azure__review-checklists METASEP

web/flaskmysql/templates/index.html METASEP
<!doctype html>
<html>
<head>
<title>Azure Review</title>
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css" />    
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js"></script>
<script type='text/javascript'>
$(document).ready(function(){
  
 // Show Input element in table when clicked
 $('.edit').click(function(){
  $('.txtedit').hide();
  $(this).next('.txtedit').show().focus();
  $(this).hide();
 });
 
 // Save data
 $(".txtedit").focusout(function(){
   
  // Get edit id, field name and value
  var id = this.id;
  var split_id = id.split("_");  //fields are called comment_<guid>, text_<guid>, etc
  var field_name = split_id[0];
  var edit_id = split_id[1];     //edit_id will be the GUID
  var value = $(this).val();
   
  // Hide Input element
  $(this).hide();
 
  // Hide and Change Text of the container with input element
  $(this).prev('.edit').show();
  $(this).prev('.edit').text(value);
 
  // Update call to the Flask /route, with the field name, value and ID
  $.ajax({
   url: '/update',
   type: 'post',
   data: { field:field_name, value:value, id:edit_id },
   success:function(response){
      if (response == 1) { 
         console.log('Save successfully'); 
      } else { 
         console.log("Not saved.");  
      }
   }
  });
  
 });
 
});
</script>
</head>

<body >
<div class="container" >
    <div class="row" style="padding:0px;">
        <p><h1>Azure Review</h1></p>
        <div id="dropdownFilters" class="dropdown">
            <table>
               <tr>
                  <td>
                     <div class="dropdown">
                        <button onclick="catClick()" class="dropbtn">Filter by category</button>
                        <div id="catDropdown" class="dropdown-content">
                           <input type="text" placeholder="Category" id="catInput" onkeyup="catFunction()">
                              {% for row in categorylist %}
                                 <a href="/?category={{row.category}}">{{row.category}}</a>
                              {% endfor %}
                        </div>
                     </div>
                  </td>
                  <td>
                     <div class="dropdown">
                        <button onclick="sevClick()" class="dropbtn">Filter by severity</button>
                        <div id="sevDropdown" class="dropdown-content">
                           <input type="text" placeholder="Severity" id="catInput" onkeyup="sevFunction()">
                              {% for row in severitylist %}
                                 <a href="/?severity={{row.severity}}">{{row.severity}}</a>
                              {% endfor %}
                        </div>
                     </div>
                  </td>
                  <td>
                     <div class="dropdown">
                        <button onclick="statusClick()" class="dropbtn">Filter by status</button>
                        <div id="statusDropdown" class="dropdown-content">
                           <input type="text" placeholder="Status" id="catInput" onkeyup="statusFunction()">
                              {% for row in statuslist %}
                                 <a href="/?status={{row.status}}">{{row.status}}</a>
                              {% endfor %}
                        </div>
                     </div>
                  </td>
                  <td>
                     <a href='/'><button>Remove Filters</button></a>
                  </td>
               </tr>
            </table>
        </div>
        <table width='100%'>
         <col style="width:10%">
         <col style="width:10%">
         <col style="width:5%">
         <col style="width:5%">
         <col style="width:30%">
         <col style="width:10%">
         <col style="width:30%">
      <tr>
          <th>GUID</th>
          <th>Category</th>
          <th>Subcategory</th>
          <th>Severity</th>
          <th>Text</th>
          <th>Status</th>
          <th>Comment</th>
         </tr>
         {% for row in itemslist %}
            <tr>
            <td>{{row.guid}}</td>
            <td>{{row.category}}</td>
            <td>{{row.subcategory}}</td>
            <td>{{row.severity}}</td>

            <td>
               {{row.text}}
               {% if row.link != 'None' %}
                  <a href='{{row.link}}' target='_blank'> (More info)</a>
               {% endif %}
               {% if row.training != 'None' %}
                  <a href='{{row.training}}' target='_blank'> (Training)</a>
               {% endif %}
               {% if row.graph_query_result %}
                  <input id="graphBtn_{{row.guid}}" type="button" value="Show Graph Results" class='showhidebtn' onclick="ShowHideDiv(this)" />
                  <div id="graphResults_{{row.guid}}" style="display: none" class='graphresultsdiv'>
                     <b>Graph results</b>:
                     {{row.graph_query_result}}
                  </div>
               {% endif %}
            </td>

            <td> 
               <div class='edit' >{{row.status}} </div> 
               <input type='text' onclick="clearControl(this)" class='txtedit' value='{{row.status}}' id='status_{{row.guid}}' list="statusList">
                  <datalist id="statusList">
                     <option data-value="Open">Open</option>
                     <option data-value="Fulfilled">Fulfilled</option>
                     <option data-value="N/A">N/A</option>
                     <option data-value="Not verified">Not verified</option>
                  </datalist>
            </td>
            <td> 
               <div class='edit' >{{row.comments}} </div> 
               <input type='text' class='txtedit' value='{{row.comments}}' id='comment_{{row.guid}}' >
            </td>
            </tr>
         {% endfor %} 
        </table>
   </div>
</div>
<style>
.edit{
 width: 100%;
 height: 20px;
}
.editMode{
 border: 1px solid black;
}
table {
 border:1px solid lavender;
 border-radius:3px;
}
table tr:nth-child(1){
 background-color:#4285f4;
}
table tr:nth-child(1) th{
 color:white;
 padding:10px 0px;
 letter-spacing: 1px;
}
table td{
 padding:10px;
}
table tr:nth-child(even){
 background-color:lavender;
 color:black;
}
.txtedit{
 display: none;
 width: 99%;
 height: 30px;
}

/* show/hide graph results button */
.showhidebtn{
   font-size: 10px;
   padding: 1px 5px;
}
/* graph result section */
.graphresultsdiv {
   font-size: 10px;
   font-family: 'Courier New', 'Courier', 'monospace';
   background-color:gray;
   color:whitesmoke;
   border: 1px solid black;
}

/* Dropdown Button */
.dropbtn {
  background-color: #4285f4;
  color: white;
  padding: 15px;
  font-size: 15px;
  border: none;
  cursor: pointer;
}
/* Dropdown button on hover & focus */
.dropbtn:hover, .dropbtn:focus {
  background-color:#4285f4;
}
/* The search field */
#catInput {
  box-sizing: border-box;
  background-image: url('searchicon.png');
  background-position: 14px 12px;
  background-repeat: no-repeat;
  font-size: 14px;
  padding: 14px 10px 12px 45px;
  border: none;
  border-bottom: 1px solid #ddd;
}
/* The search field when it gets focus/clicked on */
#catInput:focus {outline: 3px solid #ddd;}
/* The container <div> - needed to position the dropdown content */
.dropdown {
  position: relative;
  display: inline-block;
}

/* Dropdown Content (Hidden by Default) */
.dropdown-content {
  display: none;
  position: absolute;
  background-color: #f6f6f6;
  min-width: 230px;
  border: 1px solid #ddd;
  z-index: 1;
}

/* Links inside the dropdown */
.dropdown-content a {
  color: black;
  padding: 12px 16px;
  text-decoration: none;
  display: block;
}

/* Change color of dropdown links on hover */
.dropdown-content a:hover {background-color: #f1f1f1}

/* Show the dropdown menu (use JS to add this class to the .dropdown-content container when the user clicks on the dropdown button) */
.show {display:block;}

</style>

<script>
   /* When the user clicks on the button,
   toggle between hiding and showing the dropdown content */
   function catClick() {
     document.getElementById("catDropdown").classList.toggle("show");
   }
   function sevClick() {
     document.getElementById("sevDropdown").classList.toggle("show");
   }
   function statusClick() {
     document.getElementById("statusDropdown").classList.toggle("show");
   }
   function catFunction() {
     var input, filter, ul, li, a, i;
     input = document.getElementById("catInput");
     filter = input.value.toUpperCase();
     div = document.getElementById("catDropdown");
     a = div.getElementsByTagName("a");
     for (i = 0; i < a.length; i++) {
       txtValue = a[i].textContent || a[i].innerText;
       if (txtValue.toUpperCase().indexOf(filter) > -1) {
         a[i].style.display = "";
       } else {
         a[i].style.display = "none";
       }
     }
   }
   function sevFunction() {
     var input, filter, ul, li, a, i;
     input = document.getElementById("sevInput");
     filter = input.value.toUpperCase();
     div = document.getElementById("sevDropdown");
     a = div.getElementsByTagName("a");
     for (i = 0; i < a.length; i++) {
       txtValue = a[i].textContent || a[i].innerText;
       if (txtValue.toUpperCase().indexOf(filter) > -1) {
         a[i].style.display = "";
       } else {
         a[i].style.display = "none";
       }
     }
   }
   function statusFunction() {
     var input, filter, ul, li, a, i;
     input = document.getElementById("statusInput");
     filter = input.value.toUpperCase();
     div = document.getElementById("statusDropdown");
     a = div.getElementsByTagName("a");
     for (i = 0; i < a.length; i++) {
       txtValue = a[i].textContent || a[i].innerText;
       if (txtValue.toUpperCase().indexOf(filter) > -1) {
         a[i].style.display = "";
       } else {
         a[i].style.display = "none";
       }
     }
   }
   function clearControl(control) {
      control.value = "";
   }

   /* to show/hide graph results div */
   function ShowHideDiv(btn) {
        let idSplit = btn.id.split("_");
        let guid = idSplit[1];
        let divid = "graphResults_" + guid
        var divGraph = document.getElementById(divid);
        if (btn.value == "Show Graph Results") {
            divGraph.style.display = "block";
            btn.value = "Hide Graph Results";
            //btn.value = divid;
        } else {
            divGraph.style.display = "none";
            btn.value = "Show Graph Results";
        }
    }
</script>
</script>

</body>
</html>


workbooks/pictures/aks_bcdr.png METASEP

workbooks/pictures/advanced_editor.png METASEP

workbooks/blocks/sample_workbook.json METASEP
{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Azure Review \n---\n\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists)."
      },
      "name": "Header"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "497a107e-dde8-433e-b263-35ac8e8f7834",
            "version": "KqlParameterItem/1.0",
            "name": "Subscription",
            "type": 6,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "includeAll": true,
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "value": [
              "value::all"
            ]
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 5"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "links": [
          {
            "id": "52de57bf-f1f1-443d-98a0-8f546d02a905",
            "cellValue": "VisibleTab",
            "linkTarget": "parameter",
            "linkLabel": "Category1",
            "subTarget": "Category1",
            "preText": "Category1 text",
            "style": "primary"
          },
          {
            "id": "83cdc1ff-b9a7-4a07-b7dd-0fc3f9d5ed94",
            "cellValue": "VisibleTab",
            "linkTarget": "parameter",
            "linkLabel": "Category2",
            "subTarget": "Category2",
            "preText": "Category2 Text",
            "style": "secondary"
          },
          {
            "id": "4aef8c92-daa6-41c5-bc12-2c3d6aa2ba71",
            "cellValue": "VisibleTab",
            "linkTarget": "parameter",
            "linkLabel": "Category3",
            "subTarget": "Category3",
            "preText": "Category3 Text",
            "style": "link"
          }
        ]
      },
      "name": "links - 4"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 1,
            "content": {
              "json": "## Category 1\r\n\r\nLorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua"
            },
            "name": "text - 9"
          },
          {
            "type": 1,
            "content": {
              "json": "### Query 1\r\n\r\nLorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua"
            },
            "name": "text - 2"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "where type=='microsoft.containerservice/managedclusters' | extend compliant= isnotnull(zones) | distinct id,compliant",
              "size": 4,
              "queryType": 1,
              "resourceType": "microsoft.resourcegraph/resources",
              "crossComponentResources": [
                "{Subscription}"
              ],
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "id",
                    "formatter": 0,
                    "numberFormat": {
                      "unit": 0,
                      "options": {
                        "style": "decimal"
                      }
                    }
                  },
                  {
                    "columnMatch": "compliant",
                    "formatter": 18,
                    "formatOptions": {
                      "thresholdsOptions": "icons",
                      "thresholdsGrid": [
                        {
                          "operator": "==",
                          "thresholdValue": "1",
                          "representation": "success",
                          "text": "Success"
                        },
                        {
                          "operator": "==",
                          "thresholdValue": "0",
                          "representation": "failed",
                          "text": "Failed"
                        },
                        {
                          "operator": "Default",
                          "thresholdValue": null,
                          "representation": "unknown",
                          "text": "Unknown"
                        }
                      ]
                    }
                  }
                ]
              }
            },
            "name": "query - 1"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "VisibleTab",
        "comparison": "isEqualTo",
        "value": "Category1"
      },
      "name": "MainGroup"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 1,
            "content": {
              "json": "## Category 2\r\n\r\nLorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua"
            },
            "name": "text - 9"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "VisibleTab",
        "comparison": "isEqualTo",
        "value": "Category2"
      },
      "name": "MainGroup"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 1,
            "content": {
              "json": "## Category 3\r\n\r\nLorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua"
            },
            "name": "text - 9"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "VisibleTab",
        "comparison": "isEqualTo",
        "value": "Category3"
      },
      "name": "MainGroup"
    }
  ],
  "fallbackResourceIds": [
    "Azure Monitor"
  ],
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}
workbooks/blocks/block_workbook.json METASEP
{
    "version": "Notebook/1.0",
    "items": [
      {
        "type": 1,
        "content": {
          "json": "## Azure Review \n---\n\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists)."
        },
        "name": "Header"
      },
      {
        "type": 9,
        "content": {
          "version": "KqlParameterItem/1.0",
          "parameters": [
            {
              "id": "497a107e-dde8-433e-b263-35ac8e8f7834",
              "version": "KqlParameterItem/1.0",
              "name": "Subscription",
              "type": 6,
              "multiSelect": true,
              "quote": "'",
              "delimiter": ",",
              "typeSettings": {
                "additionalResourceOptions": [
                  "value::all"
                ],
                "includeAll": true,
                "showDefault": false
              },
              "timeContext": {
                "durationMs": 86400000
              },
              "value": [
                "value::all"
              ]
            }
          ],
          "style": "pills",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces"
        },
        "name": "parameters - 5"
      },
      {
        "type": 11,
        "content": {
          "version": "LinkItem/1.0",
          "style": "tabs",
          "links": [
          ]
        },
        "name": "links - 4"
      }
    ],
    "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}
workbooks/blocks/block_text.json METASEP
{
    "type": 1,
    "content": {
        "json": "### Query 1\r\n\r\nLorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua"
    },
    "name": "text - 2"
}

workbooks/blocks/block_query.json METASEP
{
    "type": 3,
    "content": {
      "version": "KqlItem/1.0",
      "query": "where type=='microsoft.containerservice/managedclusters' | extend compliant= isnotnull(zones) | distinct id,compliant",
      "size": 1,
      "queryType": 1,
      "resourceType": "microsoft.resourcegraph/resources",
      "crossComponentResources": [
        "{Subscription}"
      ],
      "gridSettings": {
        "formatters": [
          {
            "columnMatch": "id",
            "formatter": 0,
            "numberFormat": {
              "unit": 0,
              "options": {
                "style": "decimal"
              }
            }
          },
          {
            "columnMatch": "compliant",
            "formatter": 18,
            "formatOptions": {
              "thresholdsOptions": "icons",
              "thresholdsGrid": [
                {
                  "operator": "==",
                  "thresholdValue": "1",
                  "representation": "success",
                  "text": "Success"
                },
                {
                  "operator": "==",
                  "thresholdValue": "0",
                  "representation": "failed",
                  "text": "Failed"
                },
                {
                  "operator": "Default",
                  "thresholdValue": null,
                  "representation": "unknown",
                  "text": "Unknown"
                }
              ]
            }
          }
        ]
      }
    },
    "name": "query - 1"
}

workbooks/blocks/block_linkgroup.json METASEP
{
    "type": 11,
    "content": {
      "version": "LinkItem/1.0",
      "style": "tabs",
      "links": [
      ]
    },
    "name": "links - 4"
}

workbooks/blocks/block_link.json METASEP
{
    "id": "12345678-1234-1234-1234-123456789012",
    "cellValue": "VisibleTab",
    "linkTarget": "parameter",
    "linkLabel": "category_id",
    "subTarget": "category_id",
    "preText": "Sample text",
    "style": "primary"
}

workbooks/blocks/block_itemgroup.json METASEP
{
    "type": 12,
    "content": {
      "version": "NotebookGroup/1.0",
      "groupType": "editable",
      "items": [
        {
            "type": 1,
            "content": {
                "json": "### Query 1\r\n\r\nLorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua"
            },
            "name": "text - 2"
        }
      ]
    },
    "conditionalVisibility": {
      "parameterName": "VisibleTab",
      "comparison": "isEqualTo",
      "value": "Category3"
    },
    "name": "MainGroup"
}
workbooks/blocks/block_arm.json METASEP
{
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workbookDisplayName": {
            "type":"string",
            "defaultValue": "My Workbook",
            "metadata": {
                "description": "The friendly name for the workbook that is used in the Gallery or Saved List. Needs to be unique in the scope of the resource group and source" 
            }
        },
        "workbookType": {
            "type":"string",
            "defaultValue": "workbook",
            "metadata": {
                "description": "The gallery that the workbook will be shown under. Supported values include workbook, `tsg`, Azure Monitor, etc." 
            }
        },
        "workbookSourceId": {
            "type":"string",
            "defaultValue": "Azure Monitor",
            "metadata": {
                "description": "The id of resource instance to which the workbook will be associated" 
            }
        },
        "workbookId": {
            "type":"string",
            "defaultValue": "[newGuid()]",
            "metadata": {
                "description": "The unique guid for this workbook instance" 
            }
        }
    },    
    "resources": [
        {
            "name": "[parameters('workbookId')]",
            "type": "Microsoft.Insights/workbooks",
            "location": "[resourceGroup().location]",
            "kind": "shared",
            "apiVersion": "2018-06-17-preview",
            "dependsOn": [],
            "properties": {
                "displayName": "[parameters('workbookDisplayName')]",
                "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":\"{\\\"json\\\":\\\"Hello World!\\\"}\",\"conditionalVisibility\":null}],\"isLocked\":false}",
                "version": "1.0",
                "sourceId": "[parameters('workbookSourceId')]",
                "category": "[parameters('workbookType')]"
            }
        }
    ],
    "outputs": {
        "workbookId": {
            "type": "string",
            "value": "[resourceId( 'Microsoft.Insights/workbooks', parameters('workbookId'))]"
        }
    }
}
web/flaskmysql/requirements.txt METASEP
flask
pymysql
flask-mysql
web/flaskmysql/Dockerfile METASEP
FROM ubuntu:18.04
MAINTAINER Jose Moreno "jose.moreno@microsoft.com"

RUN apt-get update -y && apt-get install -y python3-pip python3-dev build-essential curl libssl1.0.0 libssl-dev libpq-dev
COPY . /app
WORKDIR /app
RUN pip3 install -r requirements.txt
CMD ["sh", "-c", "python3 ./app.py"]

EXPOSE 5000
web/fillgraphdb/requirements.txt METASEP
pymysql
azure-mgmt-resourcegraph
azure-mgmt-resource
azure-cli-core
azure.identity
requests
web/fillgraphdb/Dockerfile METASEP
FROM ubuntu:18.04
MAINTAINER Jose Moreno "jose.moreno@microsoft.com"

RUN apt-get update -y && apt-get install -y python3-pip python3-dev build-essential curl libssl1.0.0 libssl-dev libpq-dev gir1.2-secret-1
COPY . /app
WORKDIR /app
RUN pip3 install -r requirements.txt
CMD ["sh", "-c", "python3 graph_db.py"]

web/filldb/requirements.txt METASEP
requests
pymysql
web/filldb/Dockerfile METASEP
FROM ubuntu:18.04
MAINTAINER Jose Moreno "jose.moreno@microsoft.com"

RUN apt-get update -y && apt-get install -y python3-pip python3-dev build-essential curl libssl1.0.0 libssl-dev libpq-dev
COPY . /app
WORKDIR /app
RUN pip3 install -r requirements.txt
CMD ["sh", "-c", "python3 fill_db.py"]

web/createdb/create_mysql.azcli METASEP
# Variables
rg=checklistweb
location=westeurope
suffix=$RANDOM
mysql_server_name="checklist${suffix}"
mysql_server_username=checklist
mysql_server_password=$(echo $(tr -dc a-zA-Z0-9 </dev/urandom 2>/dev/null| head -c 12))
akv_name="checklist${suffix}"
akv_secret_usr="mysqluser"
akv_secret_pwd="mysqlpassword"

# Create RG and mysql server
echo "Creating resource group $rg in $location..."
az group create -n $rg -l $location -o none
echo "Creating MySQL server $sql_server_name..."
az mysql server create -l $location -g $rg -n $mysql_server_name \
    -u $mysql_server_username -p $mysql_server_password \
    --sku-name B_Gen5_1 --ssl-enforcement Enabled --minimal-tls-version TLS1_1 \
    --public-network-access Enabled -o none

# Add this IP address to MySQL server firewall
myip=$(curl -s4 ifconfig.co)
echo "Adding IP address $myip to MySQL server firewall..."
az mysql server firewall-rule create -g $rg -s $mysql_server_name -n allow$RANDOM --start-ip-address $myip --end-ip-address $myip -o none

# Create key vault and store username and password
echo "Creating Azure Key Vault $akv_name..."
az keyvault create -n $akv_name -g $rg -l $location -o none
echo "Storing MySQL username and password in AKV $akv_name..."
az keyvault secret set -n $akv_secret_usr --vault-name $akv_name --value "$mysql_server_username" -o none
az keyvault secret set -n $akv_secret_pwd --vault-name $akv_name --value "$mysql_server_password" -o none

# Test retrieval and export as environment variables
mysql_server_name=$(az mysql server list -g $rg --query '[0].name' -o tsv)
akv_name=$(az keyvault list -g $rg --query '[0].name' -o tsv)
export MYSQL_FQDN=$(az mysql server show -n $mysql_server_name -g $rg --query 'fullyQualifiedDomainName' -o tsv)
export MYSQL_USER="$(az keyvault secret show -n $akv_secret_usr --vault-name $akv_name --query value -o tsv)"
export MYSQL_PASSWORD="$(az keyvault secret show -n $akv_secret_pwd --vault-name $akv_name --query value -o tsv)"

web/bicep/sql.bicep METASEP

@description('Server Name for Azure database for MySQL')
param serverName string

@description('MySQL server administrator login name')
@minLength(1)
param administratorLogin string

