search

elastic / cloudbeat

Analyzing Cloud Security Posture
Other
39 stars 43 forks source link

Bump armsecurity #2450

Closed romulets closed 1 month ago

romulets commented 1 month ago

Bump arm security and solve breaking changes.

The payload of arm security has changed from the previous version:

From

{
  "id": "/subscriptions/<subID>/providers/Microsoft.Security/securityContacts/default",
  "name": "default",
  "type": "Microsoft.Security/securityContacts",
  "properties": {
    "alertNotifications": {
      "state": "On",
      "minimalSeverity": "High"
    },
    "notificationsByRole": {
      "state": "On",
      "roles": [
        "Owner"
      ]
    },
    "emails": "...",
    "phone": ""
  }
}

to

{
  "id": "/subscriptions/<Your_Subscription_Id>/providers/Microsoft.Security/securityContact/default",
  "name": "default",
  "type": "Microsoft.Security/securityContact",
  "properties": {
    "notificationsByRole": {
      "state": "On",
      "roles": [
        "Owner",
        "Admin"
      ]
    },
    "isEnabled": true,
    "emails": "john@contoso.com;Jane@contoso.com",
    "phone": "(214)275-4038",
    "notificationsSources": [
      {
        "sourceType": "AttackPath",
        "minimalRiskLevel": "Critical"
      },
      {
        "sourceType": "Alert",
        "minimalSeverity": "Medium"
      }
    ]
  }
}

There isn't however any docs on what is the migration path. Therefore I tested the UI and API and made a few assumptions.

Assumption 1:

We can't save the email settings without selecting Notify about alerts with the following severity (or higher):, therefore I assume the the default Notification Source with a valid level means that the notification is enabled

image

Assumption 2: There is no clarity on what is the default notification source type. By testing, it seems to be Alert. I'm using it as the default.

Related issues

mergify[bot] commented 1 month ago

This pull request does not have a backport label. Could you fix it @romulets? 🙏 To fixup this pull request, you need to add the backport labels for the needed branches, such as: