Skip to content

Add Azure Monitor persistence hook#913

Merged
rfelber merged 17 commits into
mainfrom
feature/azure-monitor-persistence
Feb 23, 2022
Merged

Add Azure Monitor persistence hook#913
rfelber merged 17 commits into
mainfrom
feature/azure-monitor-persistence

Conversation

@malexmave

@malexmave malexmave commented Jan 6, 2022

Copy link
Copy Markdown
Member

This PR adds the Azure Monitor persistence provider, as requested in #454.

Description

Azure Monitor is the logging service by Microsoft. It allows configuring alerting based on events in logs, and also serves as the basis for Microsoft Sentinel, the cloud SIEM by Microsoft. As such, it can be desireable to push results from SCB into the system so that they can be acted upon.

This hook uses the data collector API to push the data into custom log types (one per scan type). For more details, read the included documentation.

At the moment, the code is fairly bare-bones and does not check if the data actually conforms to the expectations that Azure Monitor has, namely, a maximum of:

  • 30 MB per POST request
  • 32 KB per individual field value
  • 50 characters per column name

The consequences for not respecting the field value and column name size limitations are truncation of the data. Too large POST requests will likely be rejected by the system with a HTTP error (not explicitly specified in docs). If desired, I can add more checks to the code to validate these requirements explicitly - I expect that 99.999% of secureCodeBox findings will fall within them without any extra modification. Truncation seems like an okay outcome to me (and cannot be prevented using checks on our end, since the only thing we could do is to truncate client-side). So the only place where we can actually do anything useful based on the client-side checks would be to split up POSTs that are larger than 30 MB into multiple individual POSTs. Do we expect findings to be larger than 30 MB?

Checklist

  • Test your changes as thoroughly as possible before you commit them. Preferably, automate your test by unit/integration tests.
  • Make sure npm test runs for the whole project.
  • Make codeclimate checks happy

malexmave and others added 3 commits January 6, 2022 10:27
Signed-off-by: Max Maass <max.maass@iteratec.com>
Signed-off-by: Max Maass <max.maass@iteratec.com>
Signed-off-by: GitHub Actions <securecodebox@iteratec.com>
@malexmave malexmave added persistence Implement or update a persistence store hook Implement or update a hook labels Jan 6, 2022
@malexmave malexmave self-assigned this Jan 6, 2022
Signed-off-by: Max Maass <max.maass@iteratec.com>
J12934
J12934 previously requested changes Jan 6, 2022

@J12934 J12934 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great 😊
Noticed a few things while going over the code

Comment thread hooks/persistence-azure-monitor/.helm-docs.gotmpl
Comment thread hooks/persistence-azure-monitor/Chart.yaml Outdated
Comment thread hooks/persistence-azure-monitor/hook/hook.js Outdated
Comment thread hooks/persistence-azure-monitor/hook/package.json Outdated
Comment thread hooks/persistence-azure-monitor/hook/package.json Outdated
Comment thread hooks/persistence-azure-monitor/hook/package.json Outdated
Comment thread hooks/persistence-azure-monitor/hook/hook.js Outdated
Comment thread hooks/persistence-azure-monitor/hook/hook.test.js Outdated
Comment thread hooks/persistence-azure-monitor/hook/hook.test.js
Signed-off-by: Max Maass <max.maass@iteratec.com>
Signed-off-by: Max Maass <max.maass@iteratec.com>
Signed-off-by: Max Maass <max.maass@iteratec.com>
Signed-off-by: Max Maass <max.maass@iteratec.com>
Signed-off-by: Max Maass <max.maass@iteratec.com>
@malexmave malexmave requested a review from J12934 January 6, 2022 15:53
Comment thread hooks/persistence-azure-monitor/hook/hook.js Outdated
Signed-off-by: Max Maass <max.maass@iteratec.com>
@J12934 J12934 requested review from J12934 and rfelber January 7, 2022 12:55
malexmave and others added 3 commits January 7, 2022 16:28
Signed-off-by: Max Maass <max.maass@iteratec.com>
Signed-off-by: GitHub Actions <securecodebox@iteratec.com>
rfelber
rfelber previously approved these changes Feb 20, 2022
Signed-off-by: GitHub Actions <securecodebox@iteratec.com>
@rfelber rfelber removed the request for review from J12934 February 20, 2022 09:15
@rfelber rfelber enabled auto-merge February 22, 2022 17:44
@rfelber rfelber added the enhancement New feature or request label Feb 22, 2022
@J12934 J12934 dismissed their stale review February 23, 2022 09:44

outdated

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request hook Implement or update a hook persistence Implement or update a persistence store

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add a persistence Hook to send Findings to Azure Log Analytics / Azure Sentinel

3 participants