search

microsoft / security-devops-action

Microsoft Security DevOps for GitHub Actions.
MIT License
97 stars 44 forks source link

How to interpret and resolve IaCFileScanner alerts? #87

Closed shunkino closed 6 months ago

shunkino commented 7 months ago

I want to know the meaning and remediation steps for the alerts generated by IaCFileScanner, a tool for mapping IaC templates and cloud resources. For example, I see this alert on our dashboard, but I don't know what it means or how to fix it. Does it just indicate that my resource has an IaC tag, or is there something else I need to do?

[Description] An IaC tag(s) was found on this resource.

[Severity] Low

[Status] Unhealthy

[Tool Name] iacfilescanner

[Rule ID] IFS-1

Where can I find more information about this tool and the rules it detects? I have read these documents, but they don't provide enough details: https://learn.microsoft.com/en-us/azure/defender-for-cloud/azure-devops-extension https://learn.microsoft.com/en-us/azure/defender-for-cloud/iac-template-mapping

anaismiller commented 6 months ago

Thank you for asking @shunkino! At the moment, https://learn.microsoft.com/azure/defender-for-cloud/iac-template-mapping has the most information about IacFileScanner. You have to tag your Infrastructure as Code (IaC resources) with the tags listed in the documentation. Then, when you run MSDO, IacFileScanner will report the tags it found in the repo. You can then query the Cloud Security Explorer for your IaC resources.

shunkino commented 6 months ago

Hi @anaismiller, Thank you for answering to my question! Understood.