1Organizational.23, 1118.01j2Organizational.124, 11192.01cHIXSystem.2, 1164.01cHIESystem.1, 1165.01cPCISystem.1, 1179.01j3Organizational.1, 1403.05i1Organizational.67, 1424.05j2Organizational.5, 1427.05jFTIOrganizational.3, 1802.08b1Organizational.3, 19141.06c1Organizational.7, 19153.06dFTIOrganizational.12, 19910.06cSROrganizational.2\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b, 500.14.a\n  - NIST 800-53 (Rev 5): AC-4, AC-4 (21), AC-6, AC-17, AC-17 (1), AC-21, CM-7, CM-7 (1), SC-7, SC-7 (3), SC-7 (4), SC-7 (5), SC-7 (9), SC-7 (10), SC-7 (11), SC-7 (16), SC-7 (20), SC-7 (21)\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.13.1, 3.13.2\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - Microsoft Cloud Security Benchmark: NS-1, NS-2, NS-3\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                                "severity": "Critical",
                                "source": "core"
                              }
                            ]
                          },
                          "High": {
                            "count": 3,
                            "insights": [
                              {
                                "author": "InsightCloudSec",
                                "description": "Identify instances that have RDP access open to the public",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 166,
                                "name": "Instance Exposing RDP to the Public",
                                "notes": "## Overview\nThe potential security problem with using RDP over the Internet is that attackers can use various brute force techniques to gain access to Azure Virtual Machines. Once the attackers gain access, they can use your virtual machine as a launch point for compromising other machines on your Azure Virtual Network or even attack networked devices outside of Azure.\n\nThis Insight identifies instances that have RDP access open to the public.\n### Supported Clouds\n\n**This Insight supports the following clouds:**\n\n* Alibaba Cloud\n* Amazon Web Services, Amazon Web Services China, Amazon Web Services Gov\n* Microsoft Azure, Microsoft Azure China, Microsoft Azure Gov\n* Google Cloud Platform\n\n\n**This Insight supports the following Infrastructure as Code clouds:**\n\n* Amazon Web Services\n* Microsoft Azure\n* Google Cloud Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n## Recommended Remediation\nDisable RDP access on Network Security Groups from the Internet.\n\n### Bot Recommendations\n*  Mark Resource Noncompliant: Flag Instances with RDP access open to the public.\n* Send Email/Instant Notification: Notify operations/security team of the Instances with RDP open for public access. Separately, using cloud badges, identify cloud account owners and notify them of the steps needed to remove public RDP access by following the CIS manual remediation steps as outlined below.\n\n### CIS Recommended Remediation Steps\n\n**Microsoft Azure**\n\nDisable direct RDP access to your Azure Virtual Machines from the Internet. After direct RDP access from the Internet is disabled, you have other options you can use to access these virtual machines for remote management:\n - [Point-to-site VPN](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal)\n - [Site-to-site VPN](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal)\n - [ExpressRoute](https://docs.microsoft.com/en-us/azure/expressroute/)\n\n### Remediation Reference Links\nFor more information on specific steps to identify and remediate instances that have RDP access open to the public, follow these links:\n\n* Alibaba Cloud - https://www.alibabacloud.com/help/en/doc-detail/96468.html\n\n* Amazon Web Services - https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/authorizing-access-to-an-instance.html\n\n* Microsoft Azure - https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview\n\n* Google Cloud Platform - https://cloud.google.com/compute/docs/instances/access-overview\n\n### Compliance Information\n  - NIST Cybersecurity Framework (Legacy): PR.DS-5\n  - CIS - Azure 1.0.0 (Legacy): Networking 6.1\n  - CIS - Azure 1.1.0: Networking - 6.1 - Ensure that RDP access is restricted from the internet\n  - NIST 800-53 (Rev 4): AC-17, AC-17(1), AC-6, RA-5, SA-17(7), SC-7, SC-8\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - HIPAA: Access Control - § 164.312(a)(1), No ePHI Should Be Publicly Accessible\n  - SOC 2: CC5.2, CC6.1, CC6.3, CC6.6\n  - PCI DSS Pack: 6.6, 7.1, 7.2, Requirement 1.3\n  - NIST Cybersecurity Framework: DE.CM-7, PR.AC-3, PR.AC-4, PR.AC-5, PR.DS-5\n  - HITRUST v9.4: 0724.07a3Organizational.4, 0814.01n1Organizational.12, 0818.01w3System.12, 0855.01wCMSOrganizational.2, 0856.01wFTIOrganizational.4, 0857.01wHIXOrganizational.1, 11123.01qPCIOrganizational.3, 1114.01h1Organizational.123, 1117.01j1Organizational.23, 1118.01j2Organizational.124, 11192.01cHIXSystem.2, 1164.01cHIESystem.1, 1165.01cPCISystem.1, 1179.01j3Organizational.1, 1403.05i1Organizational.67, 1424.05j2Organizational.5, 1427.05jFTIOrganizational.3, 1802.08b1Organizational.3, 19141.06c1Organizational.7, 19153.06dFTIOrganizational.12, 19910.06cSROrganizational.2\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b, 500.14.a\n  - NIST 800-53 (Rev 5): AC-4, AC-4 (21), AC-6, AC-17, AC-17 (1), AC-21, CM-7, CM-7 (1), SC-7, SC-7 (3), SC-7 (4), SC-7 (5), SC-7 (9), SC-7 (10), SC-7 (11), SC-7 (16), SC-7 (20), SC-7 (21)\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.13.1, 3.13.2\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - Microsoft Cloud Security Benchmark: NS-2\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                                "severity": "High",
                                "source": "core"
                              },
                              {
                                "author": "InsightCloudSec",
                                "description": "Identify select resource types on Google Cloud Platform which run on legacy network services which do not contain advanced networking features found in more advanced VPC configurations.",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 389,
                                "name": "Cloud Resource Associated with Legacy Network (GCP)",
                                "notes": "## Overview\nLegacy networks are not recommended. Many newer Google Cloud features are not supported in legacy networks. Instead, use Virtual Private Cloud (VPC) networks. For more information, see the VPC network overview.\n\nLegacy networks have a single RFC 1918 range, which you specify when you create the network. The network is global in scope and spans all cloud regions.\n\nIn a legacy network, instance IP addresses are not grouped by region or zone. One IP address can appear in one region, and the following IP address can be in a different region. Any given range of IPs can be spread across all regions, and the IP addresses of instances created within a region are not necessarily contiguous.\n\n*The IPv4Range field for creating legacy networks is deprecated and will shut down on June 1, 2021. After that date, you won't be able to create legacy networks. However, existing legacy networks won't be affected and will continue to operate normally.*\n\nThis Insight identifies select resource types on Google Cloud Platform which run on legacy network services which do not contain advanced networking features found in more advanced VPC configurations.\n\n### Supported Clouds\n\n**This Insight supports the following clouds:**\n\n* Google Cloud Platform\n\n**This Insight supports the following Infrastructure as Code clouds:**\n\n* Google Cloud Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n\n## Recommended Remediation\nEliminate Google Cloud Platform legacy network services which do not contain advanced networking features found in more advanced VPC configurations.\n\n### Bot Recommendations\n* Mark Resource Noncompliant: Flag Cloud Resources that are associated with a Legacy Network.\n* Send Email/Instant Notification: Notify operations/security team of the Cloud Resources that are associated with a Legacy Network.  Separately, using cloud badges, identify cloud account owners and notify them of the non-compliant cloud resources and the steps required to modify the Cloud Resources that are associated with a Legacy Network.\n\n### Remediation Reference Links\nFor more information on specific steps to identify and remediate select resource types on Google Cloud Platform which run on legacy network services which do not contain advanced networking features found in more advanced VPC configurations, please follow this link:\n\n* Google Cloud Platform - https://cloud.google.com/vpc/docs/using-legacy\n\n### Compliance Information\n  - ISO 27001:2013: A.13.1.1 - Network controls\n  - PCI DSS Pack: Requirement 6\n  - NIST Cybersecurity Framework: PR.IP-2\n  - HITRUST v9.4: 0805.01m1Organizational.12, 0809.01n2Organizational.1234\n  - ACSC Essential 8: ISM Patch Operating Systems\n  - ISO 27001:2022: 8.20: Network security",
                                "severity": "High",
                                "source": "core"
                              },
                              {
                                "author": "InsightCloudSec",
                                "description": "Instance with public IP address and any port exposure to 0.0.0.0/0",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 408,
                                "name": "Instance with Public IP Address and any Port Exposure to 0.0.0.0/0",
                                "notes": "## Overview\nInstances should rarely be exposed to the whole internet on any port. A wide amount of exposure increases the risk of the instance being compromised or used in a non-desirable way.\n\nThis Insight identifies an Instance with public IP address and any port exposure to 0.0.0.0/0.\n### Supported Clouds\n\n**This Insight supports the following clouds:**\n\n* Amazon Web Services, Amazon Web Services China, Amazon Web Services Gov\n* Microsoft Azure, Microsoft Azure China, Microsoft Azure Gov\n* Google Cloud Platform\n\n**This Insight supports the following Infrastructure as Code clouds:**\n\n* Amazon Web Services\n* Microsoft Azure\n* Google Cloud Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n## Recommended Remediation\nEdit the scope of the instance's security group to remove the wide-open network access.\n### Bot Recommendations\n*  Mark Resource Noncompliant: Flag Instances with a public IP address and port exposure to 0.0.0.0/0.\n* Send Email/Instant Notification: Notify operations/security team of the Instances with a public IP address and port exposure to the Internet (0.0.0.0/0). Separately, using cloud badges, identify cloud account owners and notify them of the steps needed to remove port exposure to 0.0.0.0/0 by following the CIS manual remediation steps as outlined below.\n\n\n### CIS Recommended Remediation Steps\n\n**Google Cloud Platform**\n\n**From Console:**\n\n1. Go to the `VM instances` page.\n2. Click on the instance name to go to the `Instance detail page`.\n3. Click `Edit`.\n4. For each Network interface, ensure that `External IP` is set to `None`.\n5. Click `Done` and then click `Save`.\n\n**From Command Line:**\n\n1. Describe the instance properties:\n\n```\ngcloud compute instances describe INSTANCE_NAME --zone=ZONE\n```\n\n2. Identify the access config name that contains the external IP address. This access config appears in the following format:\n\n```\nnetworkInterfaces:\n- accessConfigs:\n - kind: compute#accessConfig\n name: External NAT\n natIP: 130.211.181.55\n type: ONE_TO_ONE_NAT\n```\n\n2. Delete the access config.\n\n```\ngcloud compute instances delete-access-config INSTANCE_NAME --zone=ZONE --access-config-name \"\"ACCESS_CONFIG_NAME\"\"\n```\n\nIn the above example, the `ACCESS_CONFIG_NAME` is `External NAT`. The name of your access config might be different.\n\n**Prevention:**\n\nYou can configure the `Define allowed external IPs for VM instances` Organization Policy to prevent VMs from being configured with public IP addresses. Learn more at: https://console.cloud.google.com/orgpolicies/compute-vmExternalIpAccess\n\n### Remediation Reference Links\n\nFor more information on specific steps to identify and remediate an Instance with public IP address and any port exposure to 0.0.0.0/0, follow these links:\n\n* Amazon Web Services - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/authorizing-access-to-an-instance.html\nhttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html\n\n* Microsoft Azure - https://docs.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses\nhttps://docs.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal\n\n* Google Cloud Platform - https://cloud.google.com/compute/docs/ip-addresses\nhttps://cloud.google.com/vpc/docs/firewalls\n\n### Compliance Information\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - CIS - GCP 1.1.0: Virtual Machines 4.9\n  - HIPAA: Access Control - § 164.312(a)(1), No ePHI Should Be Publicly Accessible\n  - SOC 2: CC5.2, CC6.1, CC6.3, CC6.6\n  - PCI DSS Pack: 6.6, 7.1, 7.2, Requirement 1.3\n  - NIST Cybersecurity Framework: DE.CM-7, PR.AC-3, PR.AC-4, PR.AC-5, PR.DS-5\n  - HITRUST v9.4: 0724.07a3Organizational.4, 0814.01n1Organizational.12, 0818.01w3System.12, 0855.01wCMSOrganizational.2, 0856.01wFTIOrganizational.4, 0857.01wHIXOrganizational.1, 11123.01qPCIOrganizational.3, 1114.01h1Organizational.123, 1117.01j1Organizational.23, 1118.01j2Organizational.124, 11192.01cHIXSystem.2, 1164.01cHIESystem.1, 1165.01cPCISystem.1, 1179.01j3Organizational.1, 1403.05i1Organizational.67, 1424.05j2Organizational.5, 1427.05jFTIOrganizational.3, 1802.08b1Organizational.3, 19141.06c1Organizational.7, 19153.06dFTIOrganizational.12, 19910.06cSROrganizational.2\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b, 500.14.a\n  - NIST 800-53 (Rev 5): CM-7, CM-7 (1)\n  - FFEIC: D3.PC.IM.B.3 All ports are monitored., D3.PC.IM.B.6 Ports, functions, protocols and services are prohibited if no longer needed for business purposes.\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.4.7, 3.13.1, 3.13.2, 3.13.6\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - Microsoft Cloud Security Benchmark: NS-1, NS-2\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1037, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                                "severity": "High",
                                "source": "core"
                              }
                            ]
                          },
                          "Info": {
                            "count": 2,
                            "insights": [
                              {
                                "author": "InsightCloudSec",
                                "description": "Match instances with an ephemeral public IP address",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 4,
                                "name": "Instance Has Ephemeral Public IP",
                                "notes": "## Overview\n\nCompute instances can have static or dynamic (ephemeral) public IP addresses associated with them. Static addresses will remain intact and persist through lifecycle actions such as stop/start. This can be essential when the resource is used for direct connectivity and does not sit behind a load balancer. Ephemeral addresses will commonly change, and can result in a loss of connectivity to the system if it is routinely stopped/started.\n\nFor some workloads such as web servers this may not represent a true problem. These systems are intended to be ephemeral and in many cases should not have a public IP at all. This Insight can be reconfigured to leverage that tagging policy to identify those mission critical systems which should be updated. It is strongly encouraged to leverage a tagging policy to identify scenarios where this is acceptable.\n\n### Remediation\n\nFor production facing/critical workloads which cannot be taken offline, consider attaching an persistent public iP address. This can be done without taking the machine offline. Be aware that when doing this you may need to update DNS to point to the newly reserved IP address.\n\n### Compliance Information\n  - SOC 2 (Legacy): A1.1, C1.2, C1.3, C1.7, CC5.6\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - HIPAA: Access Control - § 164.312(a)(1), Information Access Management - § 164.308(a)(4)\n  - SOC 2: CC6.1, CC6.6\n  - PCI DSS Pack: Requirement 7\n  - NIST Cybersecurity Framework: PR.PT-5\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.13.1, 3.13.2\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                                "severity": "Info",
                                "source": "core"
                              },
                              {
                                "author": "InsightCloudSec",
                                "description": "Identifies compute instances which have an ephemeral/reserved public IP attached",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 536,
                                "name": "Compute Instance With Public IP Attached",
                                "notes": "Overview\n----------\n\nCloud Service Providers (CSPs) provide customers with a way to assign ephemeral or reserved/static public IP addresses to compute instances and the network interfaces that back them for communication over the Internet. As a best practice, it is recommended that customers use these only where necessary, and opt for backend VPC communication and Load Balancers for network communication with the compute instances.\n\n### Reference Links\n\n+ https://docs.aws.amazon.com/vpc/latest/userguide/vpc-eips.html\n\n### Compliance Information\n  - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction\n  - HITRUST v9.4: 0724.07a3Organizational.4, 0814.01n1Organizational.12, 0818.01w3System.12, 0855.01wCMSOrganizational.2, 0856.01wFTIOrganizational.4, 0857.01wHIXOrganizational.1, 11123.01qPCIOrganizational.3, 1114.01h1Organizational.123, 1117.01j1Organizational.23, 1118.01j2Organizational.124, 11192.01cHIXSystem.2, 1164.01cHIESystem.1, 1165.01cPCISystem.1, 1179.01j3Organizational.1, 1403.05i1Organizational.67, 1424.05j2Organizational.5, 1427.05jFTIOrganizational.3, 1802.08b1Organizational.3, 19141.06c1Organizational.7, 19153.06dFTIOrganizational.12, 19910.06cSROrganizational.2\n  - AWS Foundational Security Best Practices: EC2.9\n  - CIS - GCP 1.3.0: Virtual Machines 4.9\n  - CMMC Level 1: AC.1.001, AC.1.002, AC.1.003\n  - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b\n  - ACSC Essential 8: ACSC Mitigation Strategies to Prevent Malware Delivery and Execution\n  - FFEIC: D3.PC.Im.B.1 Network perimeter defense tools (e.g., border router and firewall) are used.\n  - NIST 800-171: 3.1.1, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.13.1, 3.13.2\n  - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09\n  - CIS - GCP 2.0.0: Virtual Machines 4.9\n  - MITRE Att&ck Mitigation Pack: M1015, M1039, M1035, M1030\n  - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks\n  - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture",
                                "severity": "Info",
                                "source": "core"
                              }
                            ]
                          },
                          "Low": {
                            "count": 2,
                            "insights": [
                              {
                                "author": "InsightCloudSec",
                                "description": "Identify resources without the Name, Environment and Owner tag keys",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 87,
                                "name": "Resource Tagging Policy 101",
                                "notes": "## Overview\n\nA resource tagging policy is critical to effective cloud administration.  While you will likely leverage tags for more than just for 'Name', 'Environment' and 'Owner' keys, they should be considered a bare minimum tagging strategy before attempting to scale.  Moreover, an effective tagging policy can be used to stack with other insights, adding context to other insights and bot actions.\n\nThis insight accepts parameters, including a list, 'tag_keys', and the boolean parameter 'match_all'.  For 'tag_keys', the default option mandates that 'Name', 'Owner', and 'Environment' are present, but if you have other tags defined, this insight is appropriate for identifying instances missing those tags.\n\n### Remediation\n\nLeverage bot automation and customize this insight to enforce tags are being applied to instances to conform to your tagging policy.\n\n### Recommended Bot Workflow\n\n- Create Slack / Email Notification: Notify the appropriate parties when tags are not present on instances.\n- Assign Tag to Resource: This action can be used to automatically tag resources that are missing tags, or to assign ephemeral tags to trigger further review.\n- Add To Resource Group: An 'Untagged' Resource Group provides an easy mechanism for reviewing untagged instances.\n- Mark Resource Non-Compliant: If a resource is untagged, and that violates your resource tagging policy, you can mark it as non-compliant.\n\n### Compliance Information\n  - SOC 2 (Legacy): CC6.2\n  - FedRAMP CCM 3.0.1: DSI-01, IVS-08\n  - NIST 800-53 (Rev 4): CM-8(4), CM-8(9) CM-8(2)\n  - ISO 27001:2013: A.8.2.1 - Classification of information, A.8.2.2 - Labelling of information\n  - SOC 2: CC6.1\n  - PCI DSS Pack: Requirement 2.4\n  - NIST Cybersecurity Framework: PR.DS-3\n  - CSA CCM V4: DCS-05, DSP-04, DSP-17\n  - Microsoft Cloud Security Benchmark: DP-1\n  - ISO 27001:2022: 5.12: Classification of information, 5.13: Labeling of information",
                                "severity": "Low",
                                "source": "core"
                              },
                              {
                                "author": "InsightCloudSec",
                                "description": "Identify resources running in locations outside of the Continental United States (OCONUS)",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 96,
                                "name": "Resource Audit Not In Continental US",
                                "notes": "## Overview\n\nEnsuring all cloud resources are within an approved set of regions has a number of benefits.\n\n- Some compliance frameworks require limiting regions to a single country. This insight limits to the Continental United States.\n- Non-standard regions for a company are not frequently monitored. Resources launched in these non-standard regions may incur larger costs if not identified early.\n- Geographic latency may be a primary concern and instances much be located close to their intended network audience.\n\nThe best course of action may be to disable or delete resources after taking an image or snapshot moved to an approved region.\n\n### Supported Clouds\n\nThis Insight supports the following Clouds:\n- ALICLOUD\n- AWS\n- AWS China\n- AWS Gov\n- Microsoft Azure\n- Google\n- Oracle\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n\n### Bot Notification and/or Remediation Workflow\n\n - Create a bot from the insight\n - Refine the bot's selection criteria as needed via scope and/or additional filters\n - Mark those identified resources **Noncompliant** and add an action to notify resource owners based upon resource tags and/or cloud badges\n - Consider **Scheduled Deletion** preceded by backup actions, if available\n - Have the bot run daily or upon resource creation/modification\n\n### Compliance Information\n  - NIST 800-171: 3.3.1\n  - CSA CCM V4: IAM-12",
                                "severity": "Low",
                                "source": "core"
                              }
                            ]
                          },
                          "Medium": {
                            "count": 1,
                            "insights": [
                              {
                                "author": "InsightCloudSec",
                                "description": "Identifies instances that are configured to use the default service account",
                                "identified_on": "2023-06-01 16:48:57",
                                "insight_id": 478,
                                "name": "Instance Configured to Use Default Service Account",
                                "notes": "Overview\n----------\n\nIf an attacker compromises a VM using the default Compute Engine service account, the attacker will gain access to its role, which is Editor. The attacker may then escalate privileges and gain access to your entire project.\n\nTo defend against these privilege escalations, we recommend creating a new service account and assigning only the permissions needed by your instance. This approach aligns with the principle of least privilege access.\n\n### Exception\n\nVMs created by GKE should be excluded. These VMs have names that start with gke- and are labeled goog-gke-node.\n\n### Supported Clouds\n\nThis Insight supports the following Clouds:\n - Google Compute Platform\n\nSupported clouds are specific to this Insight and may vary for any associated filter(s).\n\n### Bot Notification and/or Remediation Workflow\n\n - Create a bot from the insight\n - Refine the bot's selection criteria as needed via scope and/or additional filters\n - Mark those identified resources **Noncompliant** and add an action to notify resource owners based upon resource tags and/or cloud badges\n - Have the bot run daily or upon resource creation/modification\n\n### Remediation\n\n***From GCP Console:***\n\n1. Go to the `VM instances` page\n2. Click on the instance name to go to its VM instance details page\n3. Click `Stop` and then click `Edit`\n4. Under the section `Service Account`, select a service account other that the default\nCompute Engine service account. You may first need to create a new service\naccount\n5. Click `Save` and then click `Start`\n\n***From Command Line:***\n\n1. Stop the instance\n```\ngcloud compute instances stop INSTANCE_NAME\n```\n\n2. Update the instance\n```\ngcloud compute instances set-service-account INSTANCE_NAME --service-account=SERVICE_ACCOUNT\n```\n\n3. Restart the instance\n```\ngcloud compute instances start INSTANCE_NAME\n```\n\n### Remediation Reference Links\n\n* [GCP Service accounts](https://cloud.google.com/compute/docs/access/service-accounts)\n\n### Compliance Information\n  - CIS - GCP 1.1.0: Virtual Machines 4.1\n  - SOC 2: CC6.1\n  - PCI DSS Pack: Requirement 7\n  - NIST Cybersecurity Framework: PR.AC-1\n  - HITRUST v9.4: 1107.01b1System.2\n  - CIS - GCP 1.3.0: Virtual Machines 4.1\n  - ACSC Essential 8: ISM Restrict Administrative Privileges\n  - CIS - GCP 2.0.0: Virtual Machines 4.1",
                                "severity": "Medium",
                                "source": "core"
                              }
                            ]
                          }
                        },
                        "threat_findings": {
                          "high": {
                            "count": 1,
                            "threat_findings": [
                              {
                                "name": "Policy:IAMUser/S3BucketSharedExternally",
                                "resource_id": "storagecontainer:1:us-east-1:mledezma-ics-edh-889956758113-ccd299a4:",
                                "severity": "high",
                                "direct_link": "https://docs.aws.amazon.com/macie/latest/user/findings-types.html#findings-policy-types",
                                "affected_resource_id": "storagecontainer:1:us-east-1:mledezma-ics-edh-889956758113-ccd299a4:",
                                "finding_id": "fad37349-115a-4730-ad10-6e73ca72356d",
                                "count": 1,
                                "event_first_seen": "2023-04-30 06:08:42",
                                "event_last_seen": "2023-04-30 06:08:42",
                                "details": {
                                  "accountId": "889956758113",
                                  "archived": false,
                                  "category": "POLICY",
                                  "count": 1,
                                  "createdAt": "2023-04-30 06:08:42.895000+00:00",
                                  "description": "The access control list (ACL) or bucket policy for the Amazon S3 bucket allows the bucket to be shared with an AWS account that isn\u2019t part of your Amazon Macie organization.",
                                  "id": "fad37349-115a-4730-ad10-6e73ca72356d",
                                  "partition": "aws",
                                  "policyDetails": {
                                    "action": {
                                      "actionType": "AWS_API_CALL",
                                      "apiCallDetails": {
                                        "api": "PutBucketPolicy",
                                        "apiServiceName": "s3.amazonaws.com",
                                        "firstSeen": "2023-04-30 06:05:27+00:00",
                                        "lastSeen": "2023-04-30 06:05:27+00:00"
                                      }
                                    },
                                    "actor": {
                                      "ipAddressDetails": {
                                        "ipAddressV4": "208.118.227.19",
                                        "ipCity": {
                                          "name": "Boston"
                                        },
                                        "ipCountry": {
                                          "code": "US",
                                          "name": "United States"
                                        },
                                        "ipGeoLocation": {
                                          "lat": 42.364,
                                          "lon": -71.0265
                                        },
                                        "ipOwner": {
                                          "asn": "27552",
                                          "asnOrg": "TWDX",
                                          "isp": "TowardEX Technologies International",
                                          "org": "TowardEX Technologies International"
                                        }
                                      },
                                      "userIdentity": {
                                        "assumedRole": {
                                          "accessKeyId": "ASIA46NMOOJQ462N2CM2",
                                          "accountId": "889956758113",
                                          "arn": "arn:aws:sts::889956758113:assumed-role/developer/mbelostoky@rapid7.com",
                                          "principalId": "AROA46NMOOJQRDNDBSNI3:mbelostoky@rapid7.com",
                                          "sessionContext": {
                                            "attributes": {
                                              "creationDate": "2023-04-30 05:47:59+00:00",
                                              "mfaAuthenticated": false
                                            },
                                            "sessionIssuer": {
                                              "accountId": "889956758113",
                                              "arn": "arn:aws:iam::889956758113:role/assumable/developer",
                                              "principalId": "AROA46NMOOJQRDNDBSNI3",
                                              "type": "Role",
                                              "userName": "developer"
                                            }
                                          }
                                        },
                                        "type": "AssumedRole"
                                      }
                                    }
                                  },
                                  "region": "us-east-1",
                                  "resourcesAffected": {
                                    "s3Bucket": {
                                      "allowsUnencryptedObjectUploads": "TRUE",
                                      "arn": "arn:aws:s3:::mledezma-ics-edh-889956758113-ccd299a4",
                                      "createdAt": "2023-04-17 20:31:27+00:00",
                                      "defaultServerSideEncryption": {
                                        "encryptionType": "AES256"
                                      },
                                      "name": "mledezma-ics-edh-889956758113-ccd299a4",
                                      "owner": {
                                        "displayName": "amazon+divvycloud-dev",
                                        "id": "aebb57892f65291629ac4408d76d7fb2855a365a1237d26f5fc561a646f4c533"
                                      },
                                      "publicAccess": {
                                        "effectivePermission": "NOT_PUBLIC",
                                        "permissionConfiguration": {
                                          "accountLevelPermissions": {
                                            "blockPublicAccess": {
                                              "blockPublicAcls": true,
                                              "blockPublicPolicy": true,
                                              "ignorePublicAcls": true,
                                              "restrictPublicBuckets": true
                                            }
                                          },
                                          "bucketLevelPermissions": {
                                            "accessControlList": {
                                              "allowsPublicReadAccess": false,
                                              "allowsPublicWriteAccess": false
                                            },
                                            "blockPublicAccess": {
                                              "blockPublicAcls": true,
                                              "blockPublicPolicy": true,
                                              "ignorePublicAcls": true,
                                              "restrictPublicBuckets": true
                                            },
                                            "bucketPolicy": {
                                              "allowsPublicReadAccess": false,
                                              "allowsPublicWriteAccess": false
                                            }
                                          }
                                        }
                                      },
                                      "tags": [
                                        
