Skip to content

Commit 73919e7

Browse files
AlexSanchez-bitAlexSanchez-bit
authored
Backlog/v12 compilance reports (#2413)
* fix[definitions](compilance): added v11 compilance checks to v12 schema * fix[backend](compilance/evaluator): fixed evaluator state change rasons and metrics * fix[frontend](compilance): added state change reason modal
1 parent 72ebe3d commit 73919e7

657 files changed

Lines changed: 16424 additions & 830 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎backend/modules/compliance/usecase/evaluator.go‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,17 @@ func (e *evaluator) SetStatusOverride(ctx context.Context, frameworkKey, control
127127
if !domain.ValidStatus(status) {
128128
return domain.ErrInvalidStatus
129129
}
130+
131+
note:=domain.UtmComplianceControlNote{
132+
ControlID: controlID,
133+
Note: reason,
134+
}
135+
136+
err:=e.notes.Upsert(ctx,&note)
137+
if err!=nil{
138+
return err
139+
}
140+
130141
return e.overrides.Upsert(ctx, &domain.UtmComplianceControlStatusOverride{
131142
FrameworkKey: frameworkKey,
132143
ControlID: controlID,
@@ -370,12 +381,9 @@ func tally(s *domain.ReportSummary, status string) {
370381
}
371382
}
372383

373-
// finalizeSummary computes the compliance score over the controls that were
374-
// actually evaluated (compliant + non-compliant + at-risk); governance, pending
375-
// and not-covered are excluded from the percentage.
376384
func finalizeSummary(s *domain.ReportSummary) {
377-
evaluated := s.Compliant + s.NonCompliant + s.AtRisk
385+
evaluated := s.Compliant + s.NonCompliant + s.AtRisk + s.Pending
378386
if evaluated > 0 {
379-
s.CompliantPct = s.Compliant * 100 / evaluated
387+
s.CompliantPct = (s.Compliant / evaluated) * 100
380388
}
381389
}

‎definitions/compliance/controls/banking-audit/banking-audit-838.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: banking-audit-838
2+
family: banking-audit
3+
familyName: BANKING AUDIT
4+
name: Windows Account Logon Success
5+
scope: data
6+
statement: "The Windows Account Logon Success Report provides a comprehensive view of successful logon events, serving as a crucial tool for compliance within the Banking Audit framework. This report ensures alignment with security controls that manage and monitor user access, safeguarding sensitive financial information and meeting regulatory requirements.<br/>\t•\tBanking Regulations: Supports compliance with financial regulations, such as the Safeguards Rule under GLBA, by demonstrating a security program that protects customer data.<br/>\t•\tAccess Control: Reinforces principles of access management by tracking and validating that only authorized users can access banking systems, aligning with PCI DSS Requirement 8.<br/>\t•\tAudit Readiness: Provides evidence for maintaining security and access control, essential for audits and adherence to standards like ISO 27001 and SOC2 Type 2, ensuring secure access is granted only to legitimate users.<br/>\t•\tIncident Detection and Prevention: Helps detect unauthorized access attempts by analyzing patterns of successful logons, thereby reducing the risk of data breaches.<br/>\t•\tData Protection: Aligns with global frameworks such as GDPR Article 32, ensuring access to sensitive financial data is restricted to authorized individuals to prevent unauthorized data processing.<br/><br/>By centralizing and monitoring logon events, this report strengthens an organization’s ability to maintain cybersecurity resilience, protect financial systems, and achieve compliance with stringent banking audit requirements."
7+
strategy: ANY
8+
checks:
9+
- key: windows-user-successful-logon-event-by-host
10+
name: Windows User Successful Logon Event by Host
11+
indexPattern: v11-log-wineventlog-*
12+
sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id IN ('4624', '4672') AND logx.wineventlog.event_data.TargetUserName NOT LIKE '%$')
13+
rule: MIN_HITS_REQUIRED
14+
ruleValue: 1
15+
- key: windows-logon-success-by-host
16+
name: Windows Logon success by Host
17+
indexPattern: v11-log-wineventlog-*
18+
sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id IN ('4624', '4324') AND logx.wineventlog.event_data.TargetUserName NOT LIKE '%$' AND logx.wineventlog.event_data.TargetUserName.keyword <> '-' AND logx.wineventlog.event_data.LogonType.keyword IN ('3', '2'))
19+
rule: MIN_HITS_REQUIRED
20+
ruleValue: 1
21+
source: Migrated from UTMStack v11