@description('MySQL server administrator password')
@minLength(8)
@secure()
param administratorLoginPassword string

@description('Location for all resources.')
param location string = resourceGroup().location

var skuName = 'B_Gen5_1'
var skuFamily = 'Gen5'
var skuCapacity = 1
var skuTier = 'Basic'
var skuSizeMB = 5120
var mySqlVersion = '5.7'
var backupRetentionDays = 7
var geoRedundantBackup = 'Disabled'
var sslEnforcement = 'Disabled'
var firewallrules = [
  {
    Name: 'permitAll'
    StartIpAddress: '0.0.0.0'
    EndIpAddress: '255.255.255.255'
  }
]

resource serverName_resource 'Microsoft.DBforMySQL/servers@2017-12-01' = {
  name: serverName
  location: location
  sku: {
    name: skuName
    tier: skuTier
    capacity: skuCapacity
    size: 'skuSizeMB'
    family: skuFamily
  }
  properties: {
    createMode: 'Default'
    version: mySqlVersion
    administratorLogin: administratorLogin
    administratorLoginPassword: administratorLoginPassword
    sslEnforcement: sslEnforcement
    storageProfile: {
      storageMB: skuSizeMB
      backupRetentionDays: backupRetentionDays
      geoRedundantBackup: geoRedundantBackup
    }
  }
}

@batchSize(1)
resource serverName_firewallrules_Name 'Microsoft.DBforMySQL/servers/firewallRules@2017-12-01' = [for item in firewallrules: {
  name: '${serverName}/${item.Name}'
  properties: {
    startIpAddress: item.StartIpAddress
    endIpAddress: item.EndIpAddress
  }
  dependsOn: [
    serverName_resource
  ]
}]

output mysql_fqdn string = serverName_resource.properties.fullyQualifiedDomainName

web/bicep/mi.bicep METASEP
param managedIdentityName string
//param roleDefinitionId string = 'b24988ac-6180-42a0-ab88-20f7382dd24c'
param roleNameGuid string = newGuid()
@allowed([
  'Owner'
  'Contributor'
  'Reader'
])
@description('Built-in role to assign')
param builtInRoleType string = 'Reader'

var role = {
  Owner: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635'
  Contributor: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'
  Reader: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7'
}

resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30' = {
  name: managedIdentityName
  location: resourceGroup().location
}

resource roleassignment 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
  //name: guid(roleDefinitionId, resourceGroup().id)
  name: roleNameGuid
  scope: tenant()
  properties: {
    principalType: 'ServicePrincipal'
    //roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitionId)
    roleDefinitionId: role[builtInRoleType]
    principalId: managedIdentity.properties.principalId
  }
}

output managedIdentityID string = managedIdentity.id
output managedIdentityName string = managedIdentity.name

web/bicep/main.bicep METASEP
@description('Options available for the checklist')
@allowed([
  'lz'
  'aks'
  'avd'
  'security'
])
param checklistTech string = 'lz'
@description('Server Name for Azure database for MySQL')
param serverName string = 'sql${uniqueString(resourceGroup().id)}'
@description('MySQL server administrator login name')
@minLength(1)
param administratorLogin string
@description('MySQL server administrator password')
@minLength(8)
@secure()
param administratorLoginPassword string
param managedIdentityName string = 'mi${uniqueString(resourceGroup().id)}'
param filldbGrphContainerName string = 'filldbgraph${uniqueString(resourceGroup().id)}'
param filldbContainerName string = 'filldb${uniqueString(resourceGroup().id)}'
param flaskContainerName string = 'flask${uniqueString(resourceGroup().id)}'
//param resourceGroupName string = resourceGroup().name
//param subscriptionId string

//var fullManagedIdentityID = '/subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/${managedIdentityName}'


module mi 'mi.bicep' = {
  name: 'deploy-managedIdentity'
  params: {
    managedIdentityName: managedIdentityName
  }
}

module sql 'sql.bicep' = {
  name: 'deploy-sql'
  params: {
    administratorLogin: administratorLogin
    administratorLoginPassword: administratorLoginPassword
    serverName: serverName
  }
}

module filldbContainer 'filldb.bicep' = {
  name: 'deploy-filldb'
  params: {
    mysql_fqdn: sql.outputs.mysql_fqdn
    containerName: filldbContainerName
    administratorLogin: administratorLogin
    administratorLoginPassword: administratorLoginPassword
    checklistTech: checklistTech
  }
}

module filldbGraphContainer 'filldbgraph.bicep' = {
  name: 'deploy-filldbgraph'
  params: {
    mysql_fqdn: sql.outputs.mysql_fqdn
    containerName: filldbGrphContainerName
    administratorLogin: administratorLogin
    administratorLoginPassword: administratorLoginPassword
    fullManagedIdentityID: mi.outputs.managedIdentityID
  }
}

module flask 'flask.bicep' = {
  name: 'deploy-flask'
  params: {
    mysql_fqdn: sql.outputs.mysql_fqdn
    containerName: flaskContainerName
    administratorLogin: administratorLogin
    administratorLoginPassword: administratorLoginPassword
  }
}

output miID string = mi.outputs.managedIdentityID

web/bicep/flask.bicep METASEP
param containerName string //= 'go-app1'
param location string = 'westeurope'
param imageName string = 'erjosito/checklist-flask:1.0'
param cpuCores int = 1
param memoryInGb int = 1
param mysql_fqdn string
@description('MySQL server administrator login name')
@minLength(1)
param administratorLogin string
var aciPort = 5000

@description('MySQL server administrator password')
@minLength(8)
@secure()
param administratorLoginPassword string

resource containerGroup 'Microsoft.ContainerInstance/containerGroups@2019-12-01' = {
  name: containerName
  location: location
  properties: {
    containers: [
      {
        name: containerName
        properties: {
          environmentVariables: [
            {
              name: 'MYSQL_USER'
              value: administratorLogin 
            }
            {
              name: 'MYSQL_PASSWORD'
              secureValue: administratorLoginPassword 
            }
            {
              name: 'MYSQL_FQDN'
              value: mysql_fqdn 
            }

          ]
          ports: [
            {
              port: aciPort
              protocol: 'TCP'
            }
          ]
          image: imageName
          resources: {
            requests: {
              cpu: cpuCores
              memoryInGB: memoryInGb
            }
          }
        }
      }
    ]
    ipAddress: {
      type: 'Public'
      ports: [
        {
          port: aciPort
          protocol: 'TCP'
        }
      ]
    }
    restartPolicy: 'OnFailure'
    osType: 'Linux'
  }
}

web/bicep/filldbgraph.bicep METASEP
param containerName string //= 'go-app1'
param location string = 'westeurope'
param imageName string = 'erjosito/checklist-fillgraphdb:1.0'
param cpuCores int = 1
param memoryInGb int = 1
param mysql_fqdn string
@description('MySQL server administrator login name')
@minLength(1)
param administratorLogin string
param fullManagedIdentityID string

@description('MySQL server administrator password')
@minLength(8)
@secure()
param administratorLoginPassword string

resource containerGroup 'Microsoft.ContainerInstance/containerGroups@2019-12-01' = {
  name: containerName
  location: location
  identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
      '${fullManagedIdentityID}':{}
    }  
  } 
  properties: {
    containers: [
      {
        name: containerName
        properties: {
          environmentVariables: [
            {
              name: 'MYSQL_USER'
              value: administratorLogin 
            }
            {
              name: 'MYSQL_PASSWORD'
              secureValue: administratorLoginPassword 
            }
            {
              name: 'MYSQL_FQDN'
              value: mysql_fqdn 
            }

          ]
          image: imageName
          resources: {
            requests: {
              cpu: cpuCores
              memoryInGB: memoryInGb
            }
          }
        }
      }
    ]
    restartPolicy: 'OnFailure'
    osType: 'Linux'
  }
}

web/bicep/filldb.bicep METASEP
param containerName string //= 'go-app1'
param location string = 'westeurope'
param imageName string = 'erjosito/checklist-filldb:1.0'
param cpuCores int = 1
param memoryInGb int = 1
param checklistTech string
param mysql_fqdn string
@description('MySQL server administrator login name')
@minLength(1)
param administratorLogin string

@description('MySQL server administrator password')
@minLength(8)
@secure()
param administratorLoginPassword string

resource containerGroup 'Microsoft.ContainerInstance/containerGroups@2019-12-01' = {
  name: containerName
  location: location
  properties: {
    containers: [
      {
        name: containerName
        properties: {
          environmentVariables: [
            {
              name: 'CHECKLIST_TECHNOLOGY'
              value: checklistTech 
            }
            {
              name: 'MYSQL_USER'
              value: administratorLogin 
            }
            {
              name: 'MYSQL_PASSWORD'
              secureValue: administratorLoginPassword 
            }
            {
              name: 'MYSQL_FQDN'
              value: mysql_fqdn 
            }

          ]
          image: imageName
          resources: {
            requests: {
              cpu: cpuCores
              memoryInGB: memoryInGb
            }
          }
        }
      }
    ]
    restartPolicy: 'OnFailure'
    osType: 'Linux'
  }
}

web/bicep/deploy-mi.ps1 METASEP
## Update Variables a you need to
$rgName = "flkelly-checklist"
$rgLocation = "westeurope"

## Test to see if Resource Group exists
Write-Host "Checking if $rgname Resource Group Exists" -nonewline 
$test = Get-AzResourceGroup -Name $rgName -Location $rgLocation -ErrorAction SilentlyContinue
if ($null -eq $test) {
    Write-Host -ForegroundColor red " [NO]"
    Write-Host "$rgname Resource Group not found - creating it"
    New-AzResourceGroup -Name $rgName -Location $rgLocation
} else {
    Write-Host -ForegroundColor green " [YES]"
}

$deploymentFile = ".\main.bicep"

try {
    $deploymentName = (($deploymentFile).Substring(2)).Replace("\","-") + "-" +(get-date -Format ddMMyyyy-hhmmss) + "-deployment"
    New-AzResourceGroupDeployment -TemplateFile $deploymentFile -Name $deploymentName -ResourceGroupName $rgName
}
catch {
    write-host "Failure - $_"
}

web/arm/template.json METASEP
{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "metadata": {},
    "parameters": {
        "checklistTech": {
            "type": "string",
            "defaultValue": "lz",
            "allowedValues": [
                "lz",
                "aks",
                "avd",
                "security"
            ],
            "metadata": {
                "description": "Options available for the checklist"
            }
        },
        "identityId": {
            "type": "string",
            "defaultValue": "",
            "metadata": {
                "description": "ID for user-assigned identity that will be assigned to the ACI (not required if specifying Tenant ID, Client ID and Client secret)"
            }
        },
        "tenantId": {
            "type": "string",
            "defaultValue": "",
            "metadata": {
                "description": "Tenant ID for SP-based authentication (not required if specifying Identity Id)"
            }
        },
        "clientId": {
            "type": "string",
            "defaultValue": "",
            "metadata": {
                "description": "Client ID for SP-based authentication (not required if specifying Identity Id)"
            }
        },
        "clientSecret": {
            "type": "securestring",
            "defaultValue": "",
            "metadata": {
                "description": "Client secret for SP-based authentication (not required if specifying Identity Id)"
            }
        },
        "aciName": {
            "type": "string",
            "metadata": {
                "description": "ACI name for container group"
            }
        },
        "serverName": {
            "type": "string",
            "metadata": {
                "description": "Server Name for Azure database for MySQL"
            }
        },
        "administratorLogin": {
            "type": "string",
            "minLength": 1,
            "metadata": {
                "description": "MySQL server administrator login name"
            }
        },
        "administratorLoginPassword": {
            "type": "securestring",
            "minLength": 8,
            "metadata": {
                "description": "MySQL server administrator password"
            }
        },
        "waitIntervals": {
            "type": "int",
            "defaultValue": "[if(equals(parameters('identityId'),''), 0, 3)]",
            "metadata": {
                "description": "MySQL server administrator password"
            }
        },
        "location": {
            "type": "string",
            "defaultValue": "[resourceGroup().location]",
            "metadata": {
                "description": "Location for all resources."
            }
        }
    },
    "functions": [],
    "variables": {
        "mysql_api_version": "2017-12-01",
        "identity_api_version": "2018-11-30",
        "roleassignment_api_version": "2020-04-01-preview",
        "aci_api_version": "2019-12-01",
        "skuName": "B_Gen5_1",
        "skuFamily": "Gen5",
        "skuCapacity": 1,
        "skuTier": "Basic",
        "skuSizeMB": 5120,
        "mySqlVersion": "5.7",
        "backupRetentionDays": 7,
        "geoRedundantBackup": "Disabled",
        "sslEnforcement": "Disabled",
        "firewallrules": [
            {
                "Name": "permitAll",
                "StartIpAddress": "0.0.0.0",
                "EndIpAddress": "255.255.255.255"
            }
        ],
        "webImage": "erjosito/checklist-flask:1.0",
        "filldbImage": "erjosito/checklist-filldb:1.0",
        "fillgraphdbImage": "erjosito/checklist-fillgraphdb:1.0",
        "webName": "[concat(parameters('aciName'), '-web')]",
        "filldbName": "[concat(parameters('aciName'), '-db')]",
        "fillgraphdbName": "[concat(parameters('aciName'), '-graph')]",
        "aciPort": 5000,
        "idJson": "[concat('{\"type\": \"UserAssigned\", \"userAssignedIdentities\": {\"', parameters('identityId'), '\": {} } }')]",
        "spVariablesJson":"[concat('{\"name\": \"AZURE_TENANT_ID\", \"secureValue\": \"', parameters('tenantId'), '\"}, {\"name\": \"AZURE_CLIENT_ID\", \"secureValue\": \"', parameters('clientId'), '}, {\"name\": \"AZURE_CLIENT_SECRET\", \"secureValue\": \"', parameters('clientSecret'), '\"}')]"
    },
    "resources": [
        {
            "type": "Microsoft.DBforMySQL/servers",
            "apiVersion": "[variables('mysql_api_version')]",
            "name": "[parameters('serverName')]",
            "location": "[parameters('location')]",
            "sku": {
                "name": "[variables('skuName')]",
                "tier": "[variables('skuTier')]",
                "capacity": "[variables('skuCapacity')]",
                "size": "[format('{0}', variables('skuSizeMB'))]",
                "family": "[variables('skuFamily')]"
            },
            "properties": {
                "createMode": "Default",
                "version": "[variables('mysqlVersion')]",
                "administratorLogin": "[parameters('administratorLogin')]",
                "administratorLoginPassword": "[parameters('administratorLoginPassword')]",
                "sslEnforcement": "[variables('sslEnforcement')]",
                "storageProfile": {
                    "storageMB": "[variables('skuSizeMB')]",
                    "backupRetentionDays": "[variables('backupRetentionDays')]",
                    "geoRedundantBackup": "[variables('geoRedundantBackup')]"
                }
            }
        },
        {
            "copy": {
                "name": "firewallRules",
                "count": "[length(variables('firewallrules'))]",
                "mode": "serial",
                "batchSize": 1
            },
            "type": "Microsoft.DBforMySQL/servers/firewallRules",
            "apiVersion": "[variables('mysql_api_version')]",
            "name": "[format('{0}/{1}', parameters('serverName'), variables('firewallrules')[copyIndex()].Name)]",
            "properties": {
            "startIpAddress": "[variables('firewallrules')[copyIndex()].StartIpAddress]",
            "endIpAddress": "[variables('firewallrules')[copyIndex()].EndIpAddress]"
            },
            "dependsOn": [
                "[resourceId('Microsoft.DBforMySQL/servers', parameters('serverName'))]"
            ]
        },
        {
            "type": "Microsoft.ContainerInstance/containerGroups",
            "apiVersion": "[variables('aci_api_version')]",
            "name": "[variables('filldbName')]",
            "location": "[parameters('location')]",
            "dependsOn": [
                "[resourceId('Microsoft.DBforMySQL/servers', parameters('serverName'))]"
            ],
            "properties": {
                "initContainers": [],
                "containers": [
                    {
                        "name": "filldb",
                        "properties": {
                            "image": "[variables('filldbImage')]",
                            "environmentVariables": [
                                {
                                    "name": "CHECKLIST_TECHNOLOGY",
                                    "value": "[parameters('checklistTech')]"
                                },
                                {
                                    "name": "MYSQL_USER",
                                    "secureValue": "[parameters('administratorLogin')]"
                                },
                                {
                                    "name": "MYSQL_PASSWORD",
                                    "secureValue": "[parameters('administratorLoginPassword')]"
                                },
                                {
                                    "name": "MYSQL_FQDN",
                                    "value": "[reference(resourceId('Microsoft.DBforMySQL/servers', parameters('serverName'))).fullyQualifiedDomainName]"
                                }
                            ],
                            "ports": [],
                            "resources": {
                                "requests": {
                                    "cpu": 1,
                                    "memoryInGB": 1
                                }
                            }
                        }
                    }
                ],
                "osType": "Linux",
                "restartPolicy": "Always"
            }
        },
        {
            "type": "Microsoft.ContainerInstance/containerGroups",
            "apiVersion": "[variables('aci_api_version')]",
            "name": "[concat(variables('fillgraphdbName'),'-sp')]",
            "location": "[parameters('location')]",
            "condition": "[equals(parameters('identityId'), '')]",
            "dependsOn": [
                "[resourceId('Microsoft.ContainerInstance/containerGroups', variables('filldbName'))]"
            ],
            "identity": "[if(equals(parameters('identityId'), ''), json('null'), json(variables('idJson')))]",
            "properties": {
                "initContainers": [],
                "containers": [
                    {
                        "name": "fillgraphdb",
                        "properties": {
                            "image": "[variables('fillgraphdbImage')]",
                            "environmentVariables": [
                                {
                                    "name": "MYSQL_USER",
                                    "secureValue": "[parameters('administratorLogin')]"
                                },
                                {
                                    "name": "MYSQL_PASSWORD",
                                    "secureValue": "[parameters('administratorLoginPassword')]"
                                },
                                {
                                    "name": "MYSQL_FQDN",
                                    "value": "[reference(resourceId('Microsoft.DBforMySQL/servers', parameters('serverName'))).fullyQualifiedDomainName]"
                                },
                                {
                                    "name": "AZURE_TENANT_ID",
                                    "secureValue": "[parameters('tenantId')]"
                                },
                                {
                                    "name": "AZURE_CLIENT_ID",
                                    "secureValue": "[parameters('clientId')]"
                                },
                                {
                                    "name": "AZURE_CLIENT_SECRET",
                                    "secureValue": "[parameters('clientSecret')]"
                                },
                                {
                                    "name": "WAIT_INTERVALS",
                                    "secureValue": "[parameters('waitIntervals')]"
                                }
                            ],
                            "ports": [
                                {
                                    "port": "[variables('aciPort')]",
                                    "protocol": "TCP"
                                }
                            ],
                            "resources": {
                                "requests": {
                                    "cpu": 1,
                                    "memoryInGB": 1
                                }
                            }
                        }
                    }
                ],
                "osType": "Linux",
                "restartPolicy": "Always",
                "ipAddress": {
                    "type": "Public",
                    "ports": [
                        {
                            "port": "[variables('aciPort')]",
                            "protocol": "TCP"
                        }
                    ]
                }
            }
        },
        {
            "type": "Microsoft.ContainerInstance/containerGroups",
            "apiVersion": "[variables('aci_api_version')]",
            "name": "[concat(variables('fillgraphdbName'),'-mi')]",
            "location": "[parameters('location')]",
            "condition": "[not(equals(parameters('identityId'), ''))]",
            "dependsOn": [
                "[resourceId('Microsoft.ContainerInstance/containerGroups', variables('filldbName'))]"
            ],
            "identity": "[if(equals(parameters('identityId'), ''), json('null'), json(variables('idJson')))]",
            "properties": {
                "initContainers": [],
                "containers": [
                    {
                        "name": "fillgraphdb",
                        "properties": {
                            "image": "[variables('fillgraphdbImage')]",
                            "environmentVariables": [
                                {
                                    "name": "MYSQL_USER",
                                    "secureValue": "[parameters('administratorLogin')]"
                                },
                                {
                                    "name": "MYSQL_PASSWORD",
                                    "secureValue": "[parameters('administratorLoginPassword')]"
                                },
                                {
                                    "name": "MYSQL_FQDN",
                                    "value": "[reference(resourceId('Microsoft.DBforMySQL/servers', parameters('serverName'))).fullyQualifiedDomainName]"
                                },
                                {
                                    "name": "WAIT_INTERVALS",
                                    "secureValue": "[parameters('waitIntervals')]"
                                }
                            ],
                            "ports": [
                                {
                                    "port": "[variables('aciPort')]",
                                    "protocol": "TCP"
                                }
                            ],
                            "resources": {
                                "requests": {
                                    "cpu": 1,
                                    "memoryInGB": 1
                                }
                            }
                        }
                    }
                ],
                "osType": "Linux",
                "restartPolicy": "Always",
                "ipAddress": {
                    "type": "Public",
                    "ports": [
                        {
                            "port": "[variables('aciPort')]",
                            "protocol": "TCP"
                        }
                    ]
                }
            }
        },
        {
            "type": "Microsoft.ContainerInstance/containerGroups",
            "apiVersion": "[variables('aci_api_version')]",
            "name": "[variables('webName')]",
            "location": "[parameters('location')]",
            "dependsOn": [
                "[resourceId('Microsoft.ContainerInstance/containerGroups', concat(variables('fillgraphdbName'),'-sp'))]",
                "[resourceId('Microsoft.ContainerInstance/containerGroups', concat(variables('fillgraphdbName'),'-mi'))]"
            ],
            "properties": {
                "initContainers": [],
                "containers": [
                    {
                        "name": "flask",
                        "properties": {
                            "image": "[variables('webImage')]",
                            "environmentVariables": [
                                {
                                    "name": "MYSQL_USER",
                                    "secureValue": "[parameters('administratorLogin')]"
                                },
                                {
                                    "name": "MYSQL_PASSWORD",
                                    "secureValue": "[parameters('administratorLoginPassword')]"
                                },
                                {
                                    "name": "MYSQL_FQDN",
                                    "value": "[reference(resourceId('Microsoft.DBforMySQL/servers', parameters('serverName'))).fullyQualifiedDomainName]"
                                }
                            ],
                            "ports": [
                                {
                                    "port": "[variables('aciPort')]",
                                    "protocol": "TCP"
                                }
                            ],
                            "resources": {
                                "requests": {
                                    "cpu": 1,
                                    "memoryInGB": 1
                                }
                            }
                        }
                    }
                ],
                "osType": "Linux",
                "restartPolicy": "Always",
                "ipAddress": {
                    "type": "Public",
                    "ports": [
                        {
                            "port": "[variables('aciPort')]",
                            "protocol": "TCP"
                        }
                    ]
                }
            }
        }
    ],
    "outputs": {
        "containerIPv4Address": {
            "type": "string",
            "value": "[reference(resourceId('Microsoft.ContainerInstance/containerGroups', variables('webName'))).ipAddress.ip]"
        },
        "waitIntervals": {
            "type": "int",
            "value": "[parameters('waitIntervals')]"
        }
    }
}

web/arm/parameters.json METASEP
{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "identityName": {
            "value": "checklistid"
        },
        "serverName": {
            "value": "checklistsql1138"
        },
        "administratorLogin": {
            "value": "jose"
        },
        "administratorLoginPassword": {
            "reference": {
                "keyVault": {
                    "id": "/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/myKeyvault/providers/Microsoft.KeyVault/vaults/erjositoKeyvault"
                },
                "secretName": "defaultPassword"
            }
        }
    }
}
web/arm/deploy_sp.azcli METASEP
##################################################################
# 1. Retrieve SP credentials from Azure Key Vault, or create one #
##################################################################