                                      ]
                                    }
                                  },
                                  "sample": false,
                                  "schemaVersion": "1.0",
                                  "severity": {
                                    "description": "High",
                                    "score": 3
                                  },
                                  "title": "The S3 bucket is shared with an external AWS account.",
                                  "type": "Policy:IAMUser/S3BucketSharedExternally",
                                  "updatedAt": "2023-04-30 06:08:42.895000+00:00"
                                },
                                "finding_source": "AWS Macie"
                              }
                            ]
                          }
                        },
                        "application_context": [
                          {
                            "app": {
                              "accounts": 1,
                              "application": "ICS QA Team",
                              "block_storage_gb": 0,
                              "business_critical": false,
                              "category": "other",
                              "clouds": [
                                "AZURE_ARM"
                              ],
                              "cores": 0,
                              "is_favourite": false,
                              "name": null,
                              "object_storage_bytes": 0,
                              "poc": null,
                              "resource_count": 3
                            },
                            "tags": {
                              "Application": {
                                "value": "ICS Selenium Automation",
                                "user_defiened": true
                              },
                              "Owner": {
                                "value": "ICS QA Team",
                                "user_defiened": true
                              }
                            }
                          }
                        ],
                        "permissions": [
                          {
                            "action": "compute.snapshots.getIamPolicy",
                            "count": 1,
                            "last_executed_date": "2023-05-31 17:39:07.217902",
                            "permission": "compute.snapshots.getIamPolicy",
                            "status": "Used"
                          },
                          {
                            "action": "monitoring.dashboards.get",
                            "count": 1,
                            "last_executed_date": "2023-05-31 17:39:07.217902",
                            "permission": "monitoring.dashboards.get",
                            "status": "Used"
                          },
                          {
                            "action": "cloudbuild.builds.list",
                            "count": 1,
                            "last_executed_date": "2023-05-31 17:39:07.217902",
                            "permission": "cloudbuild.builds.list",
                            "status": "Used"
                          },
                          {
                            "permission": "gkeonprem.bareMetalAdminClusters.setIamPolicy",
                            "status": "Unused"
                          },
                          {
                            "permission": "networkconnectivity.spokes.create",
                            "status": "Unused"
                          },
                          {
                            "permission": "pubsublite.operations.get",
                            "status": "Unused"
                          },
                          {
                            "permission": "essentialcontacts.contacts.create",
                            "status": "Unused"
                          },
                          {
                            "permission": "eventarc.googleChannelConfigs.get",
                            "status": "Unused"
                          }
                        ],
                        "related_resources": [
                          {
                            "cloud_type_id": "GCE",
                            "id": "ja-gcp-hva.nic0",
                            "info": {
                              "description_template": "{source} has network interface {target}",
                              "extra_info": {
                                
