Merge pull request #33 from someengineering/mv/assessment

fix: Update compliance checks for AWS SSM and Azure security

fixcompliance/data/checks/aws/aws_ssm.json

@@ -106,7 +106,7 @@
             "risk": "Non-compliance of AWS resources (EC2, DynamoDB, SSM, S3) with AWS Systems Manager policies could expose security vulnerabilities, and incite operational inconsistencies. This could infringe regulatory compliance laws risking system integrity, data safety, and reliability.",
             "severity": "high",
             "detect": {
-                "fix": "is(aws_ssm_resource_compliance) and status=NON_COMPLIANT --> is(aws_ec2_instance, aws_dynamodb_table, aws_ssm_document, aws_s3_bucket)"
+                "fix": "is(aws_ec2_instance, aws_dynamodb_table, aws_ssm_document, aws_s3_bucket) and /metadata.assessments[*].provider=\"amazon_ssm_compliance\""
             },
             "remediation": {
                 "text": "To rectify non-compliance, identify the unmet AWS Systems Manager standards for each resource. Ensure proper setup of SSM Agent for EC2 instances, verify table settings for DynamoDB against best practices, fix S3 bucket's access controls and encryption settings. Enforce compliance policies, perform consistent audits, and leverage AWS Systems Manager automation to mend non-compliant resources.",

fixcompliance/data/checks/azure/azure_security.json

@@ -251,7 +251,7 @@
             "risk": "Without applying the latest OS patches, virtual machines are vulnerable to security threats and bugs, which can lead to system instability and potential security incidents.",
             "severity": "high",
             "detect": {
-                "fix": "is(azure_security_assessment) and name~\"^System updates should be installed on your machines\" --> is(azure_compute_virtual_machine_base)"
+                "fix": "is(azure_compute_virtual_machine_base) and /metadata.assessments[*].{provider=azure_security_assessment and findings[*].title~\"^System updates should be installed\"}"
             },
             "remediation": {
                 "text": "To apply system updates:\nFrom Azure Portal:\n1. From Azure Home select the Portal Menu.\n2. Select Microsoft Defender for Cloud.\n3. Go to the Recommendations blade.\n4. Follow the recommendations to apply system updates.\n\nFrom Azure CLI:\nRun the following command to apply updates:\naz vm update -g <resource_group> -n <vm_name> --apply-updates\n\nFrom PowerShell:\nUse the below command to apply updates to a VM:\nUpdate-AzVM -ResourceGroupName <resource_group> -VMName <vm_name> -ApplyUpdates",