# Variables
keyvault_name=erjositoKeyvault
keyvault_rg=keyvaults   # Only required if new AKV is to be created
keyvault_loc=westeurope # Only required if new AKV is to be created
purpose=checklists

# Day zero: create Azure Key Vault if required
echo "Verifying if AKV ${keyvault_name} exists..."
keyvault_rg_found=$(az keyvault list -o tsv --query "[?name=='$keyvault_name'].resourceGroup")
if [[ -n ${keyvault_rg_found} ]]
then
    echo "AKV ${keyvault_name} found in resource group $keyvault_rg_found"
    keyvault_rg="$keyvault_rg_found"
else
    echo "Creating AKV ${keyvault_name} in RG ${keyvault_rg}..."
    az group create -n $keyvault_rg -l $keyvault_loc -o none
    az keyvault create -n $keyvault_name -g $keyvault_rg -l $keyvault_loc -o none
    user_name=$(az account show --query 'user.name' -o tsv)
    echo "Setting policies for user ${user_name}..."
    az keyvault set-policy -n $keyvault_name -g $keyvault_rg --upn $user_name -o none \
        --certificate-permissions backup create delete deleteissuers get getissuers import list listissuers managecontacts manageissuers purge recover restore setissuers update \
        --key-permissions backup create decrypt delete encrypt get import list purge recover restore sign unwrapKey update verify wrapKey \
        --secret-permissions backup delete get list purge recover restore set \
        --storage-permissions backup delete deletesas get getsas list listsas purge recover regeneratekey restore set setsas update
fi

# Try to get SP details from AKV
echo "Trying to get secrets from AKV ${keyvault_name}..."
keyvault_appid_secret_name=$purpose-sp-appid
keyvault_password_secret_name=$purpose-sp-secret
sp_app_id=$(az keyvault secret show --vault-name $keyvault_name -n $keyvault_appid_secret_name --query 'value' -o tsv)
sp_app_secret=$(az keyvault secret show --vault-name $keyvault_name -n $keyvault_password_secret_name --query 'value' -o tsv)

# If either variable is blank, create new SP with the required name
if [[ -z "$sp_app_id" ]] || [[ -z "$sp_app_secret" ]]
then
    # Create new SP
    echo "Service Principal secrets for ${purpose} not found, creating new Service Principal..."
    sp_name=$purpose
    sp_output=$(az ad sp create-for-rbac --name $sp_name --skip-assignment 2>/dev/null)
    sp_app_id=$(echo $sp_output | jq -r '.appId')
    sp_app_secret=$(echo $sp_output | jq -r '.password')
    az keyvault secret set --vault-name $keyvault_name --name $keyvault_appid_secret_name --value $sp_app_id -o none
    az keyvault secret set --vault-name $keyvault_name --name $keyvault_password_secret_name --value $sp_app_secret -o none
    # Optionally, assign  Azure RBAC roles (example a RG) or AKV policy (example certificate/secret get if the SP should be able to retrieve certs)
    echo "Adding Reader role to new Service Principal..."
    subscription_id=$(az account show --query id -o tsv)
    scope="/subscriptions/${subscription_id}"
    az role assignment create --scope $scope --assignee $sp_app_id --role 'Reader' -o none
fi

# Verify whether SP has expired, and if so, renew it
sp_end_date=$(az ad app show --id $sp_app_id --query 'passwordCredentials[0].endDate' -o tsv)
sp_end_date=$(date --date="$sp_end_date" +%s)
now=$(date +%s)
if [[ $sp_end_date < $now ]]
then
    echo "SP expired, extending one year"
    new_password=$(az ad app credential reset --id $sp_app_id --years 1 --query password -o tsv)
    az keyvault secret set --vault-name $keyvault_name --name $keyvault_password_secret_name --value $new_password -o none
    sp_app_secret=$new_password
else
    echo "SP not expired, not required to renew"
fi

# Optional: test the SP credentials
# tenant_id=$(az account show --query tenantId -o tsv)
# az login --service-principal -u $sp_app_id -p $sp_app_secret --tenant $tenant_id

####################################################
# 2. Create RG and deploy checklist infrastructure #
####################################################

suffix=$RANDOM
rg="checklist${suffix}"
location=westeurope
aci_name="checklistaci${suffix}"
mysql_server_name="mysql${suffix}"
mysql_server_user=$(whoami)
mysql_server_password=$(echo $(tr -dc a-zA-Z0-9 </dev/urandom 2>/dev/null| head -c 12))
echo "Creating resource group ${rg} in ${location}..."
az group create -n $rg -l $location -o none
echo "Deploying template to resource group ${rg}..."
tenant_id=$(az account show --query tenantId -o tsv)
az deployment group create -n checklist$RANDOM -g $rg --template-file ./template.json --parameters \
    "checklistTech=aks" \
    "tenantId=${tenant_id}" \
    "clientId=${sp_app_id}" \
    "clientSecret=${sp_app_secret}" \
    "aciName=${aci_name}" \
    "serverName=${mysql_server_name}" \
    "administratorLogin=${mysql_server_user}" \
    "administratorLoginPassword=${mysql_server_password}"

# Cleanup
# az group delete $rg -y --no-wait
web/arm/deploy_mi.azcli METASEP
##############################################
# 1. Retrieve Managed Identity, or create one #
##############################################

id_name=checklistid
id_location=westeurope
id_rg=checklistid
id_id=$(az identity show -n $id_name -g $id_rg --query id -o tsv)
if [[ -z "$id_id" ]]; then
    echo "Creating user identity in resource group ${id_rg}..."
    az group create -n $id_rg -l $id_location -o none
    az identity create -n $id_name -g $id_rg -o none
    id_id=$(az identity show -n $id_name -g $id_rg --query id -o tsv)
    id_client_id=$(az identity show -n $id_name -g $id_rg --query clientId -o tsv)
    subscription_id=$(az account show --query id -o tsv)
    scope="/subscriptions/${subscription_id}"
    az role assignment create --scope $scope --assignee $id_client_id --role 'Reader' -o none
    echo "User-managed identity has been created: $id_id"
else
    echo "User-managed identity has been located: $id_id"
fi

####################################################
# 2. Create RG and deploy checklist infrastructure #
####################################################

# Variables
suffix=$RANDOM
rg="checklist${suffix}"
location=westeurope
aci_name="checklistaci${suffix}"
mysql_server_name="mysql${suffix}"
mysql_server_user=$(whoami)
mysql_server_password=$(echo $(tr -dc a-zA-Z0-9 </dev/urandom 2>/dev/null| head -c 12))

# Create RG
echo "Creating resource group ${rg} in ${location}..."
az group create -n $rg -l $location -o none

# Deploy ARM template
echo "Deploying template to resource group ${rg}..."
az deployment group create -n checklist$RANDOM -g $rg --template-file ./template.json --parameters \
    "checklistTech=aks" \
    "identityId=${id_id}" \
    "aciName=${aci_name}" \
    "serverName=${mysql_server_name}" \
    "administratorLogin=${mysql_server_user}" \
    "administratorLoginPassword=${mysql_server_password}"

# Optional: see containers created in the RG
az container list -g $rg -o table

# Optional: re-run fillgraphdb container to refresh the Graph query results
graph_aci_name="graph${suffix}"
graph_image="erjosito/checklist-fillgraphdb:1.0"
mysql_server_fqdn=$(az mysql server show -n $mysql_server_name -g $rg --query 'fullyQualifiedDomainName' -o tsv)
echo "Creating ACI ${graph_aci_name}..."
az container create -n $graph_aci_name -g $rg --assign-identity "$id_id" --image "$graph_image" --ip-address public --restart-policy OnFailure -o none -e \
    "MYSQL_PASSWORD=${mysql_server_password}" \
    "MYSQL_USER=${mysql_server_user}" \
    "MYSQL_FQDN=${mysql_server_fqdn}" \
    "WAIT_INTERVALS=6"

###########
# Cleanup #
###########

# Note the cleanup process doesnt delete the identity created, so that it can be leveraged for other checklist-based reviews
# az group delete $rg -y --no-wait
spreadsheet/macrofree/sqldb_security_checklist.pt.xlsx METASEP

spreadsheet/macrofree/sqldb_security_checklist.ko.xlsx METASEP

spreadsheet/macrofree/sqldb_security_checklist.ja.xlsx METASEP

spreadsheet/macrofree/sqldb_security_checklist.es.xlsx METASEP

spreadsheet/macrofree/sqldb_security_checklist.en.xlsx METASEP

spreadsheet/macrofree/security_checklist.pt.xlsx METASEP

spreadsheet/macrofree/security_checklist.ko.xlsx METASEP

spreadsheet/macrofree/security_checklist.ja.xlsx METASEP

spreadsheet/macrofree/security_checklist.es.xlsx METASEP

spreadsheet/macrofree/security_checklist.en.xlsx METASEP

spreadsheet/macrofree/sap_checklist.pt.xlsx METASEP

spreadsheet/macrofree/sap_checklist.ko.xlsx METASEP

spreadsheet/macrofree/sap_checklist.ja.xlsx METASEP

spreadsheet/macrofree/sap_checklist.es.xlsx METASEP

spreadsheet/macrofree/sap_checklist.en.xlsx METASEP

spreadsheet/macrofree/review_checklist_empty.xlsx METASEP

spreadsheet/macrofree/lz_checklist.pt.xlsx METASEP

spreadsheet/macrofree/lz_checklist.ko.xlsx METASEP

spreadsheet/macrofree/lz_checklist.ja.xlsx METASEP

spreadsheet/macrofree/lz_checklist.es.xlsx METASEP

spreadsheet/macrofree/lz_checklist.en.xlsx METASEP

spreadsheet/macrofree/eh_security_checklist.pt.xlsx METASEP

spreadsheet/macrofree/eh_security_checklist.ko.xlsx METASEP

spreadsheet/macrofree/eh_security_checklist.ja.xlsx METASEP

spreadsheet/macrofree/eh_security_checklist.es.xlsx METASEP

spreadsheet/macrofree/eh_security_checklist.en.xlsx METASEP

spreadsheet/macrofree/blob_storage_security_checklist.pt.xlsx METASEP

spreadsheet/macrofree/blob_storage_security_checklist.ko.xlsx METASEP

spreadsheet/macrofree/blob_storage_security_checklist.ja.xlsx METASEP

spreadsheet/macrofree/blob_storage_security_checklist.es.xlsx METASEP

spreadsheet/macrofree/blob_storage_security_checklist.en.xlsx METASEP

spreadsheet/macrofree/avd_checklist.pt.xlsx METASEP

spreadsheet/macrofree/avd_checklist.ko.xlsx METASEP

spreadsheet/macrofree/avd_checklist.ja.xlsx METASEP

spreadsheet/macrofree/avd_checklist.es.xlsx METASEP

spreadsheet/macrofree/avd_checklist.en.xlsx METASEP

spreadsheet/macrofree/asb_security_checklist.pt.xlsx METASEP

spreadsheet/macrofree/asb_security_checklist.ko.xlsx METASEP

spreadsheet/macrofree/asb_security_checklist.ja.xlsx METASEP

spreadsheet/macrofree/asb_security_checklist.es.xlsx METASEP

spreadsheet/macrofree/asb_security_checklist.en.xlsx METASEP

spreadsheet/macrofree/appsvc_security_checklist.pt.xlsx METASEP

spreadsheet/macrofree/appsvc_security_checklist.ko.xlsx METASEP

spreadsheet/macrofree/appsvc_security_checklist.ja.xlsx METASEP

spreadsheet/macrofree/appsvc_security_checklist.es.xlsx METASEP

spreadsheet/macrofree/appsvc_security_checklist.en.xlsx METASEP

spreadsheet/macrofree/apim_checklist.pt.xlsx METASEP

spreadsheet/macrofree/apim_checklist.ko.xlsx METASEP

spreadsheet/macrofree/apim_checklist.ja.xlsx METASEP

spreadsheet/macrofree/apim_checklist.es.xlsx METASEP

spreadsheet/macrofree/apim_checklist.en.xlsx METASEP

spreadsheet/macrofree/aks_checklist.pt.xlsx METASEP

spreadsheet/macrofree/aks_checklist.ko.xlsx METASEP

spreadsheet/macrofree/aks_checklist.ja.xlsx METASEP

spreadsheet/macrofree/aks_checklist.es.xlsx METASEP

spreadsheet/macrofree/aks_checklist.en.xlsx METASEP

spreadsheet/macrofree/acr_security_checklist.pt.xlsx METASEP

spreadsheet/macrofree/acr_security_checklist.ko.xlsx METASEP

spreadsheet/macrofree/acr_security_checklist.ja.xlsx METASEP

spreadsheet/macrofree/acr_security_checklist.es.xlsx METASEP

spreadsheet/macrofree/acr_security_checklist.en.xlsx METASEP

web/flaskmysql/app.py METASEP
#app.py
from flask import Flask, request, render_template, jsonify
from flaskext.mysql import MySQL #pip install flask-mysql
import pymysql
import os
  
app = Flask(__name__)

# Get database credentials from environment variables
mysql_server_fqdn = os.environ.get("MYSQL_FQDN")
if mysql_server_fqdn == None:
    print("ERROR: Please define an environment variable 'MYSQL_FQDN' with the FQDN of the MySQL server")
    sys.exit(1)
mysql_server_name = mysql_server_fqdn.split('.')[0]
mysql_server_username = os.environ.get("MYSQL_USER")
if mysql_server_username == None:
    print("ERROR: Please define an environment variable 'MYSQL_USER' with the FQDN of the MySQL username")
    sys.exit(1)
if not mysql_server_username.__contains__('@'):
    mysql_server_username += '@' + mysql_server_name
mysql_server_password = os.environ.get("MYSQL_PASSWORD")
if mysql_server_password == None:
    print("ERROR: Please define an environment variable 'MYSQL_PASSWORD' with the FQDN of the MySQL password")
    sys.exit(1)

# Open connection
mysql = MySQL()
app.config['MYSQL_DATABASE_USER'] = mysql_server_username
app.config['MYSQL_DATABASE_PASSWORD'] = mysql_server_password
app.config['MYSQL_DATABASE_DB'] = 'checklist'
app.config['MYSQL_DATABASE_HOST'] = mysql_server_fqdn
mysql.init_app(app)
  
@app.route('/')
def home():
    app.logger.info("DEBUG: Connecting to database...") 
    try:
        category_filter  = request.args.get('category', None)
        status_filter  = request.args.get('status', None)
        severity_filter  = request.args.get('severity', None)
    except Exception as e:
        app.logger.info("ERROR reading query parameters for filters: {0}".format(str(e)))
        pass
    try:
        conn = mysql.connect()
        cursor = conn.cursor(pymysql.cursors.DictCursor)
    except Exception as e:
        app.logger.info("ERROR opening cursor to DB connection: {0}".format(str(e)))
        return jsonify(str(e))
    try:
        sqlquery = "SELECT * from items"
        filter1_added = False
        # category filter
        if category_filter:
            if filter1_added:
                sqlquery += " AND "
            else:
                sqlquery += " WHERE "
                filter1_added = True
            sqlquery += "category = '{0}'".format(category_filter)
        # status filter
        if status_filter:
            if filter1_added:
                sqlquery += " AND "
            else:
                sqlquery += " WHERE "
                filter1_added = True
            sqlquery += "status = '{0}'".format(status_filter)
        # severity filter
        if severity_filter:
            if filter1_added:
                sqlquery += " AND "
            else:
                sqlquery += " WHERE "
                filter1_added = True
            sqlquery += "severity = '{0}'".format(severity_filter)
        # send queries
        app.logger.info ("Retrieving checklist items with query '{0}'".format(sqlquery))
        cursor.execute(sqlquery)
        itemslist = cursor.fetchall()
        cursor.execute("SELECT DISTINCT category FROM items")
        categorylist = cursor.fetchall()
        cursor.execute("SELECT DISTINCT severity FROM items")
        severitylist = cursor.fetchall()
        cursor.execute("SELECT DISTINCT status FROM items")
        statuslist = cursor.fetchall()
        return render_template('index.html', itemslist=itemslist, categorylist=categorylist, severitylist=severitylist, statuslist=statuslist)
    except Exception as e:
        app.logger.info("ERROR sending query: {0}".format(str(e)))
        return jsonify(str(e))
 
@app.route("/update",methods=["POST","GET"])
def update():
    app.logger.info("Processing {0} with request.form {1}".format(str(request.method), str(request.form))) 
    try:
        conn = mysql.connect()
        cursor = conn.cursor(pymysql.cursors.DictCursor)
        if request.method == 'POST':
            field = request.form['field'] 
            value = request.form['value']
            editid = request.form['id']
            app.logger.info("Processing POST for field '{0}', editid '{1}' and value '{2}'".format(field, value, editid)) 
             
            if field == 'comment' and value != '':
                sql = "UPDATE items SET comments=%s WHERE guid=%s"
                data = (value, editid)
                conn = mysql.connect()
                cursor = conn.cursor()
                app.logger.info ("Sending SQL query '{0}' with data '{1}'".format(sql, str(data)))
                cursor.execute(sql, data)
                conn.commit()
            elif field == 'status' and value != '':
                sql = "UPDATE items SET status=%s WHERE guid=%s"
                data = (value, editid)
                conn = mysql.connect()
                cursor = conn.cursor()
                app.logger.info ("Sending SQL query '{0}' with data '{1}'".format(sql, str(data)))
                cursor.execute(sql, data)
                conn.commit()
            else:
                app.logger.info ("Field is '{0}', value is '{1}': not doing anything".format(field, value))
        success = 1
        return jsonify(success)
    except Exception as e:
        app.logger.info("Oh oh, there is an error: {0}".format(str(e)))
        success = 0
        return jsonify(success)
    finally:
        cursor.close() 
        conn.close()
  
if __name__ == "__main__":
    app.run(host='0.0.0.0', debug=True)


web/fillgraphdb/graph_db.py METASEP
import os
import sys
import pymysql
import json
import time
import requests
import azure.mgmt.resourcegraph as arg
from datetime import datetime
from azure.mgmt.resource import SubscriptionClient
from azure.identity import AzureCliCredential
from azure.identity import DefaultAzureCredential
from azure.identity import ClientSecretCredential

# Database and table name
mysql_db_name = "checklist"
mysql_db_table = "items"
use_ssl = "yes"

# Format a string to be included in a SQL query as value
def escape_quotes (this_value):
    return str(this_value).replace("'", "\\'")

# Function to send an Azure Resource Graph query
def get_resources (graph_query, argClient, subsList, argQueryOptions):
    # TO DO: Authentication should probably happen outside of this function
    try:
        # Create query
        argQuery = arg.models.QueryRequest(subscriptions=subsList, query=graph_query, options=argQueryOptions)
        # Run query and return results
        argResults = argClient.resources(argQuery)
        print("DEBUG: query results: {0}".format(str(argResults)))
        return argResults
    except Exception as e:
        print("ERROR: Error sending Azure Resource Graph query to Azure: {0}".format(str(e)))
        # sys.exit(0)   # Debugging.... Probably this should be exit(1)
        return ''

# Wait for IMDS endpoint to be available
try:
    wait_max_intervals = int(os.environ.get("WAIT_INTERVALS"))
    print ("DEBUG: WAIT_INTERVALS read from environment variable: {0}".format(str(wait_max_intervals)))
except:
    wait_max_intervals = 5
    print ("DEBUG: WAIT_INTERVALS set to default value: {0}".format(str(wait_max_intervals)))
wait_interval = 10.0
imds_url = 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/'
imds_headers = {
    "Metadata" : "true"
}
imds_tries = 0
break_loop = False
print ('DEBUG: Going into waiting loop to make sure the metadata endpoint is active...')
while not break_loop:
    imds_tries += 1
    print ("DEBUG: We are in the loop, pass {0}/{1} ({2}). Trying the IMDS endpoint...".format(str(imds_tries), str(wait_max_intervals), str(datetime.now())))
    if imds_tries > wait_max_intervals:
        print("ERROR: max wait intervals exceeded when waiting for IMDS to answer, hopefully you specified some SP credentials as SP variables...")
        break_loop = True
    else:
        print ("DEBUG: Sending GET request to {0}...".format(imds_url))
        try:
            imds_response = requests.get(imds_url, headers=imds_headers, timeout=1)
            if imds_response.status_code >= 200 and imds_response.status_code <= 299:
                print ("DEBUG: IMDS endpoint seems to be working, received status code {0} and answer {1}".format(str(imds_response.status_code), str(imds_response.text)))
                break_loop = True
            else:
                print ("DEBUG: IMDS endpoint doesnt seem to be working, received status code {0} and answer {1}".format(str(imds_response.status_code), str(imds_response.text)))
        except Exception as e:
            print("DEBUG: Error sending request to IMDS endpoint: {0}".format(str(e)))
            pass
        if not break_loop:
            print("DEBUG: Going to sleep {0} seconds before next try...".format(str(wait_interval)))
            time.sleep (wait_interval)

# Authenticate to Azure, either with Managed Identity or SP
print('DEBUG: Authenticating to Azure...')
try:
    print('DEBUG: Getting environment variables...')
    # credential = AzureCliCredential()          # Get your credentials from Azure CLI (development only!) and get your subscription list
    tenant_id = os.environ.get("AZURE_TENANT_ID")
    client_id = os.environ.get("AZURE_CLIENT_ID")
    client_secret = os.environ.get("AZURE_CLIENT_SECRET")
except Exception as e:
    print("ERROR: Error getting environment variables: {0}".format(str(e)))
    tenant_id = None
    client_id = None
    client_secret = None
    pass    
try:
    if tenant_id and client_id and client_secret:
        print("DEBUG: Service principal credentials (client ID {0}, tenant ID {1}) retrieved from environment variables, trying SP-based authentication now...".format(str(client_id), str(tenant_id)))
        credential = ClientSecretCredential(tenant_id=tenant_id, client_id=client_id, client_secret=client_secret)
    else:
        print('DEBUG: Service principal credentials could not be retrieved from environment variables, trying default authentication method with Managed Identity...')
        credential = DefaultAzureCredential()        # Managed identity
except Exception as e:
    print("ERROR: Error during Azure Authentication: {0}".format(str(e)))
    sys.exit(1)
try:
    print('DEBUG: Getting subscriptions...')
    subsClient = SubscriptionClient(credential)
    subsRaw = []
    for sub in subsClient.subscriptions.list():
        subsRaw.append(sub.as_dict())
    subsList = []
    for sub in subsRaw:
        subsList.append(sub.get('subscription_id'))
    print ("DEBUG: provided credentials give access to {0} subscription(s)".format(str(len(subsList))))
    # Create Azure Resource Graph client and set options
    print('DEBUG: Creating client object...')
    argClient = arg.ResourceGraphClient(credential)
    argQueryOptions = arg.models.QueryRequestOptions(result_format="objectArray")
except Exception as e:
    print("ERROR: Error creating resource graph client object: {0}".format(str(e)))
    sys.exit(1)

# Get database credentials from environment variables
mysql_server_fqdn = os.environ.get("MYSQL_FQDN")
if mysql_server_fqdn == None:
    print("ERROR: Please define an environment variable 'MYSQL_FQDN' with the FQDN of the MySQL server")
    sys.exit(1)
else:
    print("DEBUG: mysql FQDN retrieved from environment variables: '{0}'".format(mysql_server_fqdn))
mysql_server_name = mysql_server_fqdn.split('.')[0]
mysql_server_username = os.environ.get("MYSQL_USER")
if mysql_server_username == None:
    print("ERROR: Please define an environment variable 'MYSQL_USER' with the FQDN of the MySQL username")
    sys.exit(1)
else:
    print("DEBUG: mysql authentication username retrieved from environment variables: '{0}'".format(mysql_server_username))
if not mysql_server_username.__contains__('@'):
    mysql_server_username +=  '@' + mysql_server_name
mysql_server_password = os.environ.get("MYSQL_PASSWORD")
if mysql_server_password == None:
    print("ERROR: Please define an environment variable 'MYSQL_PASSWORD' with the FQDN of the MySQL password")
    sys.exit(1)
else:
    print("DEBUG: mysql authentication password retrieved from environment variables: {0}".format("********"))

# Create connection to MySQL server and number of records
print ("DEBUG: Connecting to '{0}' with username '{1}'...".format(mysql_server_fqdn, mysql_server_username))
if use_ssl == 'yes':
    db = pymysql.connect(host=mysql_server_fqdn, user = mysql_server_username, database = mysql_db_name, passwd = mysql_server_password, ssl = {'ssl':{'ca': 'BaltimoreCyberTrustRoot.crt.pem'}})
else:
    db = pymysql.connect(host=mysql_server_fqdn, user = mysql_server_username, database = mysql_db_name, passwd = mysql_server_password)
sql_query = "SELECT * FROM {0} WHERE graph_query_success IS NOT null AND graph_query_failure IS NOT null AND graph_query_success != 'None' AND graph_query_failure != 'None';".format (mysql_db_table)
cursor = db.cursor()
cursor.execute(sql_query)
rows = cursor.fetchall()
row_cnt = 0
if len(rows) > 0:
    for row in rows:
        row_cnt += 1
        result_text = ''
        item_guid = row[0]
        item_success_query = row[10]
        item_failure_query = row[11]
        # print ("DEBUG {0}: '{1}', '{2}'".format(item_guid, item_success_query, item_failure_query))
        success_resources = str(get_resources(item_success_query, argClient, subsList, argQueryOptions)).replace("'", '"')
        success_resources = success_resources.replace(': None', ': "None"')
        # print ("DEBUG: SUCCESS QUERY: {0}".format(success_resources))
        if success_resources:
            try:
                success_resources_object = json.loads(success_resources)
            except:
                print("ERROR: JSON returned from Azure Graph Query not valid: {0}".format(success_resources))
            for resource in success_resources_object['data']:
                if result_text: result_text += '\n'
                result_text += "SUCCESS: {0}".format(resource["id"])
        failure_resources = str(get_resources(item_failure_query, argClient, subsList, argQueryOptions)).replace("'", '"')
        failure_resources = failure_resources.replace(': None', ': "None"')
        # print ("DEBUG: FAILURE QUERY: {0}".format(failure_resources))
        if failure_resources:
            try:
                failure_resources_object = json.loads(failure_resources)
            except:
                print("ERROR: JSON returned from Azure Graph Query not valid: {0}".format(failure_resources))
            for resource in failure_resources_object['data']:
                if result_text: result_text += '\n'
                result_text += "FAILURE: {0}".format(resource["id"])
        # print ("DEBUG: Result summary: \n{0}".format(result_text))
        if result_text:
            update_query = "UPDATE items SET graph_query_result = '{0}' WHERE guid = '{1}';".format(result_text, item_guid)
            print ("DEBUG: sending SQL query '{0}'".format(update_query))
            try:
                cursor.execute(update_query)
                db.commit()
            except Exception as e:
                print("ERROR: Error sending SQL query to MySql server: {0}".format(str(e)))
                pass
        else:
            print("DEBUG: No results could be retrieved for the success and failure queries of checklist item {0}".format(item_guid))
else:
    row_count = 0
print ("INFO: Processed table {0} in database {1} with {2} records with graph queries. Happy review!".format(mysql_db_table, mysql_db_name, str(row_cnt)))

# Bye
db.close()
web/filldb/fill_db.py METASEP
import requests
import json
import os
import sys
import pymysql

# Database and table name
mysql_db_name = "checklist"
mysql_db_table = "items"
use_ssl = "yes"

# Format a string to be included in a SQL query as value
def escape_quotes(this_value):
    return str(this_value).replace("'", "\\'")

# Get database credentials from environment variables
mysql_server_fqdn = os.environ.get("MYSQL_FQDN")
if mysql_server_fqdn == None:
    print("ERROR: Please define an environment variable 'MYSQL_FQDN' with the FQDN of the MySQL server")
    sys.exit(1)
mysql_server_name = mysql_server_fqdn.split('.')[0]
mysql_server_username = os.environ.get("MYSQL_USER")
if mysql_server_username == None:
    print("ERROR: Please define an environment variable 'MYSQL_USER' with the FQDN of the MySQL username")
    sys.exit(1)
if not mysql_server_username.__contains__('@'):
    mysql_server_username +=  '@' + mysql_server_name
mysql_server_password = os.environ.get("MYSQL_PASSWORD")
if mysql_server_password == None:
    print("ERROR: Please define an environment variable 'MYSQL_PASSWORD' with the FQDN of the MySQL password")
    sys.exit(1)

# Create connection to MySQL server and get version
print ("INFO: Connecting to {0} with username {1}...".format(mysql_server_fqdn, mysql_server_username))
if use_ssl == 'yes':
    db = pymysql.connect(host=mysql_server_fqdn, user = mysql_server_username, passwd = mysql_server_password, ssl = {'ssl':{'ca': 'BaltimoreCyberTrustRoot.crt.pem'}})
else:
    db = pymysql.connect(host=mysql_server_fqdn, user = mysql_server_username, passwd = mysql_server_password)
sql_query = "SELECT VERSION();"
cursor = db.cursor()
cursor.execute(sql_query)
rows = cursor.fetchall()
data = ""
if len(rows) > 0:
    for row in rows:
        if len(data) > 0:
            data += ', '
        data += str(''.join(row))
print ("INFO: Connected to MySQL server {0} with version {1}".format(mysql_server_fqdn, data))

# Delete db if existed
sql_query = "DROP DATABASE IF EXISTS {0};".format(mysql_db_name)
# print ("Sending query: {0}".format(sql_query))
cursor.execute(sql_query)
db.commit()

# Create database
sql_query = "CREATE DATABASE IF NOT EXISTS {0};".format(mysql_db_name)
# print ("Sending query: {0}".format(sql_query))
cursor.execute(sql_query)
db.commit()
sql_query = "USE {0}".format(mysql_db_name)
# print ("Sending query: {0}".format(sql_query))
cursor.execute(sql_query)
db.commit()

# Create table
sql_query = """CREATE TABLE {0} (
    guid varchar(40),
    text varchar(1024),
    description varchar(1024),
    link varchar(255),
    training varchar(255),
    comments varchar(1024),
    severity varchar(10),
    status varchar(15),
    category varchar(255),
    subcategory varchar(255),
    graph_query_success varchar(1024),
    graph_query_failure varchar(1024),
    graph_query_result varchar(4096)
);""".format(mysql_db_table)
# print ("DEBUG: Sending query: {0}".format(sql_query))
cursor.execute(sql_query)
db.commit()

# Download checklist
technology = os.environ.get("CHECKLIST_TECHNOLOGY")
if technology:
    checklist_url = "https://raw.githubusercontent.com/Azure/review-checklists/main/checklists/" + technology + "_checklist.en.json"
else:
    checklist_url = "https://raw.githubusercontent.com/Azure/review-checklists/main/checklists/lz_checklist.en.json"
response = requests.get(checklist_url)

# If download was successful
if response.status_code == 200:
    print ("INFO: File {0} downloaded successfully".format(checklist_url))
    try:
        # Deserialize JSON to object variable
        checklist_object = json.loads(response.text)
    except Exception as e:
        print("Error deserializing JSON content: {0}".format(str(e)))
        sys.exit(1)
    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_object.get("status")
        default_status = status_list[0].get("name")
    except:
        default_status = "Not verified"
        pass
    # For each checklist item, add a row to mysql DB
    row_counter = 0
    for item in checklist_object.get("items"):
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")
        text = escape_quotes(item.get("text"))
        description = escape_quotes(item.get("description"))
        severity = item.get("severity")
        link = item.get("link")
        training = item.get("training")
        status = default_status
        graph_query_success = escape_quotes(item.get("graph_success"))
        graph_query_failure = escape_quotes(item.get("graph_failure"))
        # print("DEBUG: Adding to table {0}: '{1}', '{2}', '{3}', '{4}', '{5}', '{6}', '{7}', '{8}', '{9}', '{10}'".format(mysql_db_table, category, subcategory, text, description, severity, link, training, graph_query_success, graph_query_failure, guid))
        sql_query = """INSERT INTO {0} (category,subcategory,text,description,severity,link,training,graph_query_success,graph_query_failure,guid,status) 
            VALUES ('{1}','{2}','{3}','{4}','{5}', '{6}','{7}','{8}','{9}','{10}', '{11}');""".format(mysql_db_table, category, subcategory, text, description, severity, link, training, graph_query_success, graph_query_failure, guid, status)
        # print ("DEBUG: Sending query: {0}".format(sql_query))
        cursor.execute(sql_query)
        db.commit()
        row_counter += 1
else:
    print ("Error downloading {0}".format(checklist_url))

# Bye
print("INFO: {0} rows added to database.".format(str(row_counter)))
db.close()
web/filldb/check_db.py METASEP
import os
import sys
import pymysql

# Database and table name
mysql_db_name = "checklist"
mysql_db_table = "items"
use_ssl = "yes"

# Format a string to be included in a SQL query as value
def escape_quotes(this_value):
    return str(this_value).replace("'", "\\'")

# Get database credentials from environment variables
mysql_server_fqdn = os.environ.get("MYSQL_FQDN")
if mysql_server_fqdn == None:
    print("Please define an environment variable 'MYSQL_FQDN' with the FQDN of the MySQL server")
    sys.exit(1)
mysql_server_name = mysql_server_fqdn.split('.')[0]
mysql_server_username = os.environ.get("MYSQL_USER")
if mysql_server_username == None:
    print("Please define an environment variable 'MYSQL_USER' with the FQDN of the MySQL username")
    sys.exit(1)
if not mysql_server_username.__contains__('@'):
    mysql_server_username +=  '@' + mysql_server_name
mysql_server_password = os.environ.get("MYSQL_PASSWORD")
if mysql_server_password == None:
    print("Please define an environment variable 'MYSQL_PASSWORD' with the FQDN of the MySQL password")
    sys.exit(1)

# Create connection to MySQL server and number of records
print ("Connecting to {0} with username {1}...".format(mysql_server_fqdn, mysql_server_username))
if use_ssl == 'yes':
    db = pymysql.connect(host=mysql_server_fqdn, user = mysql_server_username, database = mysql_db_name, passwd = mysql_server_password, ssl = {'ssl':{'ca': 'BaltimoreCyberTrustRoot.crt.pem'}})
else:
    db = pymysql.connect(host=mysql_server_fqdn, user = mysql_server_username, database = mysql_db_name, passwd = mysql_server_password)
sql_query = "SELECT COUNT(*) FROM {0};".format (mysql_db_table)
cursor = db.cursor()
cursor.execute(sql_query)
rows = cursor.fetchall()
if len(rows) > 0:
    row_count = rows[0][0]
else:
    row_count = 0
print ("Table {0} in database {1} contains {2} records".format(mysql_db_table, mysql_db_name, str(row_count)))