                              },
                              "label": "HAS_NETWORK_INTERFACE",
                              "other_resource_type": "networkinterface",
                              "resource_type": "instance",
                              "source": true,
                              "source_or_target": "source"
                            },
                            "name": "nic0",
                            "resource_id": "networkinterface:6:europe-west1:ja-gcp-hva.nic0:",
                            "type": "networkinterface"
                          },
                          {
                            "cloud_type_id": "GCE",
                            "id": "15354827186006192505",
                            "info": {
                              "description_template": "{source} contains instance {target}",
                              "extra_info": {
                                
                              },
                              "label": "CONTAINS_INSTANCE",
                              "other_resource_type": "privatenetwork",
                              "resource_type": "instance",
                              "source": false,
                              "source_or_target": "target"
                            },
                            "name": "default",
                            "resource_id": "privatenetwork:6::15354827186006192505:",
                            "type": "privatenetwork"
                          },
                          {
                            "cloud_type_id": "GCE",
                            "id": "110744443020505229478",
                            "info": {
                              "description_template": "{source} has role {target}",
                              "extra_info": {
                                
                              },
                              "label": "HAS_ROLE",
                              "other_resource_type": "servicerole",
                              "resource_type": "instance",
                              "source": true,
                              "source_or_target": "source"
                            },
                            "name": "317115057204@project.gserviceaccount.com",
                            "resource_id": "servicerole:6:110744443020505229478:",
                            "type": "servicerole"
                          },
                          {
                            "cloud_type_id": "GCE",
                            "id": "ja-gcp-hva",
                            "info": {
                              "description_template": "{source} has volume {target}",
                              "extra_info": {
                                
                              },
                              "label": "HAS_VOLUME",
                              "other_resource_type": "volume",
                              "resource_type": "instance",
                              "source": true,
                              "source_or_target": "source"
                            },
                            "name": "ja-gcp-hva",
                            "resource_id": "volume:6:europe-west1:ja-gcp-hva:",
                            "type": "volume"
                          },
                          {
                            "id": "3537706110417665757",
                            "name": "test-blocked-rdp",
                            "resource_id": "resourceaccesslist:6::3537706110417665757:",
                            "type": "resourceaccesslist"
                          },
                          {
                            "id": "5121977450226834962",
                            "name": "test-deny",
                            "resource_id": "resourceaccesslist:6::5121977450226834962:",
                            "type": "resourceaccesslist"
                          },
                          {
                            "id": "8519192485236936413",
                            "name": "r7-vpn-allow-ssh",
                            "resource_id": "resourceaccesslist:6::8519192485236936413:",
                            "type": "resourceaccesslist"
                          }
                        ],
                        "attack_path": {
                          "High": {
                            "count": 1,
                            "paths": [
                              {
                                "author": "rapid7",
                                "category_description": "This attack path definition looks for any publicly-available instances and checks to see if any of them have a high/critical vulnerability severity. This can lead to the instance being exploited, so it should be treated as high priority.",
                                "category_id": "apa.publicly_high_vuln_sev_esc",
                                "category_impact": "An attacker may be able to access the instance via the internet and exploit the vulnerability to execute code.",
                                "category_labels": [
                                  "Compute Abuse"
                                ],
                                "category_name": "Publicly Exposed Compute Instance with High/Critical vulnerabilities",
                                "category_remediation": "1. Click on the instance node for the attack path to view details about the node.\n2. Find the vulnerabilities tab to see vulnerabilites.\n3. From there you can find out where the vuln scan came from ie Inspector, IVM, HVA.\n4. Refer to the originating scanner's content for instructions to remediate.\n",
                                "discovered_timestamp": "2024-05-21T18:08:05",
                                "id": 93800,
                                "path_length": 7,
                                "risk_score": 800.0,
                                "severity": "High",
                                "source_resource_id": "internet:internet",
                                "source_resource_name": "Internet",
                                "source_resource_type": "internet",
                                "target_account_id": "014578312761",
                                "target_account_name": "AWS-SSE",
                                "target_account_type": "AWS",
                                "target_application_id": null,
                                "target_application_name": null,
                                "target_organization_service_id": 1496,
                                "target_resource_id": "instance:1496:ap-southeast-2:i-05b3dbcd997404213:",
                                "target_resource_name": "k8-master",
                                "target_resource_type": "instance"
                              }
                            ]
                          }
                        },
                        "errors": [
                          
                        ]
                      }
                    }
              schema:
                type: object
                properties:
                  provider-id-1:
                    type: object
                    properties:
                      resource_details:
                        type: object
                        properties:
                          dependencies:
                            type: object
                            properties:
                              networkinterface:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    id:
                                      type: string
                                      example: network-interface-id
                                    name:
                                      type: string
                                      example: nic0
                                    resource_id:
                                      type: string
                                      example: 'networkinterface:6:europe-west1:network-interface-id:'
                                    type:
                                      type: string
                                      example: networkinterface
                              privatenetwork:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    id:
                                      type: string
                                      example: '12345678912345678901'
                                    name:
                                      type: string
                                      example: default
                                    resource_id:
                                      type: string
                                      example: 'privatenetwork:6::12345678912345678901:'
                                    type:
                                      type: string
                                      example: privatenetwork
                              resourceaccesslist:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    id:
                                      type: string
                                      example: '12345678912345678901'
                                    name:
                                      type: string
                                      example: r7-vpn-allow-ssh
                                    resource_id:
                                      type: string
                                      example: 'resourceaccesslist:6::12345678912345678901:'
                                    type:
                                      type: string
                                      example: resourceaccesslist
                              servicerole:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    id:
                                      type: string
                                      example: '12345678912345678901'
                                    name:
                                      type: string
                                      example: 123456789123@project.gserviceaccount.com
                                    resource_id:
                                      type: string
                                      example: 'servicerole:6:12345678912345678901:'
                                    type:
                                      type: string
                                      example: servicerole
                              volume:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    id:
                                      type: string
                                      example: volume-id
                                    name:
                                      type: string
                                      example: volume-name
                                    resource_id:
                                      type: string
                                      example: 'volume:6:europe-west1:volume-id:'
                                    type:
                                      type: string
                                      example: volume
                          details:
                            type: object
                            properties:
                              instance:
                                type: object
                                properties:
                                  common:
                                    type: object
                                    properties:
                                      account:
                                        type: string
                                        example: GCP
                                      account_id:
                                        type: string
                                        example: account-id
                                      account_status:
                                        type: string
                                        example: REFRESH
                                      auto_id:
                                        type: integer
                                        example: 105
                                        default: 0
                                      availability_zone:
                                        type: string
                                        example: europe-west1-b
                                      cloud:
                                        type: string
                                        example: GCE
                                      creation_timestamp:
                                        type: string
                                        example: '2023-03-29 10:09:12'
                                      direct_link:
                                        type: string
                                        example: https://console.cloud.google.com/compute/instancesDetail/zones/europe-west1-b/instances/volume-id?project=my-project
                                      discovered_timestamp:
                                        type: string
                                        example: '2023-04-03 09:26:38'
                                      last_harvested_timestamp:
                                        type: string
                                        example: '2023-06-11T07:19:12'
                                      modified_timestamp:
                                        type: string
                                        example: '2023-04-04 16:35:52'
                                      noncompliance:
                                        type: array
                                      organization_service_id:
                                        type: integer
                                        example: 6
                                        default: 0
                                      properties:
                                        type: object
                                        properties:
                                          property_list:
                                            type: array
                                            items:
                                              type: object
                                              properties:
                                                name:
                                                  type: string
                                                  example: divvy.default_service_account
                                                parent_resource_id:
                                                  type: string
                                                  example: 'instance:6:europe-west1:volume-id:'
                                                type_hint:
                                                  type: string
                                                  example: bool
                                                value:
                                                  type: string
                                                  example: '1'
                                      provider_id:
                                        type: string
                                        example: volume-id
                                      region:
                                        type: string
                                        example: europe-west1
                                      resource_id:
                                        type: string
                                        example: 'instance:6:europe-west1:volume-id:'
                                      resource_name:
                                        type: string
                                        example: volume-id
                                      resource_type:
                                        type: string
                                        example: instance
                                      tags:
                                        type: object
                                        properties:
                                          ja:
                                            type: string
                                            example: hva
                                  create_time:
                                    type: string
                                    example: '2023-03-29 10:09:12'
                                  image_id:
                                    type: string
                                    example: '7157337275614620995'
                                  instance_id:
                                    type: string
                                    example: volume-id
                                  instance_type:
                                    type: string
                                    example: e2-micro
                                  launch_time:
                                    type: string
                                    example: '2023-03-29 10:09:21'
                                  network_interfaces:
                                    type: array
                                    items:
                                      type: object
                                      properties:
                                        common:
                                          type: object
                                          properties:
                                            account:
                                              type: string
                                              example: GCP
                                            account_id:
                                              type: string
                                              example: account-id
                                            account_status:
                                              type: string
                                              example: REFRESH
                                            auto_id:
                                              type: integer
                                              example: 138
                                              default: 0
                                            cloud:
                                              type: string
                                              example: GCE
                                            creation_timestamp:
                                              type: string
                                              example: None
                                            discovered_timestamp:
                                              type: string
                                              example: '2023-04-03 09:26:38'
                                            modified_timestamp:
                                              type: string
                                              example: '2023-04-03 09:26:38'
                                            organization_service_id:
                                              type: integer
                                              example: 6
                                              default: 0
                                            provider_id:
                                              type: string
                                              example: network-interface-id
                                            region:
                                              type: string
                                              example: europe-west1
                                            resource_id:
                                              type: string
                                              example: 'networkinterface:6:europe-west1:network-interface-id:'
                                            resource_name:
                                              type: string
                                              example: network-interface-name
                                            resource_type:
                                              type: string
                                              example: networkinterface
                                            tags:
                                              type: object
                                              properties:
                                                ja:
                                                  type: string
                                                  example: hva
                                        device_index:
                                          type: integer
                                          example: 0
                                          default: 0
                                        instance_id:
                                          type: string
                                          example: volume-id
                                        instance_resource_id:
                                          type: string
                                          example: 'instance:6:europe-west1:volume-id:'
                                        ip_addresses:
                                          type: array
                                          items:
                                            type: object
                                            properties:
                                              ip_address:
                                                type: string
                                                example: 123.123.123.123
                                              ip_address_type:
                                                type: string
                                                example: Ipv4PublicAddress
                                        network_interface_id:
                                          type: string
                                          example: network-interface-id
                                        network_resource_id:
                                          type: string
                                          example: 'privatenetwork:6::12345678912345678901:'
                                        private_ip_address:
                                          type: string
                                          example: 123.123.123.123
                                  network_resource_id:
                                    type: string
                                    example: 'privatenetwork:6::12345678912345678901:'
                                  object_id:
                                    type: string
                                    example: '12345678912345678901'
                                  platform:
                                    type: string
                                    example: linux
                                  private_ip_address:
                                    type: string
                                    example: 123.123.123.123
                                  public_ip_address:
                                    type: string
                                    example: 123.123.123.123
                                  role_resource_id:
                                    type: string
                                    example: 'servicerole:6:12345678912345678901:'
                                  state:
                                    type: string
                                    example: running
                                  termination_protection:
                                    type: boolean
                                    example: false
                                    default: true
                                  vulnerability_sources:
                                    type: array
                              resource_type:
                                type: string
                                example: instance
                              security_account_email:
                                type: string
                                example: security@rapid7.com
                      resource_insights:
                        type: object
                        properties:
                          Critical:
                            type: object
                            properties:
                              count:
                                type: integer
                                example: 1
                                default: 0
                              insights:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    author:
                                      type: string
                                      example: InsightCloudSec
                                    description:
                                      type: string
                                      example: Identify Compute Instances With a Public IP Address That is Exposing Windows RDP
                                    identified_on:
                                      type: string
                                      example: '2023-06-01 16:48:57'
                                    insight_id:
                                      type: integer
                                      example: 281
                                      default: 0
                                    name:
                                      type: string
                                      example: Instance with a Public IP Exposing RDP
                                    notes:
                                      type: string
                                      example: |-
                                        ## Overview
                                        Security groups provide stateful filtering of ingress/egress network traffic to cloud resources. It is recommended that no security group allows unrestricted ingress access to port 3389.