‎definitions/compliance/controls/banking-audit/banking-audit-839.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: banking-audit-839
2+
family: banking-audit
3+
familyName: BANKING AUDIT
4+
name: Windows Account Logon Failure
5+
scope: data
6+
statement: "The Windows Account Logon Failure Report provides a consolidated overview of failed logon attempts, playing a vital role in compliance within the Banking Audit framework. This report enables organizations to monitor, detect, and address unauthorized access attempts, ensuring the protection of sensitive financial systems and data.<br/>\t•\tBanking Regulations: Supports compliance with financial regulations, such as the Safeguards Rule under GLBA, by demonstrating measures to prevent unauthorized access to customer data.<br/>\t•\tAccess Control: Tracks failed logon attempts to identify potential unauthorized access or brute force attacks, aligning with PCI DSS Requirement 10 for monitoring access control events.<br/>\t•\tAudit Readiness: Provides evidence of failed access attempts, contributing to the transparency required by standards like SOC2 Type 2 and ISO 27001, ensuring security incidents are logged and reviewed.<br/>\t•\tIncident Response: Enhances threat detection by identifying patterns of failed logon attempts, enabling organizations to respond to suspicious activity promptly.<br/>\t•\tData Protection: Aligns with global frameworks such as GDPR Article 32, showcasing controls that prevent unauthorized access to financial systems, protecting sensitive customer data.<br/><br/>By centralizing data on logon failures, this report empowers organizations to enhance their security posture, reduce the risk of data breaches, and comply with stringent banking audit requirements."
7+
strategy: ANY
8+
checks:
9+
- key: windows-failed-logon-attempts-by-reason-status
10+
name: Windows Failed Logon Attempts by Reason Status
11+
indexPattern: v11-log-wineventlog-*
12+
sql: SELECT count(*) AS c FROM v11-log-wineventlog-*
13+
rule: MIN_HITS_REQUIRED
14+
ruleValue: 1
15+
- key: windows-logon-failure-by-user-and-host
16+
name: Windows Logon Failure by User and Host
17+
indexPattern: v11-log-wineventlog-*
18+
sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_data.StatusDescription.keyword IN ('Logon failure', 'Clients credentials have been revoked', 'Pre-authentication information was invalid', 'Account restriction') AND logx.wineventlog.event_data.TargetUserName NOT LIKE '%$')
19+
rule: MIN_HITS_REQUIRED
20+
ruleValue: 1
21+
source: Migrated from UTMStack v11

‎definitions/compliance/controls/banking-audit/banking-audit-840.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: banking-audit-840
2+
family: banking-audit
3+
familyName: BANKING AUDIT
4+
name: Windows Account Logoff
5+
scope: data
6+
statement: The Windows Account Logoff Report provides a comprehensive view of user logoff events, serving as a critical compliance tool within the Banking Audit framework. This report ensures transparency and accountability in user sessions, enabling organizations to track session terminations and ensure adherence to access control policies.
7+
strategy: ANY
8+
checks:
9+
- key: windows-account-logoff
10+
name: Windows Account Logoff
11+
indexPattern: v11-log-wineventlog-*
12+
sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4634')
13+
rule: MIN_HITS_REQUIRED
14+
ruleValue: 1
15+
- key: windows-account-logoff-by-user
16+
name: Windows Account Logoff by User
17+
indexPattern: v11-log-wineventlog-*
18+
sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4647')
19+
rule: MIN_HITS_REQUIRED
20+
ruleValue: 1
21+
source: Migrated from UTMStack v11

‎definitions/compliance/controls/banking-audit/banking-audit-841.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: banking-audit-841
2+
family: banking-audit
3+
familyName: BANKING AUDIT
4+
name: Windows Logins with explicit credentials
5+
scope: data
6+
statement: The Windows Logins with Explicit Credentials Report provides a detailed record of login events where explicit credentials (e.g., usernames and passwords) were used. This report plays a vital role in ensuring compliance within the Banking Audit framework by monitoring authentication activities and safeguarding sensitive financial systems.
7+
strategy: ANY
8+
checks:
9+
- key: windows-logins-with-explicit-credentials
10+
name: Windows Logins with explicit credentials
11+
indexPattern: v11-log-wineventlog-*
12+
sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4648')
13+
rule: MIN_HITS_REQUIRED
14+
ruleValue: 1
15+
- key: windows-logins-with-explicit-credentials-by-user
16+
name: Windows Logins with explicit credentials by User
17+
indexPattern: v11-log-wineventlog-*
18+
sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4648')
19+
rule: MIN_HITS_REQUIRED
20+
ruleValue: 1
21+
source: Migrated from UTMStack v11

‎definitions/compliance/controls/banking-audit/banking-audit-842.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: banking-audit-842
2+
family: banking-audit
3+
familyName: BANKING AUDIT
4+
name: Windows Cleaned Event Log
5+
scope: data
6+
statement: The Windows Cleaned Event Log Report provides a detailed record of actions where system event logs have been cleared. This report is critical within the Banking Audit framework, as it helps detect potential tampering with log integrity and supports regulatory compliance by monitoring log management activities.
7+
strategy: ANY
8+
checks:
9+
- key: windows-cleaned-event-log
10+
name: Windows Cleaned Event Log
11+
indexPattern: v11-log-wineventlog-*
12+
sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '1102')
13+
rule: MIN_HITS_REQUIRED
14+
ruleValue: 1
15+
- key: windows-cleaned-event-log-by-source
16+
name: Windows Cleaned Event Log by Source
17+
indexPattern: v11-log-wineventlog-*
18+
sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '1102')
19+
rule: MIN_HITS_REQUIRED
20+
ruleValue: 1
21+
source: Migrated from UTMStack v11

