cisagov / ScubaGoggles

SCuBA Security Configuration Baselines and assessment tool for Google Workspace
https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project
Creative Commons Zero v1.0 Universal
129 stars 13 forks source link

Enhance "no relevant events" message #243

Open adhilto opened 3 months ago

adhilto commented 3 months ago

💡 Summary

Enhance the report details message when no events are found.

Motivation and context

The current message looks like this: image

The problem is when a control depends on multiple settings. For example, GWS.COMMONCONTROLS.1.1 depends on 3 different settings. If only 2 of the 3 are in the logs, "no events found" will be displayed, which is likely to be confusing and isn't completely accurate.

Implementation notes

One option would be to display a message like

No relevant event in the current logs for the top-level OU, [OU name] for setting [x]. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended.

Acceptance criteria