                                        This Insight identities compute instances with a public IP address and that is exposing Windows RDP.

                                        ### Supported Clouds
                                        **This Insight supports the following clouds:**
                                        * Amazon Web Services, Amazon Web Services China, Amazon Web Services Government
                                        * Microsoft Azure
                                        * Google Cloud Platform

                                        **Supported Infrastructure as Code Clouds:**
                                        * Amazon Web Services
                                        * Microsoft Azure
                                        * Google Cloud Platform

                                        Supported clouds are specific to this Insight and may vary for any associated filter(s).

                                        ## Recommended Remediation
                                        Leverage Bot automation to identify and monitor for compute instances that are exposing RDP via port 3389 and have a public IP address attached.
                                        ### Bot Recommendations
                                        * Mark Resource Noncompliant: Flag compute instances that have been identified as having RDP exposed and a public IP address attached.
                                        * Send Email/Instant Notification: Notify operations/security team of the compute instances that are exposing RDP and have a public IP address attached. Separately, using cloud badges, identify cloud account owners and notify them of the non-compliant compute instances and the steps required to disable RDP and/or remove the public IP address.


                                        ### Remediation Reference Links
                                        For more information on Identifying compute instances with a public IP address and that is exposing Windows RDP, follow these links:

                                        **Amazon Web Services**

                                        - https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/authorizing-access-to-an-instance.html

                                        **Microsoft Azure**

                                         - https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

                                        **Google Cloud Platform**

                                        - https://cloud.google.com/vpc/docs/firewalls

                                        ### Compliance Information
                                          - NIST 800-53 (Rev 4): AC-17, AC-17(1), AC-6, RA-5, SA-17(7), SC-7, SC-8
                                          - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction
                                          - HIPAA: Access Control - § 164.312(a)(1), No ePHI Should Be Publicly Accessible
                                          - SOC 2: CC5.2, CC6.1, CC6.3, CC6.6
                                          - PCI DSS Pack: 6.6, 7.1, 7.2, Requirement 1.3
                                          - NIST Cybersecurity Framework: DE.CM-7, PR.AC-3, PR.AC-4, PR.AC-5, PR.DS-5
                                          - HITRUST v9.4: 0724.07a3Organizational.4, 0814.01n1Organizational.12, 0818.01w3System.12, 0855.01wCMSOrganizational.2, 0856.01wFTIOrganizational.4, 0857.01wHIXOrganizational.1, 11123.01qPCIOrganizational.3, 1114.01h1Organizational.123, 1117.01j1Organizational.23, 1118.01j2Organizational.124, 11192.01cHIXSystem.2, 1164.01cHIESystem.1, 1165.01cPCISystem.1, 1179.01j3Organizational.1, 1403.05i1Organizational.67, 1424.05j2Organizational.5, 1427.05jFTIOrganizational.3, 1802.08b1Organizational.3, 19141.06c1Organizational.7, 19153.06dFTIOrganizational.12, 19910.06cSROrganizational.2
                                          - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b, 500.14.a
                                          - NIST 800-53 (Rev 5): AC-4, AC-4 (21), AC-6, AC-17, AC-17 (1), AC-21, CM-7, CM-7 (1), SC-7, SC-7 (3), SC-7 (4), SC-7 (5), SC-7 (9), SC-7 (10), SC-7 (11), SC-7 (16), SC-7 (20), SC-7 (21)
                                          - NIST 800-171: 3.1.1, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.13.1, 3.13.2
                                          - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09
                                          - Microsoft Cloud Security Benchmark: NS-1, NS-2, NS-3
                                          - MITRE Att&ck Mitigation Pack: M1015, M1039, M1035, M1030
                                          - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks
                                          - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture
                                    severity:
                                      type: string
                                      example: Critical
                                    source:
                                      type: string
                                      example: core
                      vulnerabilities:
                        type: object
                        properties:
                          count:
                            type: integer
                            example: 1
                          vulnerabilities:
                            type: array
                            items:
                              type: object
                              properties:
                                cvss_score:
                                  type: integer
                                  example: 9.8
                                description:
                                  type: string
                                  example: CVE-2023-5178 - linux
                                name:
                                  type: string
                                  example: CVE-2023-5178
                                package:
                                  type: string
                                  example: pack
                                severity:
                                  type: string
                                  example: CRITICAL
                                source:
                                  type: string
                                  example: inspectorv2
                                uri:
                                  type: string
                                  example: https://security-tracker.debian.org/tracker/CVE-2023-5178
                      threat_findings:
                        type: object
                        properties:
                          high:
                            type: object
                            properties:
                              count:
                                type: integer
                                example: 1
                                default: 0
                              threat_findings:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    name:
                                      type: string
                                      example: Policy:IAMUser/S3BucketSharedExternally
                                    resource_id:
                                      type: string
                                      example: 'storagecontainer:1:us-east-1:storage-container-id:'
                                    severity:
                                      type: string
                                      example: high
                                    direct_link:
                                      type: string
                                      example: https://docs.aws.amazon.com/macie/latest/user/findings-types.html#findings-policy-types
                                    affected_resource_id:
                                      type: string
                                      example: 'storagecontainer:1:us-east-1:storage-container-id:'
                                    finding_id:
                                      type: string
                                      example: finding-id
                                    count:
                                      type: integer
                                      example: 1
                                      default: 0
                                    event_first_seen:
                                      type: string
                                      example: '2023-04-30 06:08:42'
                                    event_last_seen:
                                      type: string
                                      example: '2023-04-30 06:08:42'
                                    details:
                                      type: object
                                      properties:
                                        accountId:
                                          type: string
                                          example: '123456789123'
                                        archived:
                                          type: boolean
                                          example: false
                                          default: true
                                        category:
                                          type: string
                                          example: POLICY
                                        count:
                                          type: integer
                                          example: 1
                                          default: 0
                                        createdAt:
                                          type: string
                                          example: '2023-04-30 06:08:42.895000+00:00'
                                        description:
                                          type: string
                                          example: The access control list (ACL) or bucket policy for the Amazon S3 bucket allows the bucket to be shared with an AWS account that isn’t part of your Amazon Macie organization.
                                        id:
                                          type: string
                                          example: finding-id
                                        partition:
                                          type: string
                                          example: aws
                                        policyDetails:
                                          type: object
                                          properties:
                                            action:
                                              type: object
                                              properties:
                                                actionType:
                                                  type: string
                                                  example: AWS_API_CALL
                                                apiCallDetails:
                                                  type: object
                                                  properties:
                                                    api:
                                                      type: string
                                                      example: PutBucketPolicy
                                                    apiServiceName:
                                                      type: string
                                                      example: s3.amazonaws.com
                                                    firstSeen:
                                                      type: string
                                                      example: '2023-04-30 06:05:27+00:00'
                                                    lastSeen:
                                                      type: string
                                                      example: '2023-04-30 06:05:27+00:00'
                                            actor:
                                              type: object
                                              properties:
                                                ipAddressDetails:
                                                  type: object
                                                  properties:
                                                    ipAddressV4:
                                                      type: string
                                                      example: 123.123.123.123
                                                    ipCity:
                                                      type: object
                                                      properties:
                                                        name:
                                                          type: string
                                                          example: Somewhere
                                                    ipCountry:
                                                      type: object
                                                      properties:
                                                        code:
                                                          type: string
                                                          example: US
                                                        name:
                                                          type: string
                                                          example: United States
                                                    ipGeoLocation:
                                                      type: object
                                                      properties:
                                                        lat:
                                                          type: integer
                                                          example: 0
                                                          default: 0
                                                        lon:
                                                          type: integer
                                                          example: 0
                                                          default: 0
                                                    ipOwner:
                                                      type: object
                                                      properties:
                                                        asn:
                                                          type: string
                                                          example: '12345'
                                                        asnOrg:
                                                          type: string
                                                          example: ABCD
                                                        isp:
                                                          type: string
                                                          example: ABCD Corp.
                                                        org:
                                                          type: string
                                                          example: ABCD Corp.
                                                userIdentity:
                                                  type: object
                                                  properties:
                                                    assumedRole:
                                                      type: object
                                                      properties:
                                                        accessKeyId:
                                                          type: string
                                                          example: ACCESSKEY
                                                        accountId:
                                                          type: string
                                                          example: '123456789123'
                                                        arn:
                                                          type: string
                                                          example: arn:aws:sts::123456789123:assumed-role/developer/john-do@rapid7.com
                                                        principalId:
                                                          type: string
                                                          example: principal-id:john-doe@rapid7.com
                                                        sessionContext:
                                                          type: object
                                                          properties:
                                                            attributes:
                                                              type: object
                                                              properties:
                                                                creationDate:
                                                                  type: string
                                                                  example: '2023-04-30 05:47:59+00:00'
                                                                mfaAuthenticated:
                                                                  type: boolean
                                                                  example: false
                                                                  default: true
                                                            sessionIssuer:
                                                              type: object
                                                              properties:
                                                                accountId:
                                                                  type: string
                                                                  example: '123456789123'
                                                                arn:
                                                                  type: string
                                                                  example: arn:aws:iam::123456789123:role/assumable/developer
                                                                principalId:
                                                                  type: string
                                                                  example: principal-id
                                                                type:
                                                                  type: string
                                                                  example: Role
                                                                userName:
                                                                  type: string
                                                                  example: developer
                                                    type:
                                                      type: string
                                                      example: AssumedRole
                                        region:
                                          type: string
                                          example: us-east-1
                                        resourcesAffected:
                                          type: object
                                          properties:
                                            s3Bucket:
                                              type: object
                                              properties:
                                                allowsUnencryptedObjectUploads:
                                                  type: string
                                                  example: 'TRUE'
                                                arn:
                                                  type: string
                                                  example: arn:aws:s3:::storage-container-id
                                                createdAt:
                                                  type: string
                                                  example: '2023-04-17 20:31:27+00:00'
                                                defaultServerSideEncryption:
                                                  type: object
                                                  properties:
                                                    encryptionType:
                                                      type: string
                                                      example: AES256
                                                name:
                                                  type: string
                                                  example: storage-container-id
                                                owner:
                                                  type: object
                                                  properties:
                                                    displayName:
                                                      type: string
                                                      example: amazon+rapid7+owner
                                                    id:
                                                      type: string
                                                      example: owner-id
                                                publicAccess:
                                                  type: object
                                                  properties:
                                                    effectivePermission:
                                                      type: string
                                                      example: NOT_PUBLIC
                                                    permissionConfiguration:
                                                      type: object
                                                      properties:
                                                        accountLevelPermissions:
                                                          type: object
                                                          properties:
                                                            blockPublicAccess:
                                                              type: object
                                                              properties:
                                                                blockPublicAcls:
                                                                  type: boolean
                                                                  example: true
                                                                  default: true
                                                                blockPublicPolicy:
                                                                  type: boolean
                                                                  example: true
                                                                  default: true
                                                                ignorePublicAcls:
                                                                  type: boolean
                                                                  example: true
                                                                  default: true
                                                                restrictPublicBuckets:
                                                                  type: boolean
                                                                  example: true
                                                                  default: true
                                                        bucketLevelPermissions:
                                                          type: object
                                                          properties:
                                                            accessControlList:
                                                              type: object
                                                              properties:
                                                                allowsPublicReadAccess:
                                                                  type: boolean
                                                                  example: false
                                                                  default: true
                                                                allowsPublicWriteAccess:
                                                                  type: boolean
                                                                  example: false
                                                                  default: true
                                                            blockPublicAccess:
                                                              type: object
                                                              properties:
                                                                blockPublicAcls:
                                                                  type: boolean
                                                                  example: true
                                                                  default: true
                                                                blockPublicPolicy:
                                                                  type: boolean
                                                                  example: true
                                                                  default: true
                                                                ignorePublicAcls:
                                                                  type: boolean
                                                                  example: true
                                                                  default: true
                                                                restrictPublicBuckets:
                                                                  type: boolean
                                                                  example: true
                                                                  default: true
                                                            bucketPolicy:
                                                              type: object
                                                              properties:
                                                                allowsPublicReadAccess:
                                                                  type: boolean
                                                                  example: false
                                                                  default: true
                                                                allowsPublicWriteAccess:
                                                                  type: boolean
                                                                  example: false
                                                                  default: true
                                                tags:
                                                  type: array
                                        sample:
                                          type: boolean
                                          example: false
                                          default: true
                                        schemaVersion:
                                          type: string
                                          example: '1.0'
                                        severity:
                                          type: object
                                          properties:
                                            description:
                                              type: string
                                              example: High
                                            score:
                                              type: integer
                                              example: 3
                                              default: 0
                                        title:
                                          type: string
                                          example: The S3 bucket is shared with an external AWS account.
                                        type:
                                          type: string
                                          example: Policy:IAMUser/S3BucketSharedExternally
                                        updatedAt:
                                          type: string
                                          example: '2023-04-30 06:08:42.895000+00:00'
                                    finding_source:
                                      type: string
                                      example: AWS Macie
                      application_context:
                        type: array
                        items:
                          type: object
                          properties:
                            app:
                              type: object
                              properties:
                                accounts:
                                  type: integer
                                  example: 1
                                  default: 0
                                application:
                                  type: string
                                  example: ICS application
                                block_storage_gb:
                                  type: integer
                                  example: 0
                                  default: 0
                                business_critical:
                                  type: boolean
                                  example: false
                                  default: true
                                category:
                                  type: string
                                  example: other
                                clouds:
                                  type: array
                                  items:
                                    type: string
                                    example: AZURE_ARM
                                cores:
                                  type: integer
                                  example: 0
                                  default: 0
                                is_favourite:
                                  type: boolean
                                  example: false
                                  default: true
                                name: {}
                                object_storage_bytes:
                                  type: integer
                                  example: 0
                                  default: 0
                                poc: {}
                                resource_count:
                                  type: integer
                                  example: 3
                                  default: 0
                            tags:
                              type: object
                              properties:
                                Application:
                                  type: object
                                  properties:
                                    value:
                                      type: string
                                      example: ICS Automation
                                    user_defiened:
                                      type: boolean
                                      example: true
                                      default: true
                                Owner:
                                  type: object
                                  properties:
                                    value:
                                      type: string
                                      example: ICS QA Team
                                    user_defiened:
                                      type: boolean
                                      example: true
                                      default: true
                      permissions:
                        type: array
                        items:
                          type: object
                          properties:
                            action:
                              type: string
                              example: compute.snapshots.getIamPolicy
                            count:
                              type: integer
                              example: 1
                              default: 0
                            last_executed_date:
                              type: string
                              example: '2023-05-31 17:39:07.217902'
                            permission:
                              type: string
                              example: compute.snapshots.getIamPolicy
                            status:
                              type: string
                              example: Used
                      related_resources:
                        type: array
                        items:
                          type: object
                          properties:
                            cloud_type_id:
                              type: string
                              example: GCE
                            id:
                              type: string
                              example: network-interface-id
                            info:
                              type: object
                              properties:
                                description_template:
                                  type: string
                                  example: '{source} has network interface {target}'
                                extra_info:
                                  type: object
                                  properties: {}
                                label:
                                  type: string
                                  example: HAS_NETWORK_INTERFACE
                                other_resource_type:
                                  type: string
                                  example: networkinterface
                                resource_type:
                                  type: string
                                  example: instance
                                source:
                                  type: boolean
                                  example: true
                                  default: true
                                source_or_target:
                                  type: string
                                  example: source
                            name:
                              type: string
                              example: nic0
                            resource_id:
                              type: string
                              example: 'networkinterface:6:europe-west1:network-interface-id:'
                            type:
                              type: string
                              example: networkinterface
                      attack_path:
                        type: object
                        properties:
                          Critical:
                            type: object
                            properties:
                              count:
                                type: integer
                                example: 1
                                default: 0
                              paths:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    author:
                                      type: string
                                      example: rapid7
                                    category_description:
                                      type: string
                                      example: This attack path definition looks for any publicly-available instances and checks to see if any of them have a high/critical vulnerability severity. This can lead to the instance being exploited, so it should be treated as high priority.
                                    category_id:
                                      type: string
                                      example: apa.publicly_high_vuln_sev_esc
                                    category_impact:
                                      type: string
                                      example: An attacker may be able to access the instance via the internet and exploit the vulnerability to execute code.
                                    category_labels:
                                      type: array
                                      items:
                                        type: string
                                        example: Compute Abuse
                                    category_name:
                                      type: string
                                      example: Publicly Exposed Compute Instance with High/Critical vulnerabilities
                                    category_remediation:
                                      type: string
                                      example: |
                                        1. Click on the instance node for the attack path to view details about the node.
                                        2. Find the vulnerabilities tab to see vulnerabilites.
                                        3. From there you can find out where the vuln scan came from ie Inspector, IVM, HVA.
                                        4. Refer to the originating scanner's content for instructions to remediate.
                                    discovered_timestamp:
                                      type: string
                                      example: '2024-05-21T18:08:05'
                                    id:
                                      type: integer
                                      example: 10000
                                    path_length:
                                      type: integer
                                      example: 7
                                    risk_score:
                                      type: number
                                      example: 800
                                    severity:
                                      type: string
                                      example: High
                                    source_resource_id:
                                      type: string
                                      example: internet:internet
                                    source_resource_name:
                                      type: string
                                      example: Internet
                                    source_resource_type:
                                      type: string
                                      example: internet
                                    target_account_id:
                                      type: string
                                      example: '123456789123'
                                    target_account_name:
                                      type: string
                                      example: AWS-SSE
                                    target_account_type:
                                      type: string
                                      example: AWS
                                    target_application_id:
                                      type: string
                                    target_application_name:
                                      type: string
                                    target_organization_service_id:
                                      type: string
                                      example: '1234'
                                    target_resource_id:
                                      type: string
                                      example: 'instance:1111:ap-southeast-2:i-11b1dbcd111111111:'
                                    target_resource_name:
                                      type: string
                                      example: k8-master
                                    target_resource_type:
                                      type: string
                                      example: instance
                  provider-id-2:
                    type: object
                    properties:
                      resource_details:
                        type: object
                        properties:
                          dependencies:
                            type: object
                            properties:
                              networkinterface:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    id:
                                      type: string
                                      example: network-interface-id
                                    name:
                                      type: string
                                      example: nic0
                                    resource_id:
                                      type: string
                                      example: 'networkinterface:6:europe-west1:network-interface-id:'
                                    type:
                                      type: string
                                      example: networkinterface
                              privatenetwork:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    id:
                                      type: string
                                      example: '12345678912345678901'
                                    name:
                                      type: string
                                      example: default
                                    resource_id:
                                      type: string
                                      example: 'privatenetwork:6::12345678912345678901:'
                                    type:
                                      type: string
                                      example: privatenetwork
                              resourceaccesslist:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    id:
                                      type: string
                                      example: '12345678912345678901'
                                    name:
                                      type: string
                                      example: r7-vpn-allow-ssh
                                    resource_id:
                                      type: string
                                      example: 'resourceaccesslist:6::12345678912345678901:'
                                    type:
                                      type: string
                                      example: resourceaccesslist
                              servicerole:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    id:
                                      type: string
                                      example: '12345678912345678901'
                                    name:
                                      type: string
                                      example: 123456789123@project.gserviceaccount.com
                                    resource_id:
                                      type: string
                                      example: 'servicerole:6:12345678912345678901:'
                                    type:
                                      type: string
                                      example: servicerole
                              volume:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    id:
                                      type: string
                                      example: volume-id
                                    name:
                                      type: string
                                      example: volume-name
                                    resource_id:
                                      type: string
                                      example: 'volume:6:europe-west1:volume-id:'
                                    type:
                                      type: string
                                      example: volume
                          details:
                            type: object
                            properties:
                              instance:
                                type: object
                                properties:
                                  common:
                                    type: object
                                    properties:
                                      account:
                                        type: string
                                        example: GCP
                                      account_id:
                                        type: string
                                        example: account-id
                                      account_status:
                                        type: string
                                        example: REFRESH
                                      auto_id:
                                        type: integer
                                        example: 105
                                        default: 0
                                      availability_zone:
                                        type: string
                                        example: europe-west1-b
                                      cloud:
                                        type: string
                                        example: GCE
                                      creation_timestamp:
                                        type: string
                                        example: '2023-03-29 10:09:12'
                                      direct_link:
                                        type: string
                                        example: https://console.cloud.google.com/compute/instancesDetail/zones/europe-west1-b/instances/volume-id?project=my-project
                                      discovered_timestamp:
                                        type: string
                                        example: '2023-04-03 09:26:38'
                                      last_harvested_timestamp:
                                        type: string
                                        example: '2023-06-11T07:19:12'
                                      modified_timestamp:
                                        type: string
                                        example: '2023-04-04 16:35:52'
                                      noncompliance:
                                        type: array
                                      organization_service_id:
                                        type: integer
                                        example: 6
                                        default: 0
                                      properties:
                                        type: object
                                        properties:
                                          property_list:
                                            type: array
                                            items:
                                              type: object
                                              properties:
                                                name:
                                                  type: string
                                                  example: divvy.default_service_account
                                                parent_resource_id:
                                                  type: string
                                                  example: 'instance:6:europe-west1:volume-id:'
                                                type_hint:
                                                  type: string
                                                  example: bool
                                                value:
                                                  type: string
                                                  example: '1'
                                      provider_id:
                                        type: string
                                        example: volume-id
                                      region:
                                        type: string
                                        example: europe-west1
                                      resource_id:
                                        type: string
                                        example: 'instance:6:europe-west1:volume-id:'
                                      resource_name:
                                        type: string
                                        example: volume-id
                                      resource_type:
                                        type: string
                                        example: instance
                                      tags:
                                        type: object
                                        properties:
                                          ja:
                                            type: string
                                            example: hva
                                  create_time:
                                    type: string
                                    example: '2023-03-29 10:09:12'
                                  image_id:
                                    type: string
                                    example: '7157337275614620995'
                                  instance_id:
                                    type: string
                                    example: volume-id
                                  instance_type:
                                    type: string
                                    example: e2-micro
                                  launch_time:
                                    type: string
                                    example: '2023-03-29 10:09:21'
                                  network_interfaces:
                                    type: array
                                    items:
                                      type: object
                                      properties:
                                        common:
                                          type: object
                                          properties:
                                            account:
                                              type: string
                                              example: GCP
                                            account_id:
                                              type: string
                                              example: account-id
                                            account_status:
                                              type: string
                                              example: REFRESH
                                            auto_id:
                                              type: integer
                                              example: 138
                                              default: 0
                                            cloud:
                                              type: string
                                              example: GCE
                                            creation_timestamp:
                                              type: string
                                              example: None
                                            discovered_timestamp:
                                              type: string
                                              example: '2023-04-03 09:26:38'
                                            modified_timestamp:
                                              type: string
                                              example: '2023-04-03 09:26:38'
                                            organization_service_id:
                                              type: integer
                                              example: 6
                                              default: 0
                                            provider_id:
                                              type: string
                                              example: network-interface-id
                                            region:
                                              type: string
                                              example: europe-west1
                                            resource_id:
                                              type: string
                                              example: 'networkinterface:6:europe-west1:network-interface-id:'
                                            resource_name:
                                              type: string
                                              example: network-interface-name
                                            resource_type:
                                              type: string
                                              example: networkinterface
                                            tags:
                                              type: object
                                              properties:
                                                ja:
                                                  type: string
                                                  example: hva
                                        device_index:
                                          type: integer
                                          example: 0
                                          default: 0
                                        instance_id:
                                          type: string
                                          example: volume-id
                                        instance_resource_id:
                                          type: string
                                          example: 'instance:6:europe-west1:volume-id:'
                                        ip_addresses:
                                          type: array
                                          items:
                                            type: object
                                            properties:
                                              ip_address:
                                                type: string
                                                example: 123.123.123.123
                                              ip_address_type:
                                                type: string
                                                example: Ipv4PublicAddress
                                        network_interface_id:
                                          type: string
                                          example: network-interface-id
                                        network_resource_id:
                                          type: string
                                          example: 'privatenetwork:6::12345678912345678901:'
                                        private_ip_address:
                                          type: string
                                          example: 123.123.123.123
                                  network_resource_id:
                                    type: string
                                    example: 'privatenetwork:6::12345678912345678901:'
                                  object_id:
                                    type: string
                                    example: '12345678912345678901'
                                  platform:
                                    type: string
                                    example: linux
                                  private_ip_address:
                                    type: string
                                    example: 123.123.123.123
                                  public_ip_address:
                                    type: string
                                    example: 123.123.123.123
                                  role_resource_id:
                                    type: string
                                    example: 'servicerole:6:12345678912345678901:'
                                  state:
                                    type: string
                                    example: running
                                  termination_protection:
                                    type: boolean
                                    example: false
                                    default: true
                                  vulnerability_sources:
                                    type: array
                              resource_type:
                                type: string
                                example: instance
                      resource_insights:
                        type: object
                        properties:
                          Critical:
                            type: object
                            properties:
                              count:
                                type: integer
                                example: 1
                                default: 0
                              insights:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    author:
                                      type: string
                                      example: InsightCloudSec
                                    description:
                                      type: string
                                      example: Identify Compute Instances With a Public IP Address That is Exposing Windows RDP
                                    identified_on:
                                      type: string
                                      example: '2023-06-01 16:48:57'
                                    insight_id:
                                      type: integer
                                      example: 281
                                      default: 0
                                    name:
                                      type: string
                                      example: Instance with a Public IP Exposing RDP
                                    notes:
                                      type: string
                                      example: |-
                                        ## Overview
                                        Security groups provide stateful filtering of ingress/egress network traffic to cloud resources. It is recommended that no security group allows unrestricted ingress access to port 3389.