‎definitions/compliance/controls/banking-audit/banking-audit-843.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: banking-audit-843
2+
family: banking-audit
3+
familyName: BANKING AUDIT
4+
name: Windows Policy changes
5+
scope: data
6+
statement: The Windows Policy Changes Report provides a comprehensive record of system policy modifications, including changes to group policies, security configurations, and access controls. This report is critical within the Banking Audit framework, ensuring traceability and compliance with regulatory requirements by monitoring configuration changes that could impact the security of financial systems.
7+
strategy: ANY
8+
checks:
9+
- key: windows-policy-changes
10+
name: Windows Policy changes
11+
indexPattern: v11-log-wineventlog-*
12+
sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4663')
13+
rule: MIN_HITS_REQUIRED
14+
ruleValue: 1
15+
- key: windows-policy-changes-by-outcome
16+
name: Windows Policy changes by outcome
17+
indexPattern: v11-log-wineventlog-*
18+
sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4719')
19+
rule: MIN_HITS_REQUIRED
20+
ruleValue: 1
21+
source: Migrated from UTMStack v11

‎definitions/compliance/controls/banking-audit/banking-audit-844.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: banking-audit-844
2+
family: banking-audit
3+
familyName: BANKING AUDIT
4+
name: Windows User Accounts Created
5+
scope: data
6+
statement: The Windows User Accounts Created Report provides a detailed record of all user account creation events in the system. This report plays a vital role in ensuring compliance within the Banking Audit framework by monitoring and controlling user account management processes to protect sensitive financial systems.
7+
strategy: ANY
8+
checks:
9+
- key: windows-user-accounts-created
10+
name: Windows User Accounts Created
11+
indexPattern: v11-log-wineventlog-*
12+
sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4720' AND logx.wineventlog.event_data.SubjectUserName NOT LIKE '%$' AND logx.wineventlog.event_data.TargetUserName NOT LIKE '%$')
13+
rule: MIN_HITS_REQUIRED
14+
ruleValue: 1
15+
- key: windows-new-accounts-created-over-time
16+
name: Windows New Accounts Created Over Time
17+
indexPattern: v11-log-wineventlog-*
18+
sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4720')
19+
rule: MIN_HITS_REQUIRED
20+
ruleValue: 1
21+
source: Migrated from UTMStack v11

‎definitions/compliance/controls/banking-audit/banking-audit-845.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: banking-audit-845
2+
family: banking-audit
3+
familyName: BANKING AUDIT
4+
name: Windows Password Reset Attempts
5+
scope: data
6+
statement: The Windows Password Reset Attempts Report provides a comprehensive overview of password reset activities, tracking both successful and failed attempts. This report is a critical tool in the Banking Audit framework, ensuring accountability and security in the management of user credentials.The Windows Password Reset Attempts Report provides a comprehensive overview of password reset activities, tracking both successful and failed attempts. This report is a critical tool in the Banking Audit framework, ensuring accountability and security in the management of user credentials.
7+
strategy: ANY
8+
checks:
9+
- key: windows-password-reset-attempts
10+
name: Windows Password Reset Attempts
11+
indexPattern: v11-log-wineventlog-*
12+
sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4724')
13+
rule: MIN_HITS_REQUIRED
14+
ruleValue: 1
15+
- key: windows-password-reset-attempts-by-target-user
16+
name: Windows Password Reset Attempts by Target User
17+
indexPattern: v11-log-wineventlog-*
18+
sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4724')
19+
rule: MIN_HITS_REQUIRED
20+
ruleValue: 1
21+
source: Migrated from UTMStack v11

‎definitions/compliance/controls/banking-audit/banking-audit-846.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: banking-audit-846
2+
family: banking-audit
3+
familyName: BANKING AUDIT
4+
name: 'Windows User Accounts Deleted '
5+
scope: data
6+
statement: The Windows User Accounts Deleted Report provides a detailed record of all user account deletion events within the system. This report is critical for maintaining accountability and ensuring compliance within the Banking Audit framework, as it helps monitor access control changes and detect potential security risks.
7+
strategy: ANY
8+
checks:
9+
- key: windows-user-accounts-deleted-over-time
10+
name: Windows User Accounts Deleted Over Time
11+
indexPattern: v11-log-wineventlog-*
12+
sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4726')
13+
rule: MIN_HITS_REQUIRED
14+
ruleValue: 1
15+
- key: windows-user-accounts-deleted
16+
name: Windows User Accounts Deleted
17+
indexPattern: v11-log-wineventlog-*
18+
sql: SELECT count(*) AS c FROM v11-log-wineventlog-* WHERE (logx.wineventlog.event_id = '4726' AND logx.wineventlog.event_data.SubjectUserName NOT LIKE '%$' AND logx.wineventlog.event_data.TargetUserName NOT LIKE '%$')
19+
rule: MIN_HITS_REQUIRED
20+
ruleValue: 1
21+
source: Migrated from UTMStack v11

0 commit comments

Comments
 (0)