# Bye
db.close()
workbooks/lz_checklist.en_workbook_template.json METASEP
{
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workbookDisplayName": {
            "type": "string",
            "defaultValue": "Azure Landing Zone Review",
            "metadata": {
                "description": "The friendly name for the workbook that is used in the Gallery or Saved List. Needs to be unique in the scope of the resource group and source"
            }
        },
        "workbookType": {
            "type": "string",
            "defaultValue": "workbook",
            "metadata": {
                "description": "The gallery that the workbook will be shown under. Supported values include workbook, `tsg`, Azure Monitor, etc."
            }
        },
        "workbookSourceId": {
            "type": "string",
            "defaultValue": "Azure Monitor",
            "metadata": {
                "description": "The id of resource instance to which the workbook will be associated"
            }
        },
        "workbookId": {
            "type": "string",
            "defaultValue": "[newGuid()]",
            "metadata": {
                "description": "The unique guid for this workbook instance"
            }
        }
    },
    "resources": [
        {
            "name": "[parameters('workbookId')]",
            "type": "Microsoft.Insights/workbooks",
            "location": "[resourceGroup().location]",
            "kind": "shared",
            "apiVersion": "2018-06-17-preview",
            "dependsOn": [],
            "properties": {
                "displayName": "[parameters('workbookDisplayName')]",
                "serializedData": "{\n    \"version\": \"Notebook/1.0\",\n    \"items\": [\n        {\n            \"type\": 1,\n            \"content\": {\n                \"json\": \"## Azure Landing Zone Review\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists).\"\n            },\n            \"name\": \"Header\"\n        },\n        {\n            \"type\": 9,\n            \"content\": {\n                \"version\": \"KqlParameterItem/1.0\",\n                \"parameters\": [\n                    {\n                        \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n                        \"version\": \"KqlParameterItem/1.0\",\n                        \"name\": \"Subscription\",\n                        \"type\": 6,\n                        \"multiSelect\": true,\n                        \"quote\": \"'\",\n                        \"delimiter\": \",\",\n                        \"typeSettings\": {\n                            \"additionalResourceOptions\": [\n                                \"value::all\"\n                            ],\n                            \"includeAll\": true,\n                            \"showDefault\": false\n                        },\n                        \"timeContext\": {\n                            \"durationMs\": 86400000\n                        },\n                        \"value\": [\n                            \"value::all\"\n                        ]\n                    }\n                ],\n                \"style\": \"pills\",\n                \"queryType\": 0,\n                \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n            },\n            \"name\": \"parameters - 5\"\n        },\n        {\n            \"type\": 11,\n            \"content\": {\n                \"version\": \"LinkItem/1.0\",\n                \"style\": \"tabs\",\n                \"links\": [\n                    {\n                        \"id\": \"1652e790-c2af-4822-bdba-59b5c3af669e\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Identity and Access\",\n                        \"subTarget\": \"category1\",\n                        \"preText\": \"Identity and Access\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"6d11d1ca-85f2-47e8-babf-bb4b807f4b2c\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Network Topology and Connectivity\",\n                        \"subTarget\": \"category2\",\n                        \"preText\": \"Network Topology and Connectivity\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"e0f43375-f650-44b2-acc2-834d7eabf0d8\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Security, Governance and Compliance\",\n                        \"subTarget\": \"category3\",\n                        \"preText\": \"Security, Governance and Compliance\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"9304d7d4-1c62-467f-b1ce-ac3353fbc340\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Management and Monitoring\",\n                        \"subTarget\": \"category4\",\n                        \"preText\": \"Management and Monitoring\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"7cfa4798-0ace-4fec-a29a-3475cbc0bcad\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Management Group and Subscriptions\",\n                        \"subTarget\": \"category5\",\n                        \"preText\": \"Management Group and Subscriptions\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"719f565f-807f-4a27-87af-0fb81c67e2b9\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Operations\",\n                        \"subTarget\": \"category6\",\n                        \"preText\": \"Operations\",\n                        \"style\": \"primary\"\n                    }\n                ]\n            },\n            \"name\": \"links - 4\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Identity and Access\"\n                        },\n                        \"name\": \"category1title\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category1\"\n            },\n            \"name\": \"category1\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Network Topology and Connectivity\"\n                        },\n                        \"name\": \"category2title\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"For secure delivery of HTTP/S apps, ensure that WAF protection and policies are enabled in your Application Gateways. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-faq) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext5\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = (properties.webApplicationFirewallConfiguration.enabled == True and properties.webApplicationFirewallConfiguration.firewallMode == 'Prevention')\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query5\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Ensure you are using Application Gateway v2 SKU. Check [this link](https://learn.microsoft.com/azure/application-gateway/overview-v2) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext6\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query6\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.\"\n                        },\n                        \"name\": \"querytext7\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query7\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-routing) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext8\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query8\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext9\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query9\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Use VPN gateways to connect branches or remote locations to Azure. For higher resilience, deploy zone-redundant gateways (where available).. Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext10\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query10\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Ensure to use IP addresses from the address allocation for private internets (RFC 1918).. Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext11\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)')  | project id, compliant, cidr\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query11\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16) . Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext12\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query12\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information.\"\n                        },\n                        \"name\": \"querytext13\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query13\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext14\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query14\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category2\"\n            },\n            \"name\": \"category2\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Security, Governance and Compliance\"\n                        },\n                        \"name\": \"category3title\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.. Check [this link](https://learn.microsoft.com/azure/key-vault/general/overview-throttling) for further information.\"\n                        },\n                        \"name\": \"querytext15\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query15\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category3\"\n            },\n            \"name\": \"category3\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Management and Monitoring\"\n                        },\n                        \"name\": \"category4title\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category4\"\n            },\n            \"name\": \"category4\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Management Group and Subscriptions\"\n                        },\n                        \"name\": \"category5title\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Enforce reasonably flat management group hierarchy with no more than three to four levels, ideally. Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups) for further information.. [This training](https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext1\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query1\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Enforce or appended resource tags through Azure Policy. Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/resource-tagging/?toc=/azure/azure-resource-manager/management/toc.json) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext2\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query2\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Enforce no subscriptions are placed under the root management group. Check [this link](https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---default-management-group) for further information.\"\n                        },\n                        \"name\": \"querytext3\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant = (array_length(mgmtChain) > 1)\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query3\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Ensure tags are used for billing and cost management. Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/track-costs) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext4\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query4\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category5\"\n            },\n            \"name\": \"category5\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Operations\"\n                        },\n                        \"name\": \"category6title\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category6\"\n            },\n            \"name\": \"category6\"\n        }\n    ],\n    \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}",
                "version": "1.0",
                "sourceId": "[parameters('workbookSourceId')]",
                "category": "[parameters('workbookType')]"
            }
        }
    ],
    "outputs": {
        "workbookId": {
            "type": "string",
            "value": "[resourceId( 'Microsoft.Insights/workbooks', parameters('workbookId'))]"
        }
    }
}
workbooks/lz_checklist.en_workbook.json METASEP
{
    "version": "Notebook/1.0",
    "items": [
        {
            "type": 1,
            "content": {
                "json": "## Azure Landing Zone Review\n---\n\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists)."
            },
            "name": "Header"
        },
        {
            "type": 9,
            "content": {
                "version": "KqlParameterItem/1.0",
                "parameters": [
                    {
                        "id": "497a107e-dde8-433e-b263-35ac8e8f7834",
                        "version": "KqlParameterItem/1.0",
                        "name": "Subscription",
                        "type": 6,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "typeSettings": {
                            "additionalResourceOptions": [
                                "value::all"
                            ],
                            "includeAll": true,
                            "showDefault": false
                        },
                        "timeContext": {
                            "durationMs": 86400000
                        },
                        "value": [
                            "value::all"
                        ]
                    }
                ],
                "style": "pills",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 5"
        },
        {
            "type": 11,
            "content": {
                "version": "LinkItem/1.0",
                "style": "tabs",
                "links": [
                    {
                        "id": "de48cb3f-fc99-4adc-84ea-8e433742fa9c",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Identity and Access",
                        "subTarget": "category1",
                        "preText": "Identity and Access",
                        "style": "primary"
                    },
                    {
                        "id": "ecb53dd2-6dea-46df-bb93-4d2977855947",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Network Topology and Connectivity",
                        "subTarget": "category2",
                        "preText": "Network Topology and Connectivity",
                        "style": "primary"
                    },
                    {
                        "id": "35df62c1-68fa-42f2-8977-3b20bd301938",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Security, Governance and Compliance",
                        "subTarget": "category3",
                        "preText": "Security, Governance and Compliance",
                        "style": "primary"
                    },
                    {
                        "id": "941f4b64-1d6b-4753-b52e-6ae30aac4c57",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Management and Monitoring",
                        "subTarget": "category4",
                        "preText": "Management and Monitoring",
                        "style": "primary"
                    },
                    {
                        "id": "2ea00808-4e8b-4c74-b451-11b6c1fc493e",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Management Group and Subscriptions",
                        "subTarget": "category5",
                        "preText": "Management Group and Subscriptions",
                        "style": "primary"
                    },
                    {
                        "id": "98eb8395-e9e0-48c1-985e-f924f9e7e358",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Operations",
                        "subTarget": "category6",
                        "preText": "Operations",
                        "style": "primary"
                    },
                    {
                        "id": "3d956b74-1817-4ade-88dc-823ec544ba23",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Backup and Disaster Recovery",
                        "subTarget": "category7",
                        "preText": "Backup and Disaster Recovery",
                        "style": "primary"
                    }
                ]
            },
            "name": "links - 4"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Identity and Access"
                        },
                        "name": "category1title"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category1"
            },
            "name": "category1"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Network Topology and Connectivity"
                        },
                        "name": "category2title"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "For secure delivery of HTTP/S apps, ensure that WAF protection and policies are enabled in your Application Gateways. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-faq) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this."
                        },
                        "name": "querytext5"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = (properties.webApplicationFirewallConfiguration.enabled == True and properties.webApplicationFirewallConfiguration.firewallMode == 'Prevention')",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query5"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Ensure you are using Application Gateway v2 SKU. Check [this link](https://learn.microsoft.com/azure/application-gateway/overview-v2) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this."
                        },
                        "name": "querytext6"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query6"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Deploy your WAF profiles for Front Door in 'Prevention' mode.. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings) for further information."
                        },
                        "name": "querytext7"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query7"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information."
                        },
                        "name": "querytext8"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query8"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-routing) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this."
                        },
                        "name": "querytext9"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query9"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this."
                        },
                        "name": "querytext10"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query10"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Use VPN gateways to connect branches or remote locations to Azure. For higher resilience, deploy zone-redundant gateways (where available).. Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this."
                        },
                        "name": "querytext11"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query11"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Ensure to use IP addresses from the address allocation for private internets (RFC 1918).. Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this."
                        },
                        "name": "querytext12"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)')  | project id, compliant, cidr",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query12"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16) . Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this."
                        },
                        "name": "querytext13"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query13"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Use Firewall Manager with Virtual WAN to deploy and manage Azure firewalls across Virtual WAN hubs or in hub virtual networks.. Check [this link](https://learn.microsoft.com/azure/firewall/) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this."
                        },
                        "name": "querytext14"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type == 'microsoft.network/azurefirewalls' | project id,compliant=isnotnull(properties.firewallPolicy.id)",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query14"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Don't enable virtual network service endpoints by default on all subnets.. Check [this link](https://learn.microsoft.com/azure/app-service/networking-features) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this."
                        },
                        "name": "querytext15"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query15"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information."
                        },
                        "name": "querytext16"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query16"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/) can help to educate yourself on this."
                        },
                        "name": "querytext17"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query17"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category2"
            },
            "name": "category2"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Security, Governance and Compliance"
                        },
                        "name": "category3title"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.. Check [this link](https://learn.microsoft.com/azure/key-vault/general/overview-throttling) for further information."
                        },
                        "name": "querytext18"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query18"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category3"
            },
            "name": "category3"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Management and Monitoring"
                        },
                        "name": "category4title"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category4"
            },
            "name": "category4"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Management Group and Subscriptions"
                        },
                        "name": "category5title"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Enforce reasonably flat management group hierarchy with no more than three to four levels, ideally. Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups) for further information.. [This training](https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/) can help to educate yourself on this."
                        },
                        "name": "querytext1"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query1"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Enforce or appended resource tags through Azure Policy. Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/resource-tagging/?toc=/azure/azure-resource-manager/management/toc.json) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/) can help to educate yourself on this."
                        },
                        "name": "querytext2"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query2"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Enforce no subscriptions are placed under the root management group. Check [this link](https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---default-management-group) for further information."
                        },
                        "name": "querytext3"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant = (array_length(mgmtChain) > 1)",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query3"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Ensure tags are used for billing and cost management. Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/track-costs) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/) can help to educate yourself on this."
                        },
                        "name": "querytext4"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query4"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category5"
            },
            "name": "category5"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Operations"
                        },
                        "name": "category6title"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category6"
            },
            "name": "category6"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Backup and Disaster Recovery"
                        },
                        "name": "category7title"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category7"
            },
            "name": "category7"
        }
    ],
    "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}
workbooks/lz_checklist.en_network_workbook_template.json METASEP
{
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workbookDisplayName": {
            "type": "string",
            "defaultValue": "Azure Landing Zone Review - Network",
            "metadata": {
                "description": "The friendly name for the workbook that is used in the Gallery or Saved List. Needs to be unique in the scope of the resource group and source"
            }
        },
        "workbookType": {
            "type": "string",
            "defaultValue": "workbook",
            "metadata": {
                "description": "The gallery that the workbook will be shown under. Supported values include workbook, `tsg`, Azure Monitor, etc."
            }
        },
        "workbookSourceId": {
            "type": "string",
            "defaultValue": "Azure Monitor",
            "metadata": {
                "description": "The id of resource instance to which the workbook will be associated"
            }
        },
        "workbookId": {
            "type": "string",
            "defaultValue": "[newGuid()]",
            "metadata": {
                "description": "The unique guid for this workbook instance"
            }
        }
    },
    "resources": [
        {
            "name": "[parameters('workbookId')]",
            "type": "Microsoft.Insights/workbooks",
            "location": "[resourceGroup().location]",
            "kind": "shared",
            "apiVersion": "2018-06-17-preview",
            "dependsOn": [],
            "properties": {
                "displayName": "[parameters('workbookDisplayName')]",
                "serializedData": "{\n    \"version\": \"Notebook/1.0\",\n    \"items\": [\n        {\n            \"type\": 1,\n            \"content\": {\n                \"json\": \"## Azure Landing Zone Review - Network\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists).\"\n            },\n            \"name\": \"Header\"\n        },\n        {\n            \"type\": 9,\n            \"content\": {\n                \"version\": \"KqlParameterItem/1.0\",\n                \"parameters\": [\n                    {\n                        \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n                        \"version\": \"KqlParameterItem/1.0\",\n                        \"name\": \"Subscription\",\n                        \"type\": 6,\n                        \"multiSelect\": true,\n                        \"quote\": \"'\",\n                        \"delimiter\": \",\",\n                        \"typeSettings\": {\n                            \"additionalResourceOptions\": [\n                                \"value::all\"\n                            ],\n                            \"includeAll\": true,\n                            \"showDefault\": false\n                        },\n                        \"timeContext\": {\n                            \"durationMs\": 86400000\n                        },\n                        \"value\": [\n                            \"value::all\"\n                        ]\n                    }\n                ],\n                \"style\": \"pills\",\n                \"queryType\": 0,\n                \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n            },\n            \"name\": \"parameters - 5\"\n        },\n        {\n            \"type\": 11,\n            \"content\": {\n                \"version\": \"LinkItem/1.0\",\n                \"style\": \"tabs\",\n                \"links\": [\n                    {\n                        \"id\": \"68189e67-2f3e-416e-a1d1-b08132141f94\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Internet\",\n                        \"subTarget\": \"category1\",\n                        \"preText\": \"Internet\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"5dfc0655-1673-4368-8c39-a59175f84891\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Inspection\",\n                        \"subTarget\": \"category2\",\n                        \"preText\": \"Inspection\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"057dd226-0ee8-4a0d-8548-e12b924ee669\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Hybrid\",\n                        \"subTarget\": \"category3\",\n                        \"preText\": \"Hybrid\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"211a3b4b-d941-4d1e-ab80-64ba073077ac\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"App delivery\",\n                        \"subTarget\": \"category4\",\n                        \"preText\": \"App delivery\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"a494e5f9-92de-434a-80af-724e6bfa78b8\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Segmentation\",\n                        \"subTarget\": \"category5\",\n                        \"preText\": \"Segmentation\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"d5fcd478-e553-49d9-b55b-f2a679d96bbe\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Virtual WAN\",\n                        \"subTarget\": \"category6\",\n                        \"preText\": \"Virtual WAN\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"497a6804-e1f2-47e5-b1bc-519a4ff511b8\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Encryption\",\n                        \"subTarget\": \"category7\",\n                        \"preText\": \"Encryption\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"b1130b84-d6b7-435a-b326-730e7517e17f\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Hub and spoke\",\n                        \"subTarget\": \"category8\",\n                        \"preText\": \"Hub and spoke\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"ad38b17a-b861-4942-b20a-660f6926d39c\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"IP plan\",\n                        \"subTarget\": \"category9\",\n                        \"preText\": \"IP plan\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"c0aecc13-39f7-4659-938c-0bdf18bef4b3\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"PaaS\",\n                        \"subTarget\": \"category10\",\n                        \"preText\": \"PaaS\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"2d22b221-3154-4990-94c6-966ddcbd2b42\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Front Door\",\n                        \"subTarget\": \"category11\",\n                        \"preText\": \"Front Door\",\n                        \"style\": \"primary\"\n                    }\n                ]\n            },\n            \"name\": \"links - 4\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Internet\"\n                        },\n                        \"name\": \"category1title\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Use Firewall Manager with Virtual WAN to deploy and manage Azure firewalls across Virtual WAN hubs or in hub virtual networks.. Check [this link](https://learn.microsoft.com/azure/firewall/) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext10\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | where type == 'microsoft.network/azurefirewalls' | project id,compliant=isnotnull(properties.firewallPolicy.id)\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query10\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category1\"\n            },\n            \"name\": \"category1\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Inspection\"\n                        },\n                        \"name\": \"category2title\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category2\"\n            },\n            \"name\": \"category2\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Hybrid\"\n                        },\n                        \"name\": \"category3title\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-routing) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext5\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query5\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext6\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query6\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Use VPN gateways to connect branches or remote locations to Azure. For higher resilience, deploy zone-redundant gateways (where available).. Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext7\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query7\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category3\"\n            },\n            \"name\": \"category3\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## App delivery\"\n                        },\n                        \"name\": \"category4title\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"For secure delivery of HTTP/S apps, ensure that WAF protection and policies are enabled in your Application Gateways. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-faq) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext1\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = (properties.webApplicationFirewallConfiguration.enabled == True and properties.webApplicationFirewallConfiguration.firewallMode == 'Prevention')\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query1\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Ensure you are using Application Gateway v2 SKU. Check [this link](https://learn.microsoft.com/azure/application-gateway/overview-v2) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext2\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query2\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category4\"\n            },\n            \"name\": \"category4\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Segmentation\"\n                        },\n                        \"name\": \"category5title\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information.\"\n                        },\n                        \"name\": \"querytext12\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query12\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext13\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query13\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category5\"\n            },\n            \"name\": \"category5\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Virtual WAN\"\n                        },\n                        \"name\": \"category6title\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category6\"\n            },\n            \"name\": \"category6\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Encryption\"\n                        },\n                        \"name\": \"category7title\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category7\"\n            },\n            \"name\": \"category7\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Hub and spoke\"\n                        },\n                        \"name\": \"category8title\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.\"\n                        },\n                        \"name\": \"querytext4\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query4\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category8\"\n            },\n            \"name\": \"category8\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## IP plan\"\n                        },\n                        \"name\": \"category9title\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Ensure to use IP addresses from the address allocation for private internets (RFC 1918).. Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext8\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)')  | project id, compliant, cidr\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query8\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16) . Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext9\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query9\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category9\"\n            },\n            \"name\": \"category9\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## PaaS\"\n                        },\n                        \"name\": \"category10title\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Don't enable virtual network service endpoints by default on all subnets.. Check [this link](https://learn.microsoft.com/azure/app-service/networking-features) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this.\"\n                        },\n                        \"name\": \"querytext11\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query11\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category10\"\n            },\n            \"name\": \"category10\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Front Door\"\n                        },\n                        \"name\": \"category11title\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Deploy your WAF profiles for Front Door in 'Prevention' mode.. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings) for further information.\"\n                        },\n                        \"name\": \"querytext3\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query3\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category11\"\n            },\n            \"name\": \"category11\"\n        }\n    ],\n    \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}",
                "version": "1.0",
                "sourceId": "[parameters('workbookSourceId')]",
                "category": "[parameters('workbookType')]"
            }
        }
    ],
    "outputs": {
        "workbookId": {
            "type": "string",
            "value": "[resourceId( 'Microsoft.Insights/workbooks', parameters('workbookId'))]"
        }
    }
}
workbooks/lz_checklist.en_network_workbook.json METASEP
{
    "version": "Notebook/1.0",
    "items": [
        {
            "type": 1,
            "content": {
                "json": "## Azure Landing Zone Review - Network\n---\n\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists)."
            },
            "name": "Header"
        },
        {
            "type": 9,
            "content": {
                "version": "KqlParameterItem/1.0",
                "parameters": [
                    {
                        "id": "497a107e-dde8-433e-b263-35ac8e8f7834",
                        "version": "KqlParameterItem/1.0",
                        "name": "Subscription",
                        "type": 6,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "typeSettings": {
                            "additionalResourceOptions": [
                                "value::all"
                            ],
                            "includeAll": true,
                            "showDefault": false
                        },
                        "timeContext": {
                            "durationMs": 86400000
                        },
                        "value": [
                            "value::all"
                        ]
                    }
                ],
                "style": "pills",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 5"
        },
        {
            "type": 11,
            "content": {
                "version": "LinkItem/1.0",
                "style": "tabs",
                "links": [
                    {
                        "id": "68189e67-2f3e-416e-a1d1-b08132141f94",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Internet",
                        "subTarget": "category1",
                        "preText": "Internet",
                        "style": "primary"
                    },
                    {
                        "id": "5dfc0655-1673-4368-8c39-a59175f84891",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Inspection",
                        "subTarget": "category2",
                        "preText": "Inspection",
                        "style": "primary"
                    },
                    {
                        "id": "057dd226-0ee8-4a0d-8548-e12b924ee669",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Hybrid",
                        "subTarget": "category3",
                        "preText": "Hybrid",
                        "style": "primary"
                    },
                    {
                        "id": "211a3b4b-d941-4d1e-ab80-64ba073077ac",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "App delivery",
                        "subTarget": "category4",
                        "preText": "App delivery",
                        "style": "primary"
                    },
                    {
                        "id": "a494e5f9-92de-434a-80af-724e6bfa78b8",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Segmentation",
                        "subTarget": "category5",
                        "preText": "Segmentation",
                        "style": "primary"
                    },
                    {
                        "id": "d5fcd478-e553-49d9-b55b-f2a679d96bbe",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Virtual WAN",
                        "subTarget": "category6",
                        "preText": "Virtual WAN",
                        "style": "primary"
                    },
                    {
                        "id": "497a6804-e1f2-47e5-b1bc-519a4ff511b8",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Encryption",
                        "subTarget": "category7",
                        "preText": "Encryption",
                        "style": "primary"
                    },
                    {
                        "id": "b1130b84-d6b7-435a-b326-730e7517e17f",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Hub and spoke",
                        "subTarget": "category8",
                        "preText": "Hub and spoke",
                        "style": "primary"
                    },
                    {
                        "id": "ad38b17a-b861-4942-b20a-660f6926d39c",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "IP plan",
                        "subTarget": "category9",
                        "preText": "IP plan",
                        "style": "primary"
                    },
                    {
                        "id": "c0aecc13-39f7-4659-938c-0bdf18bef4b3",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "PaaS",
                        "subTarget": "category10",
                        "preText": "PaaS",
                        "style": "primary"
                    },
                    {
                        "id": "2d22b221-3154-4990-94c6-966ddcbd2b42",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Front Door",
                        "subTarget": "category11",
                        "preText": "Front Door",
                        "style": "primary"
                    }
                ]
            },
            "name": "links - 4"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Internet"
                        },
                        "name": "category1title"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Use Firewall Manager with Virtual WAN to deploy and manage Azure firewalls across Virtual WAN hubs or in hub virtual networks.. Check [this link](https://learn.microsoft.com/azure/firewall/) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this."
                        },
                        "name": "querytext10"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type == 'microsoft.network/azurefirewalls' | project id,compliant=isnotnull(properties.firewallPolicy.id)",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query10"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category1"
            },
            "name": "category1"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Inspection"
                        },
                        "name": "category2title"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category2"
            },
            "name": "category2"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Hybrid"
                        },
                        "name": "category3title"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-routing) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this."
                        },
                        "name": "querytext5"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query5"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this."
                        },
                        "name": "querytext6"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query6"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Use VPN gateways to connect branches or remote locations to Azure. For higher resilience, deploy zone-redundant gateways (where available).. Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this."
                        },
                        "name": "querytext7"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query7"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category3"
            },
            "name": "category3"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## App delivery"
                        },
                        "name": "category4title"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "For secure delivery of HTTP/S apps, ensure that WAF protection and policies are enabled in your Application Gateways. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-faq) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this."
                        },
                        "name": "querytext1"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = (properties.webApplicationFirewallConfiguration.enabled == True and properties.webApplicationFirewallConfiguration.firewallMode == 'Prevention')",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query1"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Ensure you are using Application Gateway v2 SKU. Check [this link](https://learn.microsoft.com/azure/application-gateway/overview-v2) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this."
                        },
                        "name": "querytext2"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query2"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category4"
            },
            "name": "category4"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Segmentation"
                        },
                        "name": "category5title"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information."
                        },
                        "name": "querytext12"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query12"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/) can help to educate yourself on this."
                        },
                        "name": "querytext13"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query13"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category5"
            },
            "name": "category5"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Virtual WAN"
                        },
                        "name": "category6title"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category6"
            },
            "name": "category6"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Encryption"
                        },
                        "name": "category7title"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category7"
            },
            "name": "category7"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Hub and spoke"
                        },
                        "name": "category8title"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information."
                        },
                        "name": "querytext4"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query4"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category8"
            },
            "name": "category8"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## IP plan"
                        },
                        "name": "category9title"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Ensure to use IP addresses from the address allocation for private internets (RFC 1918).. Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this."
                        },
                        "name": "querytext8"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)')  | project id, compliant, cidr",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query8"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16) . Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this."
                        },
                        "name": "querytext9"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query9"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category9"
            },
            "name": "category9"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## PaaS"
                        },
                        "name": "category10title"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Don't enable virtual network service endpoints by default on all subnets.. Check [this link](https://learn.microsoft.com/azure/app-service/networking-features) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this."
                        },
                        "name": "querytext11"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query11"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category10"
            },
            "name": "category10"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Front Door"
                        },
                        "name": "category11title"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Deploy your WAF profiles for Front Door in 'Prevention' mode.. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings) for further information."
                        },
                        "name": "querytext3"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query3"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category11"
            },
            "name": "category11"
        }
    ],
    "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}
workbooks/appsvc_security_checklist.en_workbook.json METASEP
{
    "version": "Notebook/1.0",
    "items": [
        {
            "type": 1,
            "content": {
                "json": "## Azure App Security Review\n---\n\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists)."
            },
            "name": "Header"
        },
        {
            "type": 9,
            "content": {
                "version": "KqlParameterItem/1.0",
                "parameters": [
                    {
                        "id": "497a107e-dde8-433e-b263-35ac8e8f7834",
                        "version": "KqlParameterItem/1.0",
                        "name": "Subscription",
                        "type": 6,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "typeSettings": {
                            "additionalResourceOptions": [
                                "value::all"
                            ],
                            "includeAll": true,
                            "showDefault": false
                        },
                        "timeContext": {
                            "durationMs": 86400000
                        },
                        "value": [
                            "value::all"
                        ]
                    }
                ],
                "style": "pills",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 5"
        },
        {
            "type": 11,
            "content": {
                "version": "LinkItem/1.0",
                "style": "tabs",
                "links": [
                    {
                        "id": "fe31049c-21ce-4835-8811-ed6cba199743",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Security",
                        "subTarget": "category1",
                        "preText": "Security",
                        "style": "primary"
                    }
                ]
            },
            "name": "links - 4"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Security"
                        },
                        "name": "category1title"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Set minimum TLS policy to 1.2. Check [this link](https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions) for further information."
                        },
                        "name": "querytext1"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query1"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Use HTTPS only. Check [this link](https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https) for further information."
                        },
                        "name": "querytext2"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query2"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Turn off remote debugging. Check [this link](https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings) for further information."
                        },
                        "name": "querytext3"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query3"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category1"
            },
            "name": "category1"
        }
    ],
    "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}
workbooks/aks_checklist.en_workbook_template.json METASEP
{
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workbookDisplayName": {
            "type": "string",
            "defaultValue": "Azure AKS Review",
            "metadata": {
                "description": "The friendly name for the workbook that is used in the Gallery or Saved List. Needs to be unique in the scope of the resource group and source"
            }
        },
        "workbookType": {
            "type": "string",
            "defaultValue": "workbook",
            "metadata": {
                "description": "The gallery that the workbook will be shown under. Supported values include workbook, `tsg`, Azure Monitor, etc."
            }
        },
        "workbookSourceId": {
            "type": "string",
            "defaultValue": "Azure Monitor",
            "metadata": {
                "description": "The id of resource instance to which the workbook will be associated"
            }
        },
        "workbookId": {
            "type": "string",
            "defaultValue": "[newGuid()]",
            "metadata": {
                "description": "The unique guid for this workbook instance"
            }
        }
    },
    "resources": [
        {
            "name": "[parameters('workbookId')]",
            "type": "Microsoft.Insights/workbooks",
            "location": "[resourceGroup().location]",
            "kind": "shared",
            "apiVersion": "2018-06-17-preview",
            "dependsOn": [],
            "properties": {
                "displayName": "[parameters('workbookDisplayName')]",
                "serializedData": "{\n    \"version\": \"Notebook/1.0\",\n    \"items\": [\n        {\n            \"type\": 1,\n            \"content\": {\n                \"json\": \"## Azure AKS Review\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists).\"\n            },\n            \"name\": \"Header\"\n        },\n        {\n            \"type\": 9,\n            \"content\": {\n                \"version\": \"KqlParameterItem/1.0\",\n                \"parameters\": [\n                    {\n                        \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n                        \"version\": \"KqlParameterItem/1.0\",\n                        \"name\": \"Subscription\",\n                        \"type\": 6,\n                        \"multiSelect\": true,\n                        \"quote\": \"'\",\n                        \"delimiter\": \",\",\n                        \"typeSettings\": {\n                            \"additionalResourceOptions\": [\n                                \"value::all\"\n                            ],\n                            \"includeAll\": true,\n                            \"showDefault\": false\n                        },\n                        \"timeContext\": {\n                            \"durationMs\": 86400000\n                        },\n                        \"value\": [\n                            \"value::all\"\n                        ]\n                    }\n                ],\n                \"style\": \"pills\",\n                \"queryType\": 0,\n                \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n            },\n            \"name\": \"parameters - 5\"\n        },\n        {\n            \"type\": 11,\n            \"content\": {\n                \"version\": \"LinkItem/1.0\",\n                \"style\": \"tabs\",\n                \"links\": [\n                    {\n                        \"id\": \"5cd1a0db-74d5-443c-bd49-ecbd10b0b471\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Identity and Access Management\",\n                        \"subTarget\": \"category1\",\n                        \"preText\": \"Identity and Access Management\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"075d7db8-dff5-4e02-8260-2020dd5a3803\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Network Topology and Connectivity\",\n                        \"subTarget\": \"category2\",\n                        \"preText\": \"Network Topology and Connectivity\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"232b5a99-60b2-43d4-8bc5-e32fbe0bd7ae\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"BC and DR\",\n                        \"subTarget\": \"category3\",\n                        \"preText\": \"BC and DR\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"ffbbb20e-1974-45bc-bb70-b130d6fb44fb\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Governance and Security\",\n                        \"subTarget\": \"category4\",\n                        \"preText\": \"Governance and Security\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"5324bfe1-e675-4209-8049-7b3be77bc5aa\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Cost Governance\",\n                        \"subTarget\": \"category5\",\n                        \"preText\": \"Cost Governance\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"d181e2f9-5498-4806-bdea-4eda4b1e955f\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Operations\",\n                        \"subTarget\": \"category6\",\n                        \"preText\": \"Operations\",\n                        \"style\": \"primary\"\n                    },\n                    {\n                        \"id\": \"842c825a-468a-426d-8771-7ae18533ae0f\",\n                        \"cellValue\": \"VisibleTab\",\n                        \"linkTarget\": \"parameter\",\n                        \"linkLabel\": \"Application Deployment\",\n                        \"subTarget\": \"category7\",\n                        \"preText\": \"Application Deployment\",\n                        \"style\": \"primary\"\n                    }\n                ]\n            },\n            \"name\": \"links - 4\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Identity and Access Management\"\n                        },\n                        \"name\": \"category1title\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Use managed identities instead of Service Principals. Check [this link](https://learn.microsoft.com/azure/aks/use-managed-identity) for further information.\"\n                        },\n                        \"name\": \"querytext5\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query5\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Integrate authentication with AAD (using the managed integration). Check [this link](https://learn.microsoft.com/azure/aks/managed-aad) for further information.\"\n                        },\n                        \"name\": \"querytext6\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query6\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Disable AKS local accounts. Check [this link](https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts) for further information.\"\n                        },\n                        \"name\": \"querytext7\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query7\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category1\"\n            },\n            \"name\": \"category1\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Network Topology and Connectivity\"\n                        },\n                        \"name\": \"category2title\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Do not use AKS Application Routing Add-On. Check [this link](https://learn.microsoft.com/azure/aks/http-application-routing) for further information.\"\n                        },\n                        \"name\": \"querytext8\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query8\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"For Windows workloads use Accelerated Networking. Check [this link](https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview) for further information.\"\n                        },\n                        \"name\": \"querytext9\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query9\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Use the standard ALB (as opposed to the basic one). Check [this link](https://learn.microsoft.com/azure/aks/load-balancer-standard) for further information.\"\n                        },\n                        \"name\": \"querytext10\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query10\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Choose the best CNI network plugin for your requirements (Azure CNI recommended). Check [this link](https://learn.microsoft.com/azure/aks/operator-best-practices-network) for further information.\"\n                        },\n                        \"name\": \"querytext11\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query11\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Filter egress traffic with AzFW/NVA if your security requirements mandate it. Check [this link](https://learn.microsoft.com/azure/aks/limit-egress-traffic) for further information.\"\n                        },\n                        \"name\": \"querytext12\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query12\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"If using a public API endpoint, restrict the IP addresses that can access it. Check [this link](https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges) for further information.\"\n                        },\n                        \"name\": \"querytext13\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query13\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Use private clusters if your requirements mandate it. Check [this link](https://learn.microsoft.com/azure/aks/private-clusters) for further information.\"\n                        },\n                        \"name\": \"querytext14\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query14\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used . Check [this link](https://learn.microsoft.com/azure/aks/use-network-policies) for further information.\"\n                        },\n                        \"name\": \"querytext15\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query15\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Enable a Kubernetes Network Policy option (Calico/Azure). Check [this link](https://learn.microsoft.com/azure/aks/use-network-policies) for further information.\"\n                        },\n                        \"name\": \"querytext16\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query16\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Use DDoS Standard in the AKS Virtual Network. Check [this link](https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview) for further information.\"\n                        },\n                        \"name\": \"querytext17\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query17\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"If required add company HTTP Proxy. Check [this link](https://learn.microsoft.com/azure/aks/http-proxy) for further information.\"\n                        },\n                        \"name\": \"querytext18\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query18\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category2\"\n            },\n            \"name\": \"category2\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## BC and DR\"\n                        },\n                        \"name\": \"category3title\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Use Availability Zones if they are supported in your Azure region. Check [this link](https://learn.microsoft.com/azure/aks/availability-zones) for further information.\"\n                        },\n                        \"name\": \"querytext1\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"resources | where type=='microsoft.containerservice/managedclusters' | extend compliant= isnotnull(properties.agentPoolProfiles[0].availabilityZones) | distinct id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query1\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Use the SLA-backed AKS offering. Check [this link](https://learn.microsoft.com/azure/aks/uptime-sla) for further information.\"\n                        },\n                        \"name\": \"querytext2\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query2\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category3\"\n            },\n            \"name\": \"category3\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Governance and Security\"\n                        },\n                        \"name\": \"category4title\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Use Azure Policy for Kubernetes to ensure cluster compliance. Check [this link](https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes) for further information.\"\n                        },\n                        \"name\": \"querytext3\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query3\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Separate applications from the control plane with user/system nodepools. Check [this link](https://learn.microsoft.com/azure/aks/use-system-pools) for further information.\"\n                        },\n                        \"name\": \"querytext4\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query4\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category4\"\n            },\n            \"name\": \"category4\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Cost Governance\"\n                        },\n                        \"name\": \"category5title\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category5\"\n            },\n            \"name\": \"category5\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Operations\"\n                        },\n                        \"name\": \"category6title\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Use custom Node RG (aka 'Infra RG') name. Check [this link](https://learn.microsoft.com/azure/aks/cluster-configuration) for further information.\"\n                        },\n                        \"name\": \"querytext19\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query19\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Consider AKS virtual node for quick bursting. Check [this link](https://learn.microsoft.com/azure/aks/concepts-scale) for further information.\"\n                        },\n                        \"name\": \"querytext20\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query20\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch). Check [this link](https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview) for further information.\"\n                        },\n                        \"name\": \"querytext21\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query21\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Use the Cluster Autoscaler. Check [this link](https://learn.microsoft.com/azure/aks/concepts-scale) for further information.\"\n                        },\n                        \"name\": \"querytext22\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query22\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Customize node configuration for AKS node pools. Check [this link](https://learn.microsoft.com/azure/aks/custom-node-configuration) for further information.\"\n                        },\n                        \"name\": \"querytext23\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query23\"\n                    },\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"Use ephemeral OS disks. Check [this link](https://learn.microsoft.com/azure/aks/cluster-configuration) for further information.\"\n                        },\n                        \"name\": \"querytext24\"\n                    },\n                    {\n                        \"type\": 3,\n                        \"content\": {\n                            \"version\": \"KqlItem/1.0\",\n                            \"query\": \"where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant\",\n                            \"size\": 4,\n                            \"queryType\": 1,\n                            \"resourceType\": \"microsoft.resourcegraph/resources\",\n                            \"crossComponentResources\": [\n                                \"{Subscription}\"\n                            ],\n                            \"gridSettings\": {\n                                \"formatters\": [\n                                    {\n                                        \"columnMatch\": \"id\",\n                                        \"formatter\": 0,\n                                        \"numberFormat\": {\n                                            \"unit\": 0,\n                                            \"options\": {\n                                                \"style\": \"decimal\"\n                                            }\n                                        }\n                                    },\n                                    {\n                                        \"columnMatch\": \"compliant\",\n                                        \"formatter\": 18,\n                                        \"formatOptions\": {\n                                            \"thresholdsOptions\": \"icons\",\n                                            \"thresholdsGrid\": [\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"1\",\n                                                    \"representation\": \"success\",\n                                                    \"text\": \"Success\"\n                                                },\n                                                {\n                                                    \"operator\": \"==\",\n                                                    \"thresholdValue\": \"0\",\n                                                    \"representation\": \"failed\",\n                                                    \"text\": \"Failed\"\n                                                },\n                                                {\n                                                    \"operator\": \"Default\",\n                                                    \"thresholdValue\": null,\n                                                    \"representation\": \"unknown\",\n                                                    \"text\": \"Unknown\"\n                                                }\n                                            ]\n                                        }\n                                    }\n                                ]\n                            }\n                        },\n                        \"name\": \"query24\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category6\"\n            },\n            \"name\": \"category6\"\n        },\n        {\n            \"type\": 12,\n            \"content\": {\n                \"version\": \"NotebookGroup/1.0\",\n                \"groupType\": \"editable\",\n                \"items\": [\n                    {\n                        \"type\": 1,\n                        \"content\": {\n                            \"json\": \"## Application Deployment\"\n                        },\n                        \"name\": \"category7title\"\n                    }\n                ]\n            },\n            \"conditionalVisibility\": {\n                \"parameterName\": \"VisibleTab\",\n                \"comparison\": \"isEqualTo\",\n                \"value\": \"category7\"\n            },\n            \"name\": \"category7\"\n        }\n    ],\n    \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}",
                "version": "1.0",
                "sourceId": "[parameters('workbookSourceId')]",
                "category": "[parameters('workbookType')]"
            }
        }
    ],
    "outputs": {
        "workbookId": {
            "type": "string",
            "value": "[resourceId( 'Microsoft.Insights/workbooks', parameters('workbookId'))]"
        }
    }
}
workbooks/aks_checklist.en_workbook.json METASEP
{
    "version": "Notebook/1.0",
    "items": [
        {
            "type": 1,
            "content": {
                "json": "## Azure AKS Review\n---\n\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists)."
            },
            "name": "Header"
        },
        {
            "type": 9,
            "content": {
                "version": "KqlParameterItem/1.0",
                "parameters": [
                    {
                        "id": "497a107e-dde8-433e-b263-35ac8e8f7834",
                        "version": "KqlParameterItem/1.0",
                        "name": "Subscription",
                        "type": 6,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "typeSettings": {
                            "additionalResourceOptions": [
                                "value::all"
                            ],
                            "includeAll": true,
                            "showDefault": false
                        },
                        "timeContext": {
                            "durationMs": 86400000
                        },
                        "value": [
                            "value::all"
                        ]
                    }
                ],
                "style": "pills",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 5"
        },
        {
            "type": 11,
            "content": {
                "version": "LinkItem/1.0",
                "style": "tabs",
                "links": [
                    {
                        "id": "5cd1a0db-74d5-443c-bd49-ecbd10b0b471",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Identity and Access Management",
                        "subTarget": "category1",
                        "preText": "Identity and Access Management",
                        "style": "primary"
                    },
                    {
                        "id": "075d7db8-dff5-4e02-8260-2020dd5a3803",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Network Topology and Connectivity",
                        "subTarget": "category2",
                        "preText": "Network Topology and Connectivity",
                        "style": "primary"
                    },
                    {
                        "id": "232b5a99-60b2-43d4-8bc5-e32fbe0bd7ae",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "BC and DR",
                        "subTarget": "category3",
                        "preText": "BC and DR",
                        "style": "primary"
                    },
                    {
                        "id": "ffbbb20e-1974-45bc-bb70-b130d6fb44fb",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Governance and Security",
                        "subTarget": "category4",
                        "preText": "Governance and Security",
                        "style": "primary"
                    },
                    {
                        "id": "5324bfe1-e675-4209-8049-7b3be77bc5aa",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Cost Governance",
                        "subTarget": "category5",
                        "preText": "Cost Governance",
                        "style": "primary"
                    },
                    {
                        "id": "d181e2f9-5498-4806-bdea-4eda4b1e955f",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Operations",
                        "subTarget": "category6",
                        "preText": "Operations",
                        "style": "primary"
                    },
                    {
                        "id": "842c825a-468a-426d-8771-7ae18533ae0f",
                        "cellValue": "VisibleTab",
                        "linkTarget": "parameter",
                        "linkLabel": "Application Deployment",
                        "subTarget": "category7",
                        "preText": "Application Deployment",
                        "style": "primary"
                    }
                ]
            },
            "name": "links - 4"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Identity and Access Management"
                        },
                        "name": "category1title"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Use managed identities instead of Service Principals. Check [this link](https://learn.microsoft.com/azure/aks/use-managed-identity) for further information."
                        },
                        "name": "querytext5"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query5"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Integrate authentication with AAD (using the managed integration). Check [this link](https://learn.microsoft.com/azure/aks/managed-aad) for further information."
                        },
                        "name": "querytext6"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query6"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Disable AKS local accounts. Check [this link](https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts) for further information."
                        },
                        "name": "querytext7"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query7"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category1"
            },
            "name": "category1"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Network Topology and Connectivity"
                        },
                        "name": "category2title"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Do not use AKS Application Routing Add-On. Check [this link](https://learn.microsoft.com/azure/aks/http-application-routing) for further information."
                        },
                        "name": "querytext8"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query8"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "For Windows workloads use Accelerated Networking. Check [this link](https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview) for further information."
                        },
                        "name": "querytext9"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query9"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Use the standard ALB (as opposed to the basic one). Check [this link](https://learn.microsoft.com/azure/aks/load-balancer-standard) for further information."
                        },
                        "name": "querytext10"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query10"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Choose the best CNI network plugin for your requirements (Azure CNI recommended). Check [this link](https://learn.microsoft.com/azure/aks/operator-best-practices-network) for further information."
                        },
                        "name": "querytext11"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query11"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Filter egress traffic with AzFW/NVA if your security requirements mandate it. Check [this link](https://learn.microsoft.com/azure/aks/limit-egress-traffic) for further information."
                        },
                        "name": "querytext12"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query12"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "If using a public API endpoint, restrict the IP addresses that can access it. Check [this link](https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges) for further information."
                        },
                        "name": "querytext13"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query13"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Use private clusters if your requirements mandate it. Check [this link](https://learn.microsoft.com/azure/aks/private-clusters) for further information."
                        },
                        "name": "querytext14"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query14"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used . Check [this link](https://learn.microsoft.com/azure/aks/use-network-policies) for further information."
                        },
                        "name": "querytext15"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query15"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Enable a Kubernetes Network Policy option (Calico/Azure). Check [this link](https://learn.microsoft.com/azure/aks/use-network-policies) for further information."
                        },
                        "name": "querytext16"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query16"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Use DDoS Standard in the AKS Virtual Network. Check [this link](https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview) for further information."
                        },
                        "name": "querytext17"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query17"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "If required add company HTTP Proxy. Check [this link](https://learn.microsoft.com/azure/aks/http-proxy) for further information."
                        },
                        "name": "querytext18"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query18"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category2"
            },
            "name": "category2"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## BC and DR"
                        },
                        "name": "category3title"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Use Availability Zones if they are supported in your Azure region. Check [this link](https://learn.microsoft.com/azure/aks/availability-zones) for further information."
                        },
                        "name": "querytext1"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "resources | where type=='microsoft.containerservice/managedclusters' | extend compliant= isnotnull(properties.agentPoolProfiles[0].availabilityZones) | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query1"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Use the SLA-backed AKS offering. Check [this link](https://learn.microsoft.com/azure/aks/uptime-sla) for further information."
                        },
                        "name": "querytext2"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query2"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category3"
            },
            "name": "category3"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Governance and Security"
                        },
                        "name": "category4title"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Use Azure Policy for Kubernetes to ensure cluster compliance. Check [this link](https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes) for further information."
                        },
                        "name": "querytext3"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query3"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Separate applications from the control plane with user/system nodepools. Check [this link](https://learn.microsoft.com/azure/aks/use-system-pools) for further information."
                        },
                        "name": "querytext4"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query4"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category4"
            },
            "name": "category4"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Cost Governance"
                        },
                        "name": "category5title"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category5"
            },
            "name": "category5"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Operations"
                        },
                        "name": "category6title"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Use custom Node RG (aka 'Infra RG') name. Check [this link](https://learn.microsoft.com/azure/aks/cluster-configuration) for further information."
                        },
                        "name": "querytext19"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query19"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Consider AKS virtual node for quick bursting. Check [this link](https://learn.microsoft.com/azure/aks/concepts-scale) for further information."
                        },
                        "name": "querytext20"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query20"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch). Check [this link](https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview) for further information."
                        },
                        "name": "querytext21"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query21"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Use the Cluster Autoscaler. Check [this link](https://learn.microsoft.com/azure/aks/concepts-scale) for further information."
                        },
                        "name": "querytext22"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query22"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Customize node configuration for AKS node pools. Check [this link](https://learn.microsoft.com/azure/aks/custom-node-configuration) for further information."
                        },
                        "name": "querytext23"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query23"
                    },
                    {
                        "type": 1,
                        "content": {
                            "json": "Use ephemeral OS disks. Check [this link](https://learn.microsoft.com/azure/aks/cluster-configuration) for further information."
                        },
                        "name": "querytext24"
                    },
                    {
                        "type": 3,
                        "content": {
                            "version": "KqlItem/1.0",
                            "query": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
                            "size": 4,
                            "queryType": 1,
                            "resourceType": "microsoft.resourcegraph/resources",
                            "crossComponentResources": [
                                "{Subscription}"
                            ],
                            "gridSettings": {
                                "formatters": [
                                    {
                                        "columnMatch": "id",
                                        "formatter": 0,
                                        "numberFormat": {
                                            "unit": 0,
                                            "options": {
                                                "style": "decimal"
                                            }
                                        }
                                    },
                                    {
                                        "columnMatch": "compliant",
                                        "formatter": 18,
                                        "formatOptions": {
                                            "thresholdsOptions": "icons",
                                            "thresholdsGrid": [
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "1",
                                                    "representation": "success",
                                                    "text": "Success"
                                                },
                                                {
                                                    "operator": "==",
                                                    "thresholdValue": "0",
                                                    "representation": "failed",
                                                    "text": "Failed"
                                                },
                                                {
                                                    "operator": "Default",
                                                    "thresholdValue": null,
                                                    "representation": "unknown",
                                                    "text": "Unknown"
                                                }
                                            ]
                                        }
                                    }
                                ]
                            }
                        },
                        "name": "query24"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category6"
            },
            "name": "category6"
        },
        {
            "type": 12,
            "content": {
                "version": "NotebookGroup/1.0",
                "groupType": "editable",
                "items": [
                    {
                        "type": 1,
                        "content": {
                            "json": "## Application Deployment"
                        },
                        "name": "category7title"
                    }
                ]
            },
            "conditionalVisibility": {
                "parameterName": "VisibleTab",
                "comparison": "isEqualTo",
                "value": "category7"
            },
            "name": "category7"
        }
    ],
    "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}
workbooks/README.md METASEP
# Automatic workbook creation

The checklists in this repo have the option of documenting Azure Resource Graph queries along with each check, to dynamically verify whether the resources in your subsciption(s) are compliant with the checklist recommendations.

To quickly check these out you can import them via ARM into your Azure Monitor instances:

- Landing Zone review workbook:

[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Freview-checklists%2Fmain%2Fworkbooks%2Flz_checklist.en_workbook_template.json)

- Networking - Landing Zone review workbook:

[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Freview-checklists%2Fmain%2Fworkbooks%2Flz_checklist.en_network_workbook_template.json)

- AKS review workbook:

[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Freview-checklists%2Fmain%2Fworkbooks%2Faks_checklist.en_workbook_template.json)


The Github pipelines in this repo automatically generate Azure Monitor workbooks with those queries grouped in their corresponding categories, for easy consumption. In order to deploy these workbooks to your Azure Monitor instance, you can do a simple copy/paste operation from the corresponding JSON file (for example [lz_checklist.en_workbook.json](lz_checklist.en_workbook.json) or [aks_checklist.en_workbook.json](aks_checklist.en_workbook.json)), and copy them into the advanced editor mode of an Azure Monitor workbook. For example:

![advanced editor](./pictures/advanced_editor.png)

After doing this the queries will start running and you will see a list of the resources in your subscription that comply and not comply with each specific recommendation with documented Azure Resource Graph queries. For example, the following screenshot shows the BC/DR section of the AKS workbook:

![aks BCDR](./pictures/aks_bcdr.png)

Please do not send contributions to these workbooks, since they are generated dynamically out of the building blocks contained in the [blocks directory](./blocks/) and the Azure Resource Graph queries defined in the files contained in the [checklists directory](../checklists/).


web/README.md METASEP
# Prototype for web-based checklist

This is a Minimum Viable Product (MVP) for an architecture for web-based checklist reviews. It consists of the following elements:

**High Level Overview**  

![High Level Overview](../pictures/high_level_web_based_view.png)

- A MySQL database
- An Azure Container Instance that will launch 3 containers:
    - `filldb` (init container): creates the required database and tables in the MySQL server, and fills in the data imported from the latest checklist
    - `fillgraphdb` (init container): executes any Azure Resource Graph queries stored in the checklist, and stores the results in the MySQL database
    - `flask` (main container): a flask-based web frontend that allows inspecting the MysQL checklist table, as well as updating the status and comments of each individual checklist item

This screenshot shows the `flask` container web interface that can be used to frontend the MySQL database containing the review checklist items:

![Flask container screenshot](../pictures/flaskmysql_screenshot.png)

The `fillgraphdb` container needs to authenticate to Azure to send the Azure Resource Graph queries. There are two options:

- **Working today**: With Service Principal credentials
- **Roadmap**: With a [User-Managed Identity](https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview#how-can-i-use-managed-identities-for-azure-resources) with read access to the subscription(s). The `identityId` parameter of the ARM template needs to be provided. Initial tests have shown that the User-Managed Identity is not available in the init containers.