                                        This Insight identities compute instances with a public IP address and that is exposing Windows RDP.

                                        ### Supported Clouds
                                        **This Insight supports the following clouds:**
                                        * Amazon Web Services, Amazon Web Services China, Amazon Web Services Government
                                        * Microsoft Azure
                                        * Google Cloud Platform

                                        **Supported Infrastructure as Code Clouds:**
                                        * Amazon Web Services
                                        * Microsoft Azure
                                        * Google Cloud Platform

                                        Supported clouds are specific to this Insight and may vary for any associated filter(s).

                                        ## Recommended Remediation
                                        Leverage Bot automation to identify and monitor for compute instances that are exposing RDP via port 3389 and have a public IP address attached.
                                        ### Bot Recommendations
                                        * Mark Resource Noncompliant: Flag compute instances that have been identified as having RDP exposed and a public IP address attached.
                                        * Send Email/Instant Notification: Notify operations/security team of the compute instances that are exposing RDP and have a public IP address attached. Separately, using cloud badges, identify cloud account owners and notify them of the non-compliant compute instances and the steps required to disable RDP and/or remove the public IP address.


                                        ### Remediation Reference Links
                                        For more information on Identifying compute instances with a public IP address and that is exposing Windows RDP, follow these links:

                                        **Amazon Web Services**

                                        - https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/authorizing-access-to-an-instance.html

                                        **Microsoft Azure**

                                         - https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

                                        **Google Cloud Platform**

                                        - https://cloud.google.com/vpc/docs/firewalls

                                        ### Compliance Information
                                          - NIST 800-53 (Rev 4): AC-17, AC-17(1), AC-6, RA-5, SA-17(7), SC-7, SC-8
                                          - ISO 27001:2013: A.13.1.1 - Network controls, A.9.1.2 - Access to networks and network services, A.9.4.1 - Information access restriction
                                          - HIPAA: Access Control - § 164.312(a)(1), No ePHI Should Be Publicly Accessible
                                          - SOC 2: CC5.2, CC6.1, CC6.3, CC6.6
                                          - PCI DSS Pack: 6.6, 7.1, 7.2, Requirement 1.3
                                          - NIST Cybersecurity Framework: DE.CM-7, PR.AC-3, PR.AC-4, PR.AC-5, PR.DS-5
                                          - HITRUST v9.4: 0724.07a3Organizational.4, 0814.01n1Organizational.12, 0818.01w3System.12, 0855.01wCMSOrganizational.2, 0856.01wFTIOrganizational.4, 0857.01wHIXOrganizational.1, 11123.01qPCIOrganizational.3, 1114.01h1Organizational.123, 1117.01j1Organizational.23, 1118.01j2Organizational.124, 11192.01cHIXSystem.2, 1164.01cHIESystem.1, 1165.01cPCISystem.1, 1179.01j3Organizational.1, 1403.05i1Organizational.67, 1424.05j2Organizational.5, 1427.05jFTIOrganizational.3, 1802.08b1Organizational.3, 19141.06c1Organizational.7, 19153.06dFTIOrganizational.12, 19910.06cSROrganizational.2
                                          - NYDFS NYCCR 500: 500.2.b.1, 500.2.b.2, 500.2.b.3, 500.5.b, 500.14.a
                                          - NIST 800-53 (Rev 5): AC-4, AC-4 (21), AC-6, AC-17, AC-17 (1), AC-21, CM-7, CM-7 (1), SC-7, SC-7 (3), SC-7 (4), SC-7 (5), SC-7 (9), SC-7 (10), SC-7 (11), SC-7 (16), SC-7 (20), SC-7 (21)
                                          - NIST 800-171: 3.1.1, 3.1.2, 3.1.3, 3.1.12, 3.1.14, 3.1.20, 3.13.1, 3.13.2
                                          - CSA CCM V4: IAM-03, IAM-05, IAM-08, IAM-16, IVS-03, LOG-04, LOG-09
                                          - Microsoft Cloud Security Benchmark: NS-1, NS-2, NS-3
                                          - MITRE Att&ck Mitigation Pack: M1015, M1039, M1035, M1030
                                          - ISO 27001:2022: 5.15: Access control, 5.18: Access rights, 8.3: Information access restriction, 8.4: Access to source code, 8.20: Network security, 8.22: Segregation of networks
                                          - CIS Controls v8: 3.3: Configure Data Access Control Lists, 12.2: Establish and Maintain a Secure Network Architecture
                                    severity:
                                      type: string
                                      example: Critical
                                    source:
                                      type: string
                                      example: core
                      vulnerabilities:
                        type: object
                        properties:
                          count:
                            type: integer
                            example: 1
                          vulnerabilities:
                            type: array
                            items:
                              type: object
                              properties:
                                cvss_score:
                                  type: integer
                                  example: 9.8
                                description:
                                  type: string
                                  example: CVE-2023-5178 - linux
                                name:
                                  type: string
                                  example: CVE-2023-5178
                                package:
                                  type: string
                                  example: pack
                                severity:
                                  type: string
                                  example: CRITICAL
                                source:
                                  type: string
                                  example: inspectorv2
                                uri:
                                  type: string
                                  example: https://security-tracker.debian.org/tracker/CVE-2023-5178
                      threat_findings:
                        type: object
                        properties:
                          high:
                            type: object
                            properties:
                              count:
                                type: integer
                                example: 1
                                default: 0
                              threat_findings:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    name:
                                      type: string
                                      example: Policy:IAMUser/S3BucketSharedExternally
                                    resource_id:
                                      type: string
                                      example: 'storagecontainer:1:us-east-1:storage-container-id:'
                                    severity:
                                      type: string
                                      example: high
                                    direct_link:
                                      type: string
                                      example: https://docs.aws.amazon.com/macie/latest/user/findings-types.html#findings-policy-types
                                    affected_resource_id:
                                      type: string
                                      example: 'storagecontainer:1:us-east-1:storage-container-id:'
                                    finding_id:
                                      type: string
                                      example: finding-id
                                    count:
                                      type: integer
                                      example: 1
                                      default: 0
                                    event_first_seen:
                                      type: string
                                      example: '2023-04-30 06:08:42'
                                    event_last_seen:
                                      type: string
                                      example: '2023-04-30 06:08:42'
                                    details:
                                      type: object
                                      properties:
                                        accountId:
                                          type: string
                                          example: '123456789123'
                                        archived:
                                          type: boolean
                                          example: false
                                          default: true
                                        category:
                                          type: string
                                          example: POLICY
                                        count:
                                          type: integer
                                          example: 1
                                          default: 0
                                        createdAt:
                                          type: string
                                          example: '2023-04-30 06:08:42.895000+00:00'
                                        description:
                                          type: string
                                          example: The access control list (ACL) or bucket policy for the Amazon S3 bucket allows the bucket to be shared with an AWS account that isn’t part of your Amazon Macie organization.
                                        id:
                                          type: string
                                          example: finding-id
                                        partition:
                                          type: string
                                          example: aws
                                        policyDetails:
                                          type: object
                                          properties:
                                            action:
                                              type: object
                                              properties:
                                                actionType:
                                                  type: string
                                                  example: AWS_API_CALL
                                                apiCallDetails:
                                                  type: object
                                                  properties:
                                                    api:
                                                      type: string
                                                      example: PutBucketPolicy
                                                    apiServiceName:
                                                      type: string
                                                      example: s3.amazonaws.com
                                                    firstSeen:
                                                      type: string
                                                      example: '2023-04-30 06:05:27+00:00'
                                                    lastSeen:
                                                      type: string
                                                      example: '2023-04-30 06:05:27+00:00'
                                            actor:
                                              type: object
                                              properties:
                                                ipAddressDetails:
                                                  type: object
                                                  properties:
                                                    ipAddressV4:
                                                      type: string
                                                      example: 123.123.123.123
                                                    ipCity:
                                                      type: object
                                                      properties:
                                                        name:
                                                          type: string
                                                          example: Somewhere
                                                    ipCountry:
                                                      type: object
                                                      properties:
                                                        code:
                                                          type: string
                                                          example: US
                                                        name:
                                                          type: string
                                                          example: United States
                                                    ipGeoLocation:
                                                      type: object
                                                      properties:
                                                        lat:
                                                          type: integer
                                                          example: 0
                                                          default: 0
                                                        lon:
                                                          type: integer
                                                          example: 0
                                                          default: 0
                                                    ipOwner:
                                                      type: object
                                                      properties:
                                                        asn:
                                                          type: string
                                                          example: '12345'
                                                        asnOrg:
                                                          type: string
                                                          example: ABCD
                                                        isp:
                                                          type: string
                                                          example: ABCD Corp.
                                                        org:
                                                          type: string
                                                          example: ABCD Corp.
                                                userIdentity:
                                                  type: object
                                                  properties:
                                                    assumedRole:
                                                      type: object
                                                      properties:
                                                        accessKeyId:
                                                          type: string
                                                          example: ACCESSKEY
                                                        accountId:
                                                          type: string
                                                          example: '123456789123'
                                                        arn:
                                                          type: string
                                                          example: arn:aws:sts::123456789123:assumed-role/developer/john-do@rapid7.com
                                                        principalId:
                                                          type: string
                                                          example: principal-id:john-doe@rapid7.com
                                                        sessionContext:
                                                          type: object
                                                          properties:
                                                            attributes:
                                                              type: object
                                                              properties:
                                                                creationDate:
                                                                  type: string
                                                                  example: '2023-04-30 05:47:59+00:00'
                                                                mfaAuthenticated:
                                                                  type: boolean
                                                                  example: false
                                                                  default: true
                                                            sessionIssuer:
                                                              type: object
                                                              properties:
                                                                accountId:
                                                                  type: string
                                                                  example: '123456789123'
                                                                arn:
                                                                  type: string
                                                                  example: arn:aws:iam::123456789123:role/assumable/developer
                                                                principalId:
                                                                  type: string
                                                                  example: principal-id
                                                                type:
                                                                  type: string
                                                                  example: Role
                                                                userName:
                                                                  type: string
                                                                  example: developer
                                                    type:
                                                      type: string
                                                      example: AssumedRole
                                        region:
                                          type: string
                                          example: us-east-1
                                        resourcesAffected:
                                          type: object
                                          properties:
                                            s3Bucket:
                                              type: object
                                              properties:
                                                allowsUnencryptedObjectUploads:
                                                  type: string
                                                  example: 'TRUE'
                                                arn:
                                                  type: string
                                                  example: arn:aws:s3:::storage-container-id
                                                createdAt:
                                                  type: string
                                                  example: '2023-04-17 20:31:27+00:00'
                                                defaultServerSideEncryption:
                                                  type: object
                                                  properties:
                                                    encryptionType:
                                                      type: string
                                                      example: AES256
                                                name:
                                                  type: string
                                                  example: storage-container-id
                                                owner:
                                                  type: object
                                                  properties:
                                                    displayName:
                                                      type: string
                                                      example: amazon+rapid7+owner
                                                    id:
                                                      type: string
                                                      example: owner-id
                                                publicAccess:
                                                  type: object
                                                  properties:
                                                    effectivePermission:
                                                      type: string
                                                      example: NOT_PUBLIC
                                                    permissionConfiguration:
                                                      type: object
                                                      properties:
                                                        accountLevelPermissions:
                                                          type: object
                                                          properties:
                                                            blockPublicAccess:
                                                              type: object
                                                              properties:
                                                                blockPublicAcls:
                                                                  type: boolean
                                                                  example: true
                                                                  default: true
                                                                blockPublicPolicy:
                                                                  type: boolean
                                                                  example: true
                                                                  default: true
                                                                ignorePublicAcls:
                                                                  type: boolean
                                                                  example: true
                                                                  default: true
                                                                restrictPublicBuckets:
                                                                  type: boolean
                                                                  example: true
                                                                  default: true
                                                        bucketLevelPermissions:
                                                          type: object
                                                          properties:
                                                            accessControlList:
                                                              type: object
                                                              properties:
                                                                allowsPublicReadAccess:
                                                                  type: boolean
                                                                  example: false
                                                                  default: true
                                                                allowsPublicWriteAccess:
                                                                  type: boolean
                                                                  example: false
                                                                  default: true
                                                            blockPublicAccess:
                                                              type: object
                                                              properties:
                                                                blockPublicAcls:
                                                                  type: boolean
                                                                  example: true
                                                                  default: true
                                                                blockPublicPolicy:
                                                                  type: boolean
                                                                  example: true
                                                                  default: true
                                                                ignorePublicAcls:
                                                                  type: boolean
                                                                  example: true
                                                                  default: true
                                                                restrictPublicBuckets:
                                                                  type: boolean
                                                                  example: true
                                                                  default: true
                                                            bucketPolicy:
                                                              type: object
                                                              properties:
                                                                allowsPublicReadAccess:
                                                                  type: boolean
                                                                  example: false
                                                                  default: true
                                                                allowsPublicWriteAccess:
                                                                  type: boolean
                                                                  example: false
                                                                  default: true
                                                tags:
                                                  type: array
                                        sample:
                                          type: boolean
                                          example: false
                                          default: true
                                        schemaVersion:
                                          type: string
                                          example: '1.0'
                                        severity:
                                          type: object
                                          properties:
                                            description:
                                              type: string
                                              example: High
                                            score:
                                              type: integer
                                              example: 3
                                              default: 0
                                        title:
                                          type: string
                                          example: The S3 bucket is shared with an external AWS account.
                                        type:
                                          type: string
                                          example: Policy:IAMUser/S3BucketSharedExternally
                                        updatedAt:
                                          type: string
                                          example: '2023-04-30 06:08:42.895000+00:00'
                                    finding_source:
                                      type: string
                                      example: AWS Macie
                      application_context:
                        type: array
                        items:
                          type: object
                          properties:
                            app:
                              type: object
                              properties:
                                accounts:
                                  type: integer
                                  example: 1
                                  default: 0
                                application:
                                  type: string
                                  example: ICS application
                                block_storage_gb:
                                  type: integer
                                  example: 0
                                  default: 0
                                business_critical:
                                  type: boolean
                                  example: false
                                  default: true
                                category:
                                  type: string
                                  example: other
                                clouds:
                                  type: array
                                  items:
                                    type: string
                                    example: AZURE_ARM
                                cores:
                                  type: integer
                                  example: 0
                                  default: 0
                                is_favourite:
                                  type: boolean
                                  example: false
                                  default: true
                                name: {}
                                object_storage_bytes:
                                  type: integer
                                  example: 0
                                  default: 0
                                poc: {}
                                resource_count:
                                  type: integer
                                  example: 3
                                  default: 0
                            tags:
                              type: object
                              properties:
                                Application:
                                  type: object
                                  properties:
                                    value:
                                      type: string
                                      example: ICS Automation
                                    user_defiened:
                                      type: boolean
                                      example: true
                                      default: true
                                Owner:
                                  type: object
                                  properties:
                                    value:
                                      type: string
                                      example: ICS QA Team
                                    user_defiened:
                                      type: boolean
                                      example: true
                                      default: true
                      permissions:
                        type: array
                        items:
                          type: object
                          properties:
                            action:
                              type: string
                              example: compute.snapshots.getIamPolicy
                            count:
                              type: integer
                              example: 1
                              default: 0
                            last_executed_date:
                              type: string
                              example: '2023-05-31 17:39:07.217902'
                            permission:
                              type: string
                              example: compute.snapshots.getIamPolicy
                            status:
                              type: string
                              example: Used
                      related_resources:
                        type: array
                        items:
                          type: object
                          properties:
                            cloud_type_id:
                              type: string
                              example: GCE
                            id:
                              type: string
                              example: network-interface-id
                            info:
                              type: object
                              properties:
                                description_template:
                                  type: string
                                  example: '{source} has network interface {target}'
                                extra_info:
                                  type: object
                                  properties: {}
                                label:
                                  type: string
                                  example: HAS_NETWORK_INTERFACE
                                other_resource_type:
                                  type: string
                                  example: networkinterface
                                resource_type:
                                  type: string
                                  example: instance
                                source:
                                  type: boolean
                                  example: true
                                  default: true
                                source_or_target:
                                  type: string
                                  example: source
                            name:
                              type: string
                              example: nic0
                            resource_id:
                              type: string
                              example: 'networkinterface:6:europe-west1:network-interface-id:'
                            type:
                              type: string
                              example: networkinterface
                      attack_path:
                        type: object
                        properties:
                          Critical:
                            type: object
                            properties:
                              count:
                                type: integer
                                example: 1
                                default: 0
                              paths:
                                type: array
                                items:
                                  type: object
                                  properties:
                                    author:
                                      type: string
                                      example: rapid7
                                    category_description:
                                      type: string
                                      example: This attack path definition looks for any publicly-available instances and checks to see if any of them have a high/critical vulnerability severity. This can lead to the instance being exploited, so it should be treated as high priority.
                                    category_id:
                                      type: string
                                      example: apa.publicly_high_vuln_sev_esc
                                    category_impact:
                                      type: string
                                      example: An attacker may be able to access the instance via the internet and exploit the vulnerability to execute code.
                                    category_labels:
                                      type: array
                                      items:
                                        type: string
                                        example: Compute Abuse
                                    category_name:
                                      type: string
                                      example: Publicly Exposed Compute Instance with High/Critical vulnerabilities
                                    category_remediation:
                                      type: string
                                      example: |
                                        1. Click on the instance node for the attack path to view details about the node.
                                        2. Find the vulnerabilities tab to see vulnerabilites.
                                        3. From there you can find out where the vuln scan came from ie Inspector, IVM, HVA.
                                        4. Refer to the originating scanner's content for instructions to remediate.
                                    discovered_timestamp:
                                      type: string
                                      example: '2024-05-21T18:08:05'
                                    id:
                                      type: integer
                                      example: 10000
                                    path_length:
                                      type: integer
                                      example: 7
                                    risk_score:
                                      type: number
                                      example: 800
                                    severity:
                                      type: string
                                      example: High
                                    source_resource_id:
                                      type: string
                                      example: internet:internet
                                    source_resource_name:
                                      type: string
                                      example: Internet
                                    source_resource_type:
                                      type: string
                                      example: internet
                                    target_account_id:
                                      type: string
                                      example: '123456789123'
                                    target_account_name:
                                      type: string
                                      example: AWS-SSE
                                    target_account_type:
                                      type: string
                                      example: AWS
                                    target_application_id:
                                      type: string
                                    target_application_name:
                                      type: string
                                    target_organization_service_id:
                                      type: string
                                      example: '1234'
                                    target_resource_id:
                                      type: string
                                      example: 'instance:1111:ap-southeast-2:i-11b1dbcd111111111:'
                                    target_resource_name:
                                      type: string
                                      example: k8-master
                                    target_resource_type:
                                      type: string
                                      example: instance
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value: '{}'
              schema:
                type: object
                properties: {}
      deprecated: false
  /public/resources/related/export:
    post:
      summary: Download Related Resources
      description: Downloads all related resources for a given Cloud Account or Organization ID
      operationId: downloadAllRelatedResources
      parameters: []
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/downloadAllRelatedResourcesBody'
      responses:
        '200':
          description: OK - Related resources downloaded
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/downloadAllRelatedResources200'
  /cvm/packages:
    post:
      summary: Get All Packages
      description: Gets all packages and package data
      operationId: v3_packages_list_packages_from_rl
      parameters:
        - in: query
          name: order_by
          required: false
          schema:
            type:
              - string
              - 'null'
        - in: query
          name: page
          required: false
          schema:
            type: integer
            default: 1
            minimum: 1
        - in: query
          name: provide_ids
          required: false
          schema:
            type: boolean
            default: false
        - in: query
          name: provide_counts
          required: false
          schema:
            type: boolean
            default: true
        - in: query
          name: page_size
          required: false
          schema:
            type: integer
            default: 25
            minimum: 1
            maximum: 100
        - in: query
          name: search
          required: false
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListPackagesResponse'
          description: OK
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListPackagesBody'
        required: true
  /cvm/vulnerabilities:
    post:
      operationId: v3_vulnerabilities_list_vulnerabilities
      parameters:
        - in: query
          name: order_by
          required: false
          schema:
            type:
              - string
              - 'null'
        - in: query
          name: page
          required: false
          schema:
            type: integer
            default: 1
            minimum: 1
        - in: query
          name: provide_ids
          required: false
          schema:
            type: boolean
            default: false
        - in: query
          name: provide_counts
          required: false
          schema:
            type: boolean
            default: true
        - in: query
          name: page_size
          required: false
          schema:
            type: integer
            default: 25
            minimum: 1
            maximum: 100
        - in: query
          name: search
          required: false
          schema:
            type: string
      summary: List Vulnerabilities
      description: Get vulnerability counts/aggregates for each resource (with at least one vulnerability) in the system. Returns a list of vulnerabilities found on each resource
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListVulnerabilitiesResponse'
          description: OK
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VulnerabilityAssessmentBody'
        required: true
  /cvm/resource/vulnerabilities:
    post:
      operationId: v3_vulnerabilities_list_resource_vulnerabilities
      parameters:
        - in: query
          name: order_by
          required: false
          schema:
            type:
              - string
              - 'null'
        - in: query
          name: page
          required: false
          schema:
            type: integer
            default: 1
            minimum: 1
        - in: query
          name: provide_ids
          required: false
          schema:
            type: boolean
            default: false
        - in: query
          name: provide_counts
          required: false
          schema:
            type: boolean
            default: true
        - in: query
          name: page_size
          required: false
          schema:
            type: integer
            default: 25
            minimum: 1
            maximum: 100
        - in: query
          name: search
          required: false
          schema:
            type: string
      summary: Get Resources with Vulnerabilities
      description: Get a list of resources with vulnerabilities and their associated data
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResourcesResponse2'
          description: OK
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VulnerabilityAssessmentBody'
        required: true
  /cvm/vulnerabilities/{cve_id}:
    get:
      operationId: v3_vulnerabilities_get_vulnerability
      parameters:
        - in: path
          name: cve_id
          schema:
            type: string
          required: true
        - in: query
          name: resource_id
          required: false
          schema:
            type: string
        - in: query
          name: package_name
          required: false
          schema:
            type: string
      summary: Get Vulnerability by CVE ID
      description: Retrieve the details of a single vulnerability by CVE ID
      responses:
        '204':
          description: No Content
  /cvm/configuration/assessment_scope:
    put:
      operationId: v3_vulnerabilities_set_assessment_scope
      parameters: []
      responses:
        '204':
          description: No Content
      summary: Set Assessment Scope
      description: Set the assessment scope for scans
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetAssessmentFilterResourcesBody'
        required: true
  /cvm/configuration/assessment_enabled:
    put:
      operationId: v3_vulnerabilities_set_assessment_enabled
      parameters: []
      summary: Set Assessment Status
      description: Set whether the assessment is enabled
      responses:
        '204':
          description: No Content
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetAssessmentEnabledBody'
        required: true
  /cvm/resource/{resource_id_str}/vulnerabilities:
    get:
      operationId: get_v3_vulnerabilities_get_resource_vulnerabilities
      parameters:
        - in: path
          name: resource_id_str
          schema:
            type: string
          required: true
        - in: query
          name: order_by
          required: false
          schema:
            type:
              - string
              - 'null'
        - in: query
          name: page
          required: false
          schema:
            type: integer
            default: 1
            minimum: 1
        - in: query
          name: provide_ids
          required: false
          schema:
            type: boolean
            default: false
        - in: query
          name: provide_counts
          required: false
          schema:
            type: boolean
            default: true
        - in: query
          name: page_size
          required: false
          schema:
            type: integer
            default: 25
            minimum: 1
            maximum: 10000
        - in: query
          name: search
          required: false
          schema:
            type: string
      summary: Get Resource Vulnerabilities
      description: Get the list of vulnerabilities for a particular resource
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListVulnerabilitiesResponse'
          description: OK
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListVulnerabilitiesBody'
        required: true
    post:
      operationId: post_v3_vulnerabilities_get_resource_vulnerabilities
      parameters:
        - in: path
          name: resource_id_str
          schema:
            type: string
          required: true
        - in: query
          name: order_by
          required: false
          schema:
            type:
              - string
              - 'null'
        - in: query
          name: page
          required: false
          schema:
            type: integer
            default: 1
            minimum: 1
        - in: query
          name: provide_ids
          required: false
          schema:
            type: boolean
            default: false
        - in: query
          name: provide_counts
          required: false
          schema:
            type: boolean
            default: true
        - in: query
          name: page_size
          required: false
          schema:
            type: integer
            default: 25
            minimum: 1
            maximum: 100
        - in: query
          name: search
          required: false
          schema:
            type: string
      summary: Get Resource Vulnerabilities
      description: Get the list of vulnerabilities for a particular resource
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListVulnerabilitiesResponse'
          description: OK
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListVulnerabilitiesBody'
        required: true
  /cvm/packages/{package_name}/{package_version}/vulnerabilities:
    get:
      operationId: v3_packages_list_package_vulnerabilities
      parameters:
        - in: path
          name: package_name
          schema:
            type: string
          required: true
        - in: path
          name: package_version
          schema:
            type: string
          required: true
        - in: query
          name: order_by
          required: false
          schema:
            type:
              - string
              - 'null'
        - in: query
          name: page
          required: false
          schema:
            type: integer
            default: 1
            minimum: 1
        - in: query
          name: provide_ids
          required: false
          schema:
            type: boolean
            default: false
        - in: query
          name: provide_counts
          required: false
          schema:
            type: boolean
            default: true
        - in: query
          name: page_size
          required: false
          schema:
            type: integer
            default: 25
            minimum: 1
            maximum: 100
        - in: query
          name: search
          required: false
          schema:
            type: string
      summary: Get Package Vulnerabilities
      description: Get the list of vulnerabilities for a particular package
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListPackageVulnerabilitiesResponse'
          description: OK
  /sensitivedata/classifications/resources/{resource_id}:
    get:
      operationId: get_classifications_by_resource_id.GET
      summary: Get Classifications by Resource ID
      description: Gets details about sensitive data classifications related to a specific resource
      parameters:
        - name: resource_id
          in: path
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type:
                      - integer
                      - 'null'
                  last_harvest_time:
                    type:
                      - string
                      - 'null'
                  last_harvest_time_source:
                    type:
                      - string
                      - 'null'
                  max_severity:
                    type:
                      - string
                      - 'null'
                  max_severity_sources:
                    type: array
                    items:
                      type: string
                  unique_classifications_count:
                    type:
                      - integer
                      - 'null'
                  categories:
                    type: array
                    items:
                      type: object
                      properties:
                        count:
                          type:
                            - integer
                            - 'null'
                        name:
                          type: string
                        max_severity:
                          type: string
                        sources:
                          type: array
                          items:
                            type: string
                        source_providers:
                          type: array
                          items:
                            type: string
                        classifications:
                          type: array
                          items:
                            type: object
                            properties:
                              count:
                                type:
                                  - integer
                                  - 'null'
                              name:
                                type: string
                              severity:
                                type: string
                              source_provider:
                                type: string
                            required:
                              - count
                              - name
                              - severity
                              - source_provider
                            additionalProperties: false
                      required:
                        - count
                        - name
                        - max_severity
                        - sources
                        - source_providers
                        - classifications
                      additionalProperties: false
                  resource_id:
                    type: string
                required:
                  - count
                  - last_harvest_time
                  - last_harvest_time_source
                  - max_severity
                  - max_severity_sources
                  - unique_classifications_count
                  - categories
                  - resource_id
                additionalProperties: false
  /sensitivedata/classifications/resources:
    post:
      operationId: get_classifications_by_resource_ids.POST
      description: Gets details about sensitive data classifications related to the provided list of resources
      summary: Get Classifications by Resource IDs
      parameters: []
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  resources:
                    type: object
                    properties:
                      '{resource_id}':
                        type: object
                        properties:
                          count:
                            type:
                              - integer
                              - 'null'
                          last_harvest_time:
                            type:
                              - string
                              - 'null'
                          last_harvest_time_source:
                            type:
                              - string
                              - 'null'
                          max_severity:
                            type:
                              - string
                              - 'null'
                          max_severity_sources:
                            type: array
                            items:
                              type: string
                          unique_classifications_count:
                            type:
                              - integer
                              - 'null'
                          categories:
                            type: array
                            items:
                              type: object
                              properties:
                                count:
                                  type:
                                    - integer
                                    - 'null'
                                name:
                                  type: string
                                max_severity:
                                  type: string
                                sources:
                                  type: array
                                  items:
                                    type: string
                                source_providers:
                                  type: array
                                  items:
                                    type: string
                                classifications:
                                  type: array
                                  items:
                                    type: object
                                    properties:
                                      count:
                                        type:
                                          - integer
                                          - 'null'
                                      name:
                                        type: string
                                      severity:
                                        type: string
                                      source_provider:
                                        type: string
                                    required:
                                      - count
                                      - name
                                      - severity
                                      - source_provider
                                    additionalProperties: false
                              required:
                                - count
                                - name
                                - max_severity
                                - sources
                                - source_providers
                                - classifications
                              additionalProperties: false
                          resource_id:
                            type: string
                        required:
                          - count
                          - last_harvest_time
                          - last_harvest_time_source
                          - max_severity
                          - max_severity_sources
                          - unique_classifications_count
                          - categories
                          - resource_id
                        additionalProperties: false
                    required:
                      - '{resource_id}'
                    additionalProperties: false
                  errors:
                    type: object
                    properties:
                      '{resource_id}':
                        type: string
                    required:
                      - '{resource_id}'
                    additionalProperties: false
                required:
                  - resources
                  - errors
                additionalProperties: false
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                resource_ids:
                  description: The Resource IDs of the resources you want classification data about
                  type: array
                  items:
                    type: string
                search:
                  description: Search term to filter classifications by
                  type: string
              required:
                - resource_ids
              additionalProperties: false
  /sensitivedata/classifications:
    post:
      operationId: get_classifications.POST
      description: Gets details about sensitive data classifications that match the filters provided
      summary: Get Classifications
      parameters: []
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      resources:
                        type: array
                        items:
                          type: object
                          properties:
                            count:
                              type:
                                - integer
                                - 'null'
                            last_harvest_time:
                              type:
                                - string
                                - 'null'
                            last_harvest_time_source:
                              type:
                                - string
                                - 'null'
                            max_severity:
                              type:
                                - string
                                - 'null'
                            max_severity_sources:
                              type: array
                              items:
                                type: string
                            unique_classifications_count:
                              type:
                                - integer
                                - 'null'
                            categories:
                              type: array
                              items:
                                type: object
                                properties:
                                  count:
                                    type:
                                      - integer
                                      - 'null'
                                  name:
                                    type: string
                                  max_severity:
                                    type: string
                                  sources:
                                    type: array
                                    items:
                                      type: string
                                  source_providers:
                                    type: array
                                    items:
                                      type: string
                                  classifications:
                                    type: array
                                    items:
                                      type: object
                                      properties:
                                        count:
                                          type:
                                            - integer
                                            - 'null'
                                        name:
                                          type: string
                                        severity:
                                          type: string
                                        source_provider:
                                          type: string
                                      required:
                                        - count
                                        - name
                                        - severity
                                        - source_provider
                                      additionalProperties: false
                                required:
                                  - count
                                  - name
                                  - max_severity
                                  - sources
                                  - source_providers
                                  - classifications
                                additionalProperties: false
                            resource_id:
                              type: string
                          required:
                            - count
                            - last_harvest_time
                            - last_harvest_time_source
                            - max_severity
                            - max_severity_sources
                            - unique_classifications_count
                            - categories
                            - resource_id
                          additionalProperties: false
                    required:
                      - resources
                    additionalProperties: false
                  page:
                    type: integer
                  page_size:
                    type: integer
                  total_count:
                    type:
                      - integer
                      - 'null'
                  total_pages:
                    type: integer
                required:
                  - data
                  - page
                  - page_size
                  - total_count
                  - total_pages
                additionalProperties: false
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                categories:
                  description: The categories of data type you want classification data about
                  type: array
                  items:
                    type: string
                severities:
                  description: The severities of data type you want classification data about
                  type: array
                  items:
                    type: string
                resource_types:
                  description: The resource types you want classification data about
                  type: array
                  items:
                    type: string
                sensitive_data_types:
                  description: The identifiers of csp specific data types you want classification data about
                  type: array
                  items:
                    type: string
                internal_sensitive_data_types:
                  description: The identifiers of internal data types you want classification data about
                  type: array
                  items:
                    type: string
                pagination:
                  description: Pagination controls
                  type: object
                  properties:
                    page:
                      description: Index of current results page being queried. Starts from 1
                      type: integer
                    page_size:
                      description: The number of resources to get classifications for per page
                      type: integer
                  additionalProperties: false
                order_by:
                  description: The resource-level column to order by e.g. 'total_count asc'
                  type: string
                search:
                  description: A string value to further filter the classifications returned
                  type: string
              additionalProperties: false
components:
  securitySchemes:
    Api-Key:
      type: apiKey
      description: Requests to this API require an [API key](https://docs.rapid7.com/insightcloudsec/api-documentation#authentication) passed through the `Api-Key` header. For more information on security and access within InsightCloudSec, see [Users, Groups and Roles](https://docs.rapid7.com/insightcloudsec/user-roles).
      name: Api-Key
      in: header
  schemas:
    getAllIacScanResults200:
      type: object
      properties: {}
      example:
        page: 1
        total_pages: 1
        total_count: 1
        data:
          - pack:
              source: custom
              id: 256
              name: TLS TRANSIT ENCRYPTION AND NOT USING TLS 1.2
            config_name: TLS TRANSIT ENCRYPTION AND NOT USING TLS 1.21
            failed_resources: 0
            total_resources: 1
            id: 473
            config_id: 101
            status: success
            status_message: Your insightCloudSec IaC Scan completed with 0 failed resources, 0 resource with warnings, 0 unanalyzed resources, and 0 error(s).
            warned_insights: 0
            failed_insights: 0
            errors: []
            scan_type: analysis
            iac_provider: terraform
            scan_name: data/plan.json
            author_name: john.smith@rapid7.com
            stacktrace: null
            create_time: '2023-01-17T09:52:20.578664'
            duration: 2060
    getReadableDetailedIacScanResults200:
      type: object
      description: Returned if `readable` (query parameter) is set to `true`.
      properties: {}
      example:
        config_name: TLS TRANSIT ENCRYPTION AND NOT USING TLS 1.21
        pack:
          source: custom
          id: 256
          name: TLS TRANSIT ENCRYPTION AND NOT USING TLS 1.2
        passed_resources: 1
        warned_resources: 0
        failed_resources: 0
        total_resources: 1
        resources_by_type:
          cat_compute:
            esinstance: 1
        warned_resources_by_type: {}
        failed_resources_by_type: {}
        resource_mapping:
          esinstance:1:
            id: '1'
            type: esinstance
            cloud_resource_type: OpenSearch
            name: es-cluster
            address: aws_elasticsearch_domain.elastic_domain
            region: us-east-1
            provider_id: null
        id: 473
        config_id: 101
        status: success
        status_message: Your insightCloudSec IaC Scan completed with 0 failed resources, 0 resource with warnings, 0 unanalyzed resources, and 0 error(s).
        warned_insights: 0
        failed_insights: 0
        errors: []
        scan_type: analysis
        iac_provider: terraform
        scan_name: data/plan.json
        author_name: john.smith@rapid7.com
        stacktrace: null
        create_time: '2023-01-17T09:52:20.578664'
        duration: 2060
        details:
          scan_template: '{}'
          passed_insights:
            - id: 4047
              name: TLS TRANSIT ENCRYPTION AND NOT USING TLS 1.2
              notes: |-
                ## Overview
                TLS TRANSIT ENCRYPTION AND NOT USING TLS 1.2
              source: custom
              failure: 0
              success: 1
              warning: 0
              severity: 1
              warn_only: false
              description: TLS TRANSIT ENCRYPTION AND NOT USING TLS 1.2
              resource_types:
                - cloud_type_id: AWS
                  resource_type: esinstance
                  supported: true
                - cloud_type_id: GCE
                  resource_type: esinstance
                  supported: false
                - cloud_type_id: AZURE_ARM
                  resource_type: esinstance
                  supported: false
              iac_support: partial
          warned_insights: []
          failed_insights: []
          skipped_insights: []
          skipped_resources: 0
        success: true
        warnings: []
        scan_results: https://myinsightcloudsec.com/iac/home/scans/473
    getDetailedIacScanResults200:
      type: object
      description: Returned if `readable` (query parameter) is set to `false`.
      properties: {}
      example:
        author_name: john.smith@rapid7.com
        config_id: 101
        config_name: TLS TRANSIT ENCRYPTION AND NOT USING TLS 1.21
        create_time: '2023-01-17T09:52:20.578664'
        details:
          failed_insights: []
          passed_insights:
            - description: TLS TRANSIT ENCRYPTION AND NOT USING TLS 1.2
              failure: 0
              iac_support: partial
              id: 4047
              name: TLS TRANSIT ENCRYPTION AND NOT USING TLS 1.2
              notes: |-
                ## Overview
                TLS TRANSIT ENCRYPTION AND NOT USING TLS 1.2
              resource_types:
                - cloud_type_id: AWS
                  resource_type: esinstance
                  supported: true
                - cloud_type_id: GCE
                  resource_type: esinstance
                  supported: false
                - cloud_type_id: AZURE_ARM
                  resource_type: esinstance
                  supported: false
              severity: 1
              source: custom
              success: 1
              warn_only: false
              warning: 0
          scan_template: '{}'
          skipped_insights: []
          skipped_resources: 0
          warned_insights: []
        duration: 2060
        errors: []
        failed_insights: 0
        failed_resources: 0
        failed_resources_by_type: {}
        iac_provider: terraform
        id: 473
        pack:
          id: 256
          name: TLS TRANSIT ENCRYPTION AND NOT USING TLS 1.2
          source: custom
        passed_resources: 1
        resource_mapping:
          esinstance:1:
            address: aws_elasticsearch_domain.elastic_domain
            cloud_resource_type: OpenSearch
            id: '1'
            name: es-cluster
            provider_id: null
            region: us-east-1
            type: esinstance
        resources_by_type:
          cat_compute:
            esinstance: 1
        scan_name: data/plan.json
        scan_results: https://myinsightcloudsec.com/iac/home/scans/473
        scan_type: analysis
        stacktrace: null
        status: success
        status_message: Your insightCloudSec IaC Scan completed with 0 failed resources, 0 resource with warnings, 0 unanalyzed resources, and 0 error(s).
        success: true
        total_resources: 1
        warned_insights: 0
        warned_resources: 0
        warned_resources_by_type: {}
        warnings: []
    downloadAllRelatedResourcesBody:
      type: object
      properties:
        organization_service_id:
          type: integer
          description: The internal Organization Service ID for a Cloud Account or Organization.
    downloadAllRelatedResources200:
      type: string
      example: |-
        source_resource_id,source_resource_name,source_resource_type,related_resource_id,related_resource_name,related_resource_type
        myElasticFleet,myElasticFleet,appstreamfleet,sg-123a12a1a123456a1,john-doe,resourceaccesslist
    ListPackagesResponse:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/Package'
        ids:
          type: array
          items: {}
        total_count:
          type:
            - integer
            - 'null'
        total_pages:
          type:
            - integer
            - 'null'
        page:
          type: integer
        page_size:
          type: integer
    ListPackagesBody:
      type: object
      properties:
        with_vulns_only:
          type:
            - boolean
            - 'null'
          default: null
        filtering:
          default: null
          anyOf:
            - $ref: '#/components/schemas/AdvFilteringRootExpr1'
            - type: 'null'
    Package:
      type: object
      properties:
        has_exploits:
          type: boolean
        has_threats:
          type: boolean
        vulnerability_status:
          $ref: '#/components/schemas/VulnerabilityStatus'
        technology:
          type: string
        name:
          type: string
        type:
          type: string
        version:
          type: string
        resource_id:
          type: string
        impacted_resources:
          type: integer
    VulnerabilityStatus:
      type: object
      properties:
        severity:
          type: string
        high_count:
          type: integer
        riskscore:
          type: number
        medium_count:
          type: integer
        none_count:
          type: integer
        total_count:
          type: integer
        critical_count:
          type: integer
        low_count:
          type: integer
        last_seen:
          type: string
          format: date-time
    AdvFilteringRootExpr1:
      type: object
      properties:
        form_name:
          type: string
          enum:
            - usc
            - usc_cloud
            - usc_application
            - threatfinding
            - hva
            - clusters
            - iac
            - iam_principals
            - iam_federated_users
            - applications
            - apa
            - summary
            - cvm_resources
            - cvm_packages
            - cvm_vulnerabilities
            - cvm_config
            - harvester_status
            - system_events
            - jit_profiles
            - jit_session_history
            - jit_approval_policy
            - jit_role_configs
        expr: {}
      required:
        - expr
        - form_name
    AdvFilteringRootExpr5:
      type: object
      properties:
        form_name:
          type: string
          enum:
            - usc
            - usc_cloud
            - usc_application
            - threatfinding
            - hva
            - clusters
            - iac
            - iam_principals
            - iam_federated_users
            - applications
            - apa
            - summary
            - cvm_resources
            - cvm_packages
            - cvm_vulnerabilities
            - cvm_config
            - harvester_status
            - system_events
            - jit_profiles
            - jit_session_history
            - jit_approval_policy
            - jit_role_configs
        expr: {}
      required:
        - expr
        - form_name
    ListVulnerabilitiesResponse:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/Vulnerability'
        total_count:
          type:
            - integer
            - 'null'
        ids:
          type: array
          items: {}
        total_pages:
          type:
            - integer
            - 'null'
        page:
          type: integer
        page_size:
          type: integer
    Vulnerability:
      type: object
      properties:
        severity:
          type: string
        cvss_v2_vector:
          type: string
        source:
          type: string
        cvss_v2_score:
          type: number
        first_found:
          type: string
          format: date-time
        cvss_score:
          type: number
        cvss_v3_score:
          type: number
        uri:
          type: string
        has_exploits:
          type: boolean
        cve_id:
          type: string
        affected_packages:
          type: integer
        has_threats:
          type: boolean
        resource_count:
          type: integer
        vuln_meta:
          type: object
        title:
          type: string
        riskscore:
          type: number
        vulnerability_id:
          type: string
        last_seen:
          type: string
          format: date-time
        cvss_v3_vector:
          type: string
    VulnerabilityAssessmentBody:
      type: object
      properties:
        filtering:
          default: null
          anyOf:
            - $ref: '#/components/schemas/AdvFilteringRootExpr5'
            - type: 'null'
    HostAssessmentResource:
      type: object
      properties:
        severity:
          type: string
        high_count:
          type: integer
        public_accessible:
          type: boolean
        organization_service_id:
          type: integer
        none_count:
          type: integer
        resource_type:
          type: string
        id:
          type: integer
        low_count:
          type: integer
        cloud:
          type: string
          enum:
            - AWS
            - AWS_GOV
            - AWS_CHINA
            - DO
            - GCE
            - AZURE_ARM
            - AZURE_GOV
            - AZURE_CHINA
            - OCI
            - K8S
            - K8S_R7
            - ALICLOUD
        platform:
          type: string
        riskscore:
          type: number
        report_id:
          type: string
        image_id:
          type: string
        resource_name:
          type: string
        last_assessment:
          type: string
          format: date-time
        critical_count:
          type: integer
        assessment_info:
          type: object
        account:
          type: string
        medium_count:
          type: integer
        account_id:
          type: string
        total_count:
          type: integer
        resource_id:
          type: string
    ListResourcesResponse2:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/HostAssessmentResource'
        total_count:
          type:
            - integer
            - 'null'
        ids:
          type: array
          items: {}
        total_pages:
          type:
            - integer
            - 'null'
        page:
          type: integer
        page_size:
          type: integer
    SetAssessmentFilterResourcesBody:
      type: object
      properties:
        assessment_scope:
          default: null
          anyOf:
            - $ref: '#/components/schemas/AdvFilteringRootExpr5'
            - type: 'null'
    SetAssessmentEnabledBody:
      type: object
      properties:
        assessment_enabled:
          type: boolean
    ListVulnerabilitiesBody:
      type: object
      properties:
        severities:
          type:
            - array
            - 'null'
          default: null
          items:
            type: string
            enum:
              - UNKNOWN
              - NONE
              - LOW
              - MEDIUM
              - HIGH
              - CRITICAL
    ListPackageVulnerabilitiesResponse:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/PackageVulnerability'
        ids:
          type: array
          items: {}
        total_count:
          type:
            - integer
            - 'null'
        total_pages:
          type:
            - integer
            - 'null'
        page:
          type: integer
        page_size:
          type: integer
    PackageVulnerability:
      type: object
      properties:
        has_exploits:
          type: boolean
        severity: {}
        cvss_v2_vector:
          type: string
        cve_id:
          type: string
        riskscore:
          type: number
        source:
          type: string
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/Package1'
        cvss_v2_score:
          type: number
        has_threats:
          type: boolean
        uri:
          type: string
        cvss_v3_vector:
          type: string
        vuln_meta:
          type: string
        vulnerability_id:
          type: integer
        first_found:
          type: string
          format: date-time
        cvss_score:
          type: number
        cvss_v3_score:
          type: number
        title:
          type: string
    Package1:
      type: object
      properties:
        name:
          type: string
        version:
          type: string
x-tagGroups: []