The [Azure CLI deployment script for Service Principals](./arm/deploy_sp.azcli) shows how to create the Service Principal, assign the reader role for the whole subscription, and launch the ARM template to create the MySQL server and the Azure Container Instance (it doesn't store the Service Principal secret in an Azure Key Vault, that would be highly advisable). If you already have the Service Principal, you can deploy the ARM template graphically as well using the button below:

[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Freview-checklists%2Fmain%2Fweb%2Farm%2Ftemplate.json)

The web interface will be available in the public IP address of the ACI container group, on TCP port 5000.

## Future improvements

Since this is only a prototype, there are some aspects not being addressed for the sake of simplicity:

- Figure out why the user-managed identities seem not be reachable from the init containers
- No HTTPS (it could be easily achieved with an nginx sidecar in the ACI container group)
- No authentication (an authentication proxy such as Ambassador could be leveraged for this)
- The network firewall of the MySQL server is fully open (it could be closed down to the ACI egress IP address)
- The UI of the flask container is rather rudimentary, but it shows the basic principles and does live updates to the MySQL database without having to press any "Submit" button
- SSL Enforcement is disabled in the MySQL Server due to `flask-mysql` not using encryption
- Decouple the containers, so that they can be launched independently:
    - It should be possible to launch the `fillgraphdb` container at any time, to refresh the Graph results
    - It should be possible to restart the `flask` container (web) without having the `filldb` container run as an init container wiping out the database

Contributions highly appreciated!

spreadsheet/review_checklist.xlsm METASEP

spreadsheet/Sheet1.cls METASEP
Option Explicit
Option Base 0
Private Declare PtrSafe Function URLDownloadToFile Lib "urlmon" Alias "URLDownloadToFileA" (ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCB As Long) As Long

'Constants
Const row1 = 10
Const technology_selection_row = 2
Const technology_selection_col = 5
Const language_selection_row = 2
Const language_selection_col = 6
Const checklist_name_row = 6
Const checklist_name_col = 1
Const line_break = vbCrLf
Const category_column = 1
Const subcategory_column = 2
Const text_column = 3
Const description_column = 4
Const severity_column = 5
Const status_column = 6
Const comments_column = 7
Const link_column = 8
Const training_column = 9
Const graph_column = 10
Const guid_column = 11
Const sec_mod_column = 12
Const cost_mod_column = 13
Const scale_mod_column = 14
Const simple_mod_column = 15
Const ha_mod_column = 16
Const num_columns = ha_mod_column
Const values_sheet = "values"
Const values_sev_column = 1
Const values_status_column = 2
Const values_status_description_column = 8
Const values_category_column = 3
Const values_technology_selection_column = 6
Const values_language_selection_column = 7
Const values_technology_prefix_column = 10
Const values_language_prefix_column = 11
Const row_limit = 2000   'Safety net
Const user_info_guid_index = 1
Const user_info_comments_index = 2
Const user_info_status_index = 3

'Global variables
Dim user_checks() As String     'To hold the user's comments/status
Dim selected_language As String
Dim selected_technology As String
Dim import_graph_queries As Boolean

'Modifies text so that it can be stored in JSON format
' * Removes line breaks (chr10 and chr13)
' * Replaces doublequotes with single quotes
' * Eliminates blanks (replaces with &nbsp)
Function correct_format_for_JSON(ByVal input_text As String) As String
    'Remove breaks
    input_text = Replace(Replace(input_text, Chr(10), ""), Chr(13), "")
    'Replace double quotes with single quotes
    input_text = Replace(input_text, Chr(34), Chr(39))
    'If it is a link, remove localization
    input_text = Replace(input_text, "en-us/", "")
    'Escape control characters such as "?"
    'input_text = escape_character(input_text, "?")
    input_text = escape_character(input_text, "\")
    input_text = escape_character(input_text, "\", False)   'Second escaping to turn '\' into '\\\\'
    'Avoid empty fields, the Azure translate API doesnt work well with then
    If input_text = "" Then input_text = "&nbsp"
    correct_format_for_JSON = input_text
End Function

'Escapes a character in a string, and gives out the resulting string
Function escape_character(ByVal input_text As String, search_char As String, Optional unescape_first As Boolean = True) As String
    'First we remove any possible escape signs for that character that might be already there
    If unescape_first Then
        input_text = Replace(input_text, "\" + search_char, search_char)
    End If
    'Now we escape all occurrences of the character
    input_text = Replace(input_text, search_char, "\" + search_char)
    'And return the output
    escape_character = input_text
End Function

'Exports current checklist from excel to a json-formated text file
Sub export_json()
    On Error GoTo errh
    ' Constants
    Const export_file_name = "checklist.json"
    Const values_sheet = "values"
    Const values_category_column = 3
    ' Variables
    Dim row As Integer
    Dim json As String
    Dim check_category As String, check_subcategory As String, check_text As String, check_description As String, check_severity As String, check_status As String, status_description As String, check_link As String, check_training As String, check_graph_query As String, check_guid As String
    Dim check_sec_mod, check_cost_mod, check_scale_mod, check_simple_mod, check_ha_mod
    Dim category_name As String, severity_name As String, status_name As String
    Dim export_file_path As Variant
    Dim double_quote As String
    Dim item_count As Integer, category_count As Integer, status_count As Integer
    ' Initialization
    double_quote = Chr(34) ' double quote as a variable
    row = row1
    json = "{" + line_break
    json = json + "  " + double_quote + "items" + double_quote + ": ["
    item_count = 0
    category_count = 0
    status_count = 0
    ' Loop through all rows as long as there is content
    Do While row < row_limit And Len(Cells(row, category_column)) > 0
        If row > row1 Then json = json + ","
        json = json + line_break
        check_category = Cells(row, category_column)
        check_subcategory = Cells(row, subcategory_column)
        check_text = Cells(row, text_column)
        check_description = Cells(row, description_column)
        check_severity = Cells(row, severity_column)
        check_graph_query = Cells(row, graph_column)
        check_guid = LCase(Cells(row, guid_column))
        check_sec_mod = Cells(row, sec_mod_column)
        check_cost_mod = Cells(row, cost_mod_column)
        check_scale_mod = Cells(row, scale_mod_column)
        check_simple_mod = Cells(row, simple_mod_column)
        check_ha_mod = Cells(row, ha_mod_column)
        'If there was no GUID, generate one
        If Len(check_guid) = 0 Then check_guid = generate_guid()
        'Only read More Info hyperlink if the cell contains one
        If Cells(row, link_column).Hyperlinks.Count > 0 Then
            'Anchors are not contained by the Address property, we need to concat the Subaddress too
            If Len(Cells(row, link_column).Hyperlinks(1).SubAddress) > 0 Then
                check_link = Cells(row, link_column).Hyperlinks(1).Address + "#" + Cells(row, link_column).Hyperlinks(1).SubAddress
            Else
                check_link = Cells(row, link_column).Hyperlinks(1).Address
            End If
        Else
            check_link = Cells(row, link_column)
        End If
        'Only read Training hyperlink if the cell contains one
        If Cells(row, training_column).Hyperlinks.Count > 0 Then
            check_training = Cells(row, training_column).Hyperlinks(1).Address
        Else
            check_training = Cells(row, training_column)
        End If
        row = row + 1
        json = json + "    {" + line_break
        json = json + "      " + double_quote + "category" + double_quote + ": " + double_quote + correct_format_for_JSON(check_category) + double_quote + ","
        json = json + line_break + "      " + double_quote + "subcategory" + double_quote + ": " + double_quote + correct_format_for_JSON(check_subcategory) + double_quote
        json = json + "," + line_break + "      " + double_quote + "text" + double_quote + ": " + double_quote + correct_format_for_JSON(check_text) + double_quote
        If Len(check_description) > 0 Then json = json + "," + line_break + "      " + double_quote + "description" + double_quote + ": " + double_quote + correct_format_for_JSON(check_description) + double_quote
        If Len(check_guid) > 0 Then json = json + "," + line_break + "      " + double_quote + "guid" + double_quote + ": " + double_quote + check_guid + double_quote
        If Len(check_sec_mod) > 0 And IsNumeric(check_sec_mod) Then json = json + "," + line_break + "      " + double_quote + "security" + double_quote + ": " + CStr(check_sec_mod)
        If Len(check_cost_mod) > 0 And IsNumeric(check_cost_mod) Then json = json + "," + line_break + "      " + double_quote + "cost" + double_quote + ": " + CStr(check_cost_mod)
        If Len(check_scale_mod) > 0 And IsNumeric(check_scale_mod) Then json = json + "," + line_break + "      " + double_quote + "scale" + double_quote + ": " + CStr(check_scale_mod)
        If Len(check_simple_mod) > 0 And IsNumeric(check_simple_mod) Then json = json + "," + line_break + "      " + double_quote + "simple" + double_quote + ": " + CStr(check_simple_mod)
        If Len(check_ha_mod) > 0 And IsNumeric(check_ha_mod) Then json = json + "," + line_break + "      " + double_quote + "ha" + double_quote + ": " + CStr(check_ha_mod)
        If Len(check_severity) > 0 Then json = json + "," + line_break + "      " + double_quote + "severity" + double_quote + ": " + double_quote + check_severity + double_quote
        If Len(check_graph_query) > 0 Then json = json + "," + line_break + "      " + double_quote + "graph" + double_quote + ": " + double_quote + correct_format_for_JSON(check_graph_query) + double_quote
        If Len(check_training) > 0 Then json = json + "," + line_break + "      " + double_quote + "training" + double_quote + ": " + double_quote + correct_format_for_JSON(check_training) + double_quote
        If Len(check_link) > 0 Then json = json + "," + line_break + "      " + double_quote + "link" + double_quote + ": " + double_quote + correct_format_for_JSON(check_link) + double_quote
        json = json + line_break + "    }"
        item_count = item_count + 1
    Loop
    ' Finish items section
    json = json + line_break + "  ]," + line_break
    ' Create categories section
    json = json + "  " + double_quote + "categories" + double_quote + ": ["
    row = 2
    Do While row < row_limit And Len(Sheets(values_sheet).Cells(row, values_category_column)) > 0
        If row > 2 Then json = json + ","
        json = json + line_break
        category_name = Sheets(values_sheet).Cells(row, values_category_column)
        json = json + "    {" + line_break
        json = json + "      " + double_quote + "name" + double_quote + ": " + double_quote + correct_format_for_JSON(category_name) + double_quote + line_break
        json = json + "    }"
        row = row + 1
        category_count = category_count + 1
    Loop
    ' Finish category section
    json = json + line_break + "  ]," + line_break
    ' Create status section
    json = json + "  " + double_quote + "status" + double_quote + ": ["
    row = 2
    Do While row < row_limit And Len(Sheets(values_sheet).Cells(row, values_status_column)) > 0
        If row > 2 Then json = json + ","
        json = json + line_break
        status_name = Sheets(values_sheet).Cells(row, values_status_column)
        status_description = Sheets(values_sheet).Cells(row, values_status_description_column)
        json = json + "    {" + line_break
        json = json + "      " + double_quote + "name" + double_quote + ": " + double_quote + correct_format_for_JSON(status_name) + double_quote + "," + line_break
        json = json + "      " + double_quote + "description" + double_quote + ": " + double_quote + correct_format_for_JSON(status_description) + double_quote + line_break
        json = json + "    }"
        row = row + 1
        status_count = status_count + 1
    Loop
    ' Finish status section
    json = json + line_break + "  ]," + line_break
    ' Create severities section
    json = json + "  " + double_quote + "severities" + double_quote + ": ["
    row = 2
    Do While row < row_limit And Len(Sheets(values_sheet).Cells(row, values_sev_column)) > 0
        If row > 2 Then json = json + ","
        json = json + line_break
        severity_name = Sheets(values_sheet).Cells(row, values_sev_column)
        json = json + "    {" + line_break
        json = json + "      " + double_quote + "name" + double_quote + ": " + double_quote + correct_format_for_JSON(severity_name) + double_quote + line_break
        json = json + "    }"
        row = row + 1
    Loop
    ' Finish severities section
    json = json + line_break + "  ]," + line_break
    ' Create metadata section
    json = json + "  " + double_quote + "metadata" + double_quote + ": {" + line_break
    json = json + "    " + double_quote + "name" + double_quote + ": " + double_quote + correct_format_for_JSON(Cells(checklist_name_row, checklist_name_col)) + double_quote + line_break
    ' Finish metadata section
    json = json + "  }" + line_break
    ' Finish JSON
    json = json + "}" + line_break
    ' Write JSON to file
    ' MsgBox json
    'export_file_path = ActiveWorkbook.Path + "\" + export_file_name
    export_file_path = ""
    export_file_path = Application.GetSaveAsFilename(FileFilter:="JSON File (*.json), *.json", Title:="Exporting JSON checklist", InitialFileName:=ActiveWorkbook.Path + "\" + export_file_name)
    'checks to make sure the user hasn't canceled the dialog
    If export_file_path <> False Then
        'MsgBox "Exporting to " + export_file_path
        Open export_file_path For Output As #1
        Print #1, json
        Close #1
    End If
    MsgBox CStr(item_count) + " checklist items and " + CStr(category_count) + " categories exported to JSON file " + export_file_path, vbInformation
    Exit Sub
errh:
    If Err.Number <> 0 Then
        MsgBox "Error while exporting checklist to JSON " & Err.Description, vbCritical
    End If
End Sub

'Import JSON from URL (first download to a local file)
Sub import_checklist_fromurl()
    Const values_sheet = "values"
    Const values_url_column = 4
    Dim checklist_url, checklist_base_url As String
    Dim json_file As Variant
    Dim buf, ret As Long
    Dim url_split() As String
    Dim filename As String
    Dim objXmlHttpReq As Object
    Dim objStream As Object
    Dim msg As String
    'Get URL stored in the Values sheet
    checklist_base_url = Sheets(values_sheet).Cells(2, values_url_column)
    If Len(checklist_base_url) > 0 Then
        'Look at the option buttons to set global variables that control technology (LZ, AKS, AVD, AVS, Security) and language
        set_checklist_variables
        'Append the technology and options variables (default to English and LZ)
        If Len(selected_technology) = 0 Then selected_technology = "lz"
        If Len(selected_language) = 0 Then selected_language = "en"
        checklist_url = checklist_base_url + selected_technology + "_checklist." + selected_language + ".json"
        'Get the filename of the URL
        url_split = Split(checklist_url, "/")
        filename = url_split(UBound(url_split))
        ' Instead of letting the user specify a download directory, picking up Downloads per default
        'ChDir ActiveWorkbook.Path
        'json_file = Application.GetOpenFilename(Title:="Please choose a file to open", FileFilter:="JSON Files *.json* (*.json),")
        json_file = Environ("USERPROFILE") + "\Downloads\checklist.json"
        msg = "Reference checklist will be downloaded from '" + checklist_url + "' to '" + CStr(json_file) + "'"
        If MsgBox(msg, vbOKCancel + vbQuestion, "Downloading reference checklist") = vbOK Then
            ret = URLDownloadToFile(0, checklist_url, json_file, 0, 0)
            If ret = 0 Then
                'Call the sub for actually doing the import
                import_checklist_fromfile json_file
            Else
                MsgBox "Checklist could not be downloaded from '" + checklist_url + "'", vbCritical
            End If
        End If
    Else
        MsgBox "Sorry, I could not found out the reference URL in sheet '" + values_sheet + "' at cell location 2," + CStr(values_url_column), vbCritical
    End If
End Sub

'Import from custom JSON file
Sub import_checklist()
    On Error GoTo import_checklist_err
    Dim json_file As Variant
    ChDir ActiveWorkbook.Path
    json_file = Application.GetOpenFilename(Title:="Please choose a file to open", FileFilter:="JSON Files *.json* (*.json),")
    If json_file = False Then
        MsgBox "No file selected.", vbExclamation, "Action canceled"
        Exit Sub
    Else
        import_graph_queries = True 'Always import graph queries in advanced mode.
        import_checklist_fromfile json_file
    End If
import_checklist_err:
    If Err.Number = 76 Then   'path not found, this happens usually if the spreadsheet is in onedrive
        Resume Next
    ElseIf Err.Number <> 0 Then
        MsgBox "Error while importing checklist from custom file: " & CStr(Err.Number) & ": " & Err.Description, vbCritical
    End If
    Exit Sub
End Sub


'Import from a local JSON file
'Parse JSON code using the JsonConverter module
Sub import_checklist_fromfile(json_file As Variant)
    On Error GoTo import_checklist_fromfile_err
    ' Constants
    Const row_limit = 2000   'Safety net
    'Variables
    Dim json_ts As TextStream
    Dim FSO As New FileSystemObject
    Dim textline As String
    Dim json As String
    Dim json_object, json_item As Object
    Dim double_quote As String
    Dim line_elements() As String
    Dim row, item_count, category_count, status_count, i As Integer
    Dim notverified As String
    Dim get_user_info_successful As Boolean
    Dim start_time As Double
    'Remember time when macro starts
    start_time = Timer
    'Disable some stuff to speed up
    Call DisableStuff
    'Variable value initialization
    row = row1
    double_quote = Chr(34) ' double quote as a variable
    json = ""
    item_count = 0
    category_count = 0
    status_count = 0
    'First of all, get the info entered by the user in a global variable
    get_user_info_successful = get_user_input()
    'Go through the file line by line
    Dim objStream
    Set objStream = CreateObject("ADODB.Stream")
    objStream.Charset = "utf-8"
    objStream.Open
    objStream.LoadFromFile (json_file)
    json = objStream.ReadText()
    
    objStream.Close
    Set objStream = Nothing

    json = Replace(json, vbCrLf, "")
    Set json_object = JsonConverter.ParseJson(json)  'This line might give Run-time error 10001 if there are JSON syntactic errors
    'Update checklist title
    If json_object.Exists("metadata") Then
        If json_object("metadata").Exists("name") Then
            Cells(checklist_name_row, checklist_name_col) = json_object("metadata")("name")
        End If
    End If
    'Import status
    If json_object.Exists("status") Then
        row = 2
        If TypeName(json_object("status")) = "Dictionary" Then
            notverified = json_object("status")("0")("name") ' The "Not Verified" status is the first one
            i = 0
            Do
                Sheets(values_sheet).Cells(row, values_status_column) = json_object("status")(CStr(i))("name")
                If json_object("status")(CStr(i)).Exists("description") Then
                    Sheets(values_sheet).Cells(row, values_status_description_column) = json_object("status")(CStr(i))("description")
                End If
                row = row + 1
                status_count = status_count + 1
                i = i + 1
            Loop While json_object("status").Exists(CStr(i))
        Else
            notverified = json_object("status")(1)("name") ' The "Not Verified" status is the first one
            For Each json_item In json_object("status")
                Sheets(values_sheet).Cells(row, values_status_column) = json_item("name")
                If json_item.Exists("description") Then
                    Sheets(values_sheet).Cells(row, values_status_description_column) = json_item("description")
                End If
                row = row + 1
                status_count = status_count + 1
            Next json_item
        End If
        'Blank the rest of the status rows, although for status this shouldnt be required
        Do While row < row_limit And Len(Cells(row, values_status_column)) > 0
            Sheets(values_sheet).Cells(row, values_status_column) = ""
            row = row + 1
        Loop
    End If
    'Import checklist items
    row = row1
    'If JSON is a translated file, it is a nested dictionary with keys "0", "1", etc
    If TypeName(json_object("items")) = "Dictionary" Then
        i = 0
        Do
            update_row json_object("items")(CStr(i)), row, notverified, get_user_info_successful
            row = row + 1
            item_count = item_count + 1
            i = i + 1
        Loop While json_object("items").Exists(CStr(i))
    'Otherwise, it is just an array
    Else
        For Each json_item In json_object("items")
            update_row json_item, row, notverified, get_user_info_successful
            row = row + 1
            item_count = item_count + 1
        Next json_item
    End If
    'Blank the rest of the item rows
    Do While row < row_limit And (Len(Cells(row, category_column)) + Len(Cells(row, subcategory_column)) + Len(Cells(row, text_column)) + Len(Cells(row, status_column)) + Len(Cells(row, comments_column))) > 0
        Cells(row, category_column) = ""
        Cells(row, subcategory_column) = ""
        Cells(row, text_column) = ""
        Cells(row, description_column) = ""
        Cells(row, severity_column) = ""
        Cells(row, link_column) = ""
        Cells(row, status_column) = ""
        Cells(row, comments_column) = ""
        Cells(row, training_column) = ""
        Cells(row, graph_column) = ""
        Cells(row, guid_column) = ""
        row = row + 1
    Loop
    'Import categories
    If json_object.Exists("categories") Then
        row = 2
        If TypeName(json_object("categories")) = "Dictionary" Then
            i = 0
            Do
                Sheets(values_sheet).Cells(row, values_category_column) = json_object("categories")(CStr(i))("name")
                row = row + 1
                category_count = category_count + 1
                i = i + 1
            Loop While json_object("categories").Exists(CStr(i))
        Else
            For Each json_item In json_object("categories")
                Sheets(values_sheet).Cells(row, values_category_column) = json_item("name")
                row = row + 1
                category_count = category_count + 1
            Next json_item
        End If
        'Blank the rest of the category rows
        Do While row < row_limit And Len(Cells(row, values_category_column)) > 0
            Sheets(values_sheet).Cells(row, values_category_column) = ""
            row = row + 1
        Loop
    End If
    'Import severities
    If json_object.Exists("severities") Then
        row = 2
        If TypeName(json_object("severities")) = "Dictionary" Then
            i = 0
            Do
                Sheets(values_sheet).Cells(row, values_sev_column) = json_object("severities")(CStr(i))("name")
                row = row + 1
                i = i + 1
            Loop While json_object("severities").Exists(CStr(i))
        Else
            For Each json_item In json_object("severities")
                Sheets(values_sheet).Cells(row, values_sev_column) = json_item("name")
                row = row + 1
            Next json_item
        End If
        'Blank the rest of the severity rows
        Do While row < row_limit And Len(Cells(row, values_sev_column)) > 0
            Sheets(values_sheet).Cells(row, values_sev_column) = ""
            row = row + 1
        Loop
    End If
    MsgBox CStr(item_count) + " check items and " + CStr(category_count) + " categories imported from JSON file " + json_file + " in " + CStr(Round(Timer - start_time, 2)) + " seconds", vbInformation
    Call EnableStuff
    Exit Sub
import_checklist_fromfile_err:
    If Err.Number <> 0 Then
        MsgBox "Error while importing checklist from JSON file " & json_file & ": " & Err.Description, vbCritical
        Call EnableStuff
    End If
End Sub

'Function with error control in case a property does not exist for an object
Function get_object_property(ByVal object_item As Object, property_name As String) As String
    On Error GoTo get_object_property_err
    Dim aux As String
    aux = object_item(property_name)
    'If it is "&nbsp" or something similar (some translation engines introduce blanks between "&" and "nbsp"), set to null
    If Right(aux, 4) = "nbsp" Then aux = ""
    get_object_property = aux
    Exit Function
get_object_property_err:
    get_object_property = ""
    Exit Function
End Function

' Updates a checklist row with the information in the object
Sub update_row(ByVal json_item As Object, ByVal row As Integer, notverified As String, user_input_saved As Boolean)
On Error GoTo update_row_err
    ' Variables and constants
    Dim check_category As String, check_subcategory As String, check_text As String, check_description As String, check_severity As String, check_status As String, check_link As String, check_training As String, check_graph_query As String, check_guid As String
    Dim user_input_comments As String, user_input_status As String
    Dim check_sec_mod, check_cost_mod, check_scale_mod, check_simple_mod, check_ha_mod
    Dim get_guid_user_input_successful As Boolean
    Dim newrow(1 To num_columns) As Variant
    ' Defaults to English "Not Verified"
    If Len(notverified) = 0 Then notverified = "Not verified"
    ' Code
    check_category = get_object_property(json_item, "category")
    check_subcategory = get_object_property(json_item, "subcategory")
    check_text = get_object_property(json_item, "text")
    check_description = get_object_property(json_item, "description")
    check_severity = get_object_property(json_item, "severity")
    check_link = get_object_property(json_item, "link")
    check_training = get_object_property(json_item, "training")
    check_graph_query = get_object_property(json_item, "graph")
    If Len(check_graph_query) = 0 Then check_graph_query = get_object_property(json_item, "graph_success")  'Backwards compatibility
    check_guid = get_object_property(json_item, "guid")
    check_sec_mod = get_object_property(json_item, "security")
    check_cost_mod = get_object_property(json_item, "cost")
    check_scale_mod = get_object_property(json_item, "scale")
    check_simple_mod = get_object_property(json_item, "simple")
    check_ha_mod = get_object_property(json_item, "ha")
    'Cells(row, category_column) = check_category
    'Cells(row, subcategory_column) = check_subcategory
    'Cells(row, text_column) = check_text
    'Cells(row, description_column) = check_description
    'Cells(row, severity_column) = check_severity
    'Cells(row, guid_column) = check_guid
    newrow(category_column) = check_category
    newrow(subcategory_column) = check_subcategory
    newrow(text_column) = check_text
    newrow(description_column) = check_description
    newrow(severity_column) = check_severity
    newrow(guid_column) = check_guid
    'If the previous user input was saved, and we can successfully retrieve an entry for this guid, put it in the comments/status fields
    If user_input_saved Then
        If get_user_input_from_guid(check_guid, user_input_comments, user_input_status) Then
            'Cells(row, status_column) = CStr(user_input_status)     'Some times around this line there is a dreadful 400 error :(
            'Cells(row, comments_column) = CStr(user_input_comments)
            newrow(status_column) = CStr(user_input_status)     'Some times around this line there is a dreadful 400 error :(
            newrow(comments_column) = CStr(user_input_comments)
        Else
            'Cells(row, status_column) = notverified '"notverified" is a variable containing the translation of "not verified"
            'Cells(row, comments_column) = ""
            newrow(status_column) = notverified '"notverified" is a variable containing the translation of "not verified"
            newrow(comments_column) = ""
        End If
    'Otherwise, blank them
    Else
        'Cells(row, status_column) = notverified '"notverified" is a variable containing the translation of "not verified"
        'Cells(row, comments_column) = ""
        newrow(status_column) = notverified '"notverified" is a variable containing the translation of "not verified"
        newrow(comments_column) = ""
    End If
    'Graph queries can optionally be imported or not, since it impacts readability
    'Per default, they are only imported when using the English language
    If import_graph_queries Then
        'Cells(row, graph_success_column) = check_graph_success
        'Cells(row, graph_failure_column) = check_graph_failure
        newrow(graph_column) = check_graph_query
    Else
        'Cells(row, graph_success_column) = ""
        'Cells(row, graph_failure_column) = ""
        newrow(graph_column) = ""
    End If
    'Design modifiers are optional too
    If IsNumeric(check_sec_mod) Then
        'Cells(row, sec_mod_column) = check_sec_mod
        newrow(sec_mod_column) = check_sec_mod
    End If
    If IsNumeric(check_cost_mod) Then
        'Cells(row, cost_mod_column) = check_cost_mod
        newrow(cost_mod_column) = check_cost_mod
    End If
    If IsNumeric(check_scale_mod) Then
        'Cells(row, scale_mod_column) = check_scale_mod
        newrow(scale_mod_column) = check_scale_mod
    End If
    If IsNumeric(check_simple_mod) Then
        'Cells(row, simple_mod_column) = check_simple_mod
        newrow(simple_mod_column) = check_simple_mod
    End If
    If IsNumeric(check_ha_mod) Then
        'Cells(row, ha_mod_column) = check_ha_mod
        newrow(ha_mod_column) = check_ha_mod
    End If
    'Update Excel row
    Range(Cells(row, 1), Cells(row, num_columns)).Value = newrow
    'Training and MoreInfo link optional
    If Len(check_link) > 0 Then
        Cells(row, link_column).Hyperlinks.Add Address:=check_link, TextToDisplay:="More info", Anchor:=Cells(row, link_column), ScreenTip:=check_link
    Else
        Cells(row, link_column) = ""
    End If
    If Len(check_training) > 0 Then
        Cells(row, training_column).Hyperlinks.Add Address:=check_training, TextToDisplay:="Training", Anchor:=Cells(row, training_column), ScreenTip:=check_training
    Else
        Cells(row, training_column) = ""
    End If
    Exit Sub
update_row_err:
    If Err.Number <> 0 Then
        MsgBox "Error while updating row: " & Err.Description, vbCritical
    End If
End Sub

'Generates a random GUID
'https://danwagner.co/how-to-generate-a-guid-in-excel-with-vba/
Function generate_guid() As String
On Error GoTo genguiderr
    Dim k, h As Variant
    generate_guid = Space(36)
    For k = 1 To Len(generate_guid)
        Randomize
        Select Case k
            Case 9, 14, 19, 24: h = "-"
            Case 15:            h = "4"
            Case 20:            h = Hex(Rnd * 3 + 8)
            Case Else:          h = Hex(Rnd * 15)
        End Select
        Mid$(generate_guid, k, 1) = h
    Next
    generate_guid = LCase$(generate_guid)
genguiderr:
    If Err.Number <> 0 Then
        MsgBox "Error while generating GUID: " & Err.Description, vbCritical
    End If
End Function

'Import Azure Resource Graph query results from a JSON file generated with checklist_graph.sh
Sub import_graph_results()
On Error GoTo import_graph_results_err
    Dim json_file As Variant
    Dim objStream
    Dim json As String
    Dim json_object, json_item As Object
    Dim check_guid As String, check_success_result As String, check_failure_result As String, check_result As String, check_arm_id As String
    Dim row As Integer
    Dim query_result_format As String, query_result_date As String
    'File pick dialog
    ChDir ActiveWorkbook.Path
    json_file = Application.GetOpenFilename(Title:="Please choose a file to open", FileFilter:="JSON Files *.json* (*.json),")
    If json_file = False Then
        MsgBox "No file selected.", vbExclamation, "Action canceled"
        Exit Sub
    Else
        If MsgBox("This action will potentially overwrite existing contents in the Comments column. Do you want to continue?", vbQuestion + vbYesNo) = vbYes Then
            'Open and read text file
            Set objStream = CreateObject("ADODB.Stream")
            objStream.Charset = "utf-8"
            objStream.Open
            objStream.LoadFromFile (json_file)
            json = objStream.ReadText()
            objStream.Close
            Set objStream = Nothing
            'Remove line breaks and parse
            json = Replace(json, vbCrLf, "")
            Set json_object = JsonConverter.ParseJson(json)  'This line might give Run-time error 10001 if there are JSON syntax errors
            'Browse the checks one per one
            If json_object.Exists("checks") Then
                For Each json_item In json_object("checks")
                    'Get the check info
                    check_guid = get_object_property(json_item, "guid")
                    check_result = get_object_property(json_item, "compliant")
                    check_arm_id = get_object_property(json_item, "id")
                    'Now find the row with a matching GUID, and populate the comments field
                    row = row1
                    Do Until Cells(row, guid_column) = check_guid Or Cells(row, text_column) = ""
                        row = row + 1
                    Loop
                    'And update the comments column if it was found
                    If Cells(row, text_column) = "" Then
                       MsgBox "GUID " & check_guid & " not found in this checklist.", vbExclamation
                    Else
                        'Enter a line break if the cell wasnt empty
                        If Len(Cells(row, comments_column)) > 0 Then Cells(row, comments_column) = Cells(row, comments_column) & Chr(10)
                        'Depending on the test result, add 'compliant' or 'non-compliant'
                        If check_result = "true" Then
                            Cells(row, comments_column) = Cells(row, comments_column) & "Compliant: " + check_arm_id
                        ElseIf check_result = "false" Then
                            Cells(row, comments_column) = Cells(row, comments_column) & "Non-compliant: " + check_arm_id
                        Else
                            MsgBox "Check result " & check_result & " not understood", vbExclamation
                        End If
                    End If
                Next json_item
            Else
                MsgBox "It looks like the JSON file " & json_file & " does not contain a 'checks' object?", vbCritical
            End If
        End If
    
    End If
    Exit Sub
import_graph_results_err:
    If Err.Number = 10001 Then
        MsgBox "Error while importing graph results: please verify that the file " & json_file & " has a valid JSON format", vbCritical
    ElseIf Err.Number = 76 Then   'path not found, this happens usually if the spreadsheet is in onedrive
        Resume Next
    ElseIf Err.Number <> 0 Then
        MsgBox "Error while importing graph results: " & CStr(Err.Number) & ": " & Err.Description, vbCritical
    End If
    Exit Sub
End Sub

'Delete all from controls, so that the spreadsheet can be saved as macro-free
Sub clear_rows()
    Dim row As Integer
    Dim emptyrow() As Variant
    row = row1
    emptyrow = Array("", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "")
    Do While row < row_limit And (Len(Cells(row, category_column)) + Len(Cells(row, subcategory_column)) + Len(Cells(row, text_column)) + Len(Cells(row, status_column)) + Len(Cells(row, comments_column))) > 0
        'Cells(row, category_column) = ""
        'Cells(row, subcategory_column) = ""
        'Cells(row, text_column) = ""
        'Cells(row, description_column) = ""
        'Cells(row, severity_column) = ""
        'Cells(row, link_column) = ""
        'Cells(row, status_column) = ""
        'Cells(row, comments_column) = ""
        'Cells(row, training_column) = ""
        'Cells(row, graph_success_column) = ""
        'Cells(row, graph_failure_column) = ""
        'Cells(row, guid_column) = ""
        'Cells(row, sec_mod_column) = ""
        'Cells(row, cost_mod_column) = ""
        'Cells(row, scale_mod_column) = ""
        'Cells(row, simple_mod_column) = ""
        'Cells(row, ha_mod_column) = ""
        Range(Cells(row, 1), Cells(row, num_columns)).Value = emptyrow
        row = row + 1
    Loop
    'Reset checklist title
    Cells(checklist_name_row, checklist_name_col) = Sheets(values_sheet).Cells(2, 5)
    'Defaults to LZ and English
    Cells(technology_selection_row, technology_selection_col) = Sheets(values_sheet).Cells(2, values_technology_selection_column)
    Cells(language_selection_row, language_selection_col) = Sheets(values_sheet).Cells(2, values_language_selection_column)
End Sub

'Clear all rows
Sub delete_controls()
    Dim item As Object
    'Browse all shapes
    For Each item In ActiveSheet.Shapes
        'Only Form Controls
        If item.Type = msoFormControl Then
            item.Delete
        End If
    Next item
End Sub

'Inspect option buttons and set global variables accordingly
Sub set_checklist_variables()
On Error GoTo set_checklist_variables_err
Dim tech_found As Boolean, lang_found As Boolean
Dim row As Integer

    'Initialization
    tech_found = False
    lang_found = False
    
    'Find the prefix for the given technology
    row = 2
    Do While row < row_limit And Len(Sheets(values_sheet).Cells(row, values_technology_selection_column)) > 0
        If Sheets(values_sheet).Cells(row, values_technology_selection_column) = Cells(technology_selection_row, technology_selection_col) Then
            tech_found = True
            selected_technology = Sheets(values_sheet).Cells(row, values_technology_prefix_column)
            Exit Do
        End If
        row = row + 1
    Loop
            
    'Find the prefix for the given language
    row = 2
    Do While row < row_limit And Len(Sheets(values_sheet).Cells(row, values_language_selection_column)) > 0
        If Sheets(values_sheet).Cells(row, values_language_selection_column) = Cells(language_selection_row, language_selection_col) Then
            lang_found = True
            selected_language = Sheets(values_sheet).Cells(row, values_language_prefix_column)
            Exit Do
        End If
        row = row + 1
    Loop
            
    
'    'Look at the technology cell
'    Select Case Cells(technology_selection_row, technology_selection_col)
'        Case Sheets(values_sheet).Cells(2, values_technology_selection_column)
'            selected_technology = "lz"
'        Case Sheets(values_sheet).Cells(3, values_technology_selection_column)
'            selected_technology = "aks"
'        Case Sheets(values_sheet).Cells(4, values_technology_selection_column)
'            selected_technology = "avd"
'        Case Sheets(values_sheet).Cells(5, values_technology_selection_column)
'            selected_technology = "avs"
'        Case Sheets(values_sheet).Cells(6, values_technology_selection_column)
'            selected_technology = "security"
'        Case Else
'            MsgBox "Technology option " & Cells(technology_selection_row, technology_selection_col) & " unknown, defaulting to Landing Zone review", vbCritical
'            selected_technology = "lz"
'    End Select
    
'    'Look at the language cell
'    Select Case Cells(language_selection_row, language_selection_col)
'        Case Sheets(values_sheet).Cells(2, values_language_selection_column)
'            selected_language = "en"
'            import_graph_queries = True
'        Case Sheets(values_sheet).Cells(3, values_language_selection_column)
'            selected_language = "ja"
'            import_graph_queries = False
'        Case Sheets(values_sheet).Cells(4, values_language_selection_column)
'            selected_language = "ko"
'            import_graph_queries = False
'        Case Sheets(values_sheet).Cells(5, values_language_selection_column)
'            selected_language = "pt"
'            import_graph_queries = False
'        Case Sheets(values_sheet).Cells(6, values_language_selection_column)
'            selected_language = "es"
'            import_graph_queries = False
'        Case Else
'            MsgBox "Language option " & Cells(language_selection_row, language_selection_col) & " unknown, defaulting to English", vbCritical
'            selected_language = "en"
'            import_graph_queries = True
'    End Select

    'Import Azure Resource Graph queries only if the language is English (otherwise the translated queries are imported)
    'If Cells(language_selection_row, language_selection_col) = "English" Then
    '    import_graph_queries = True
    'Else
    '    MsgBox "Azure Resource Graph queries will not be imported, since the selected language is not English", vbInformation + vbOKOnly
    'End If
    
    'After translation has been fixed, we can now import the Graph queries safely :)
    import_graph_queries = True
    
    'Error message if tech or lang could not be found
    If Not tech_found Then
        MsgBox "Not able to resolve technology '" + Cells(technology_selection_row, technology_selection_col) + "' to a file prefix", vbCritical
    End If
    If Not lang_found Then
        MsgBox "Not able to resolve language '" + Cells(language_selection_row, language_selection_col) + "' to a file prefix", vbCritical
    End If
        
    'Debug.Print "Selected technology " + selected_technology + ", selected language " + selected_language
    Exit Sub
set_checklist_variables_err:
    MsgBox "Error while reading checklist selection options, defaulting to Landing Zone and English: " & CStr(Err.Number) & ": " & Err.Description, vbCritical
    selected_technology = "lz"
    selected_language = "en"
    import_graph_queries = True
End Sub

'Load in an object variable the existing values
Function get_user_input() As Boolean
On Error GoTo get_user_input_err
    Dim row, checks_counter As Integer
    row = row1
    ReDim user_checks(3, 1) As String
    Erase user_checks
    checks_counter = 0
    'Browse through all rows
    Do While row < row_limit And Len(Cells(row, category_column)) > 0
        'Only store a check if there is a non-blank comment or status is different than "Not Verified"
        If Len(Cells(row, comments_column)) > 0 Or Cells(row, status_column) <> Sheets(values_sheet).Cells(2, values_status_column) Then
            checks_counter = checks_counter + 1
            ReDim Preserve user_checks(3, checks_counter) As String
            user_checks(user_info_guid_index, checks_counter) = Cells(row, guid_column)
            user_checks(user_info_comments_index, checks_counter) = Cells(row, comments_column)
            user_checks(user_info_status_index, checks_counter) = Cells(row, status_column)
        End If
        row = row + 1
    Loop
    get_user_input = True
    Exit Function
get_user_input_err:
    If Err.Number <> 0 Then
        MsgBox "Error while reading existing comments: " & Err.Description, vbCritical
    End If
    get_user_input = False
    Exit Function
End Function

'Return the comments a status for a certain guid in an bidimensional array generated by get_user_input
Function get_user_input_from_guid(guid As String, ByRef comments As String, ByRef status As String) As Boolean
On Error GoTo get_user_input_from_guid_err
    Dim i As Integer
    comments = ""
    status = ""
    For i = 1 To UBound(user_checks(), 2)
        If LCase(user_checks(user_info_guid_index, i)) = LCase(guid) Then
            comments = user_checks(user_info_comments_index, i)
            status = user_checks(user_info_status_index, i)
            get_user_input_from_guid = True
            Exit Function
        End If
    Next i
    get_user_input_from_guid = False
    Exit Function
get_user_input_from_guid_err:
    If Err.Number = 9 Then      'Subscript out of range: silently exit
        get_user_input_from_guid = False
        Exit Function
    ElseIf Err.Number <> 0 Then
        Debug.Print "Error while retrieving comments/status for GUID " + guid + " - " & CStr(Err.Number) & ": " & Err.Description, vbCritical
    End If
    get_user_input_from_guid = False
    Exit Function
End Function

'Disable some settings to speed up code
Sub DisableStuff()
    Application.Calculation = xlCalculationManual
    Application.ScreenUpdating = False
End Sub

'Enable settings back to normal
Sub EnableStuff()
    Application.Calculation = xlCalculationAutomatic
    Application.ScreenUpdating = True
End Sub

'Test sub
Sub test()
    Dim comments As String, status As String
    If get_user_input() Then
        'Debug.Print CStr(UBound(my_checks, 2) - LBound(my_checks, 2))
        If get_user_input_from_guid("a0f61565-9de5-458f-a372-49c831112dbd", comments, status) Then
            Debug.Print "Comments: " + comments + ". Status: " + status
        End If
    End If
End Sub

spreadsheet/JsonConverter.bas METASEP
Attribute VB_Name = "JsonConverter"
''
' VBA-JSON v2.3.1
' (c) Tim Hall - https://github.com/VBA-tools/VBA-JSON
'
' JSON Converter for VBA
'
' Errors:
' 10001 - JSON parse error
'
' @class JsonConverter
' @author tim.hall.engr@gmail.com
' @license MIT (http://www.opensource.org/licenses/mit-license.php)
'' ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ '
'
' Based originally on vba-json (with extensive changes)
' BSD license included below
'
' JSONLib, http://code.google.com/p/vba-json/
'
' Copyright (c) 2013, Ryo Yokoyama
' All rights reserved.
'
' Redistribution and use in source and binary forms, with or without
' modification, are permitted provided that the following conditions are met:
'     * Redistributions of source code must retain the above copyright
'       notice, this list of conditions and the following disclaimer.
'     * Redistributions in binary form must reproduce the above copyright
'       notice, this list of conditions and the following disclaimer in the
'       documentation and/or other materials provided with the distribution.
'     * Neither the name of the <organization> nor the
'       names of its contributors may be used to endorse or promote products
'       derived from this software without specific prior written permission.
'
' THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
' ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
' WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
' DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
' DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
' (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
' LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
' ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
' (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
' SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
' ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ '
Option Explicit

' === VBA-UTC Headers
#If Mac Then

#If VBA7 Then

' 64-bit Mac (2016)
Private Declare PtrSafe Function utc_popen Lib "/usr/lib/libc.dylib" Alias "popen" _
    (ByVal utc_Command As String, ByVal utc_Mode As String) As LongPtr
Private Declare PtrSafe Function utc_pclose Lib "/usr/lib/libc.dylib" Alias "pclose" _
    (ByVal utc_File As LongPtr) As LongPtr
Private Declare PtrSafe Function utc_fread Lib "/usr/lib/libc.dylib" Alias "fread" _
    (ByVal utc_Buffer As String, ByVal utc_Size As LongPtr, ByVal utc_Number As LongPtr, ByVal utc_File As LongPtr) As LongPtr
Private Declare PtrSafe Function utc_feof Lib "/usr/lib/libc.dylib" Alias "feof" _
    (ByVal utc_File As LongPtr) As LongPtr

#Else

' 32-bit Mac
Private Declare Function utc_popen Lib "libc.dylib" Alias "popen" _
    (ByVal utc_Command As String, ByVal utc_Mode As String) As Long
Private Declare Function utc_pclose Lib "libc.dylib" Alias "pclose" _
    (ByVal utc_File As Long) As Long
Private Declare Function utc_fread Lib "libc.dylib" Alias "fread" _
    (ByVal utc_Buffer As String, ByVal utc_Size As Long, ByVal utc_Number As Long, ByVal utc_File As Long) As Long
Private Declare Function utc_feof Lib "libc.dylib" Alias "feof" _
    (ByVal utc_File As Long) As Long

#End If

#ElseIf VBA7 Then

' http://msdn.microsoft.com/library/windows/desktop/ms724421.aspx
' http://msdn.microsoft.com/library/windows/desktop/ms724949.aspx
' http://msdn.microsoft.com/library/windows/desktop/ms725485.aspx
Private Declare PtrSafe Function utc_GetTimeZoneInformation Lib "kernel32" Alias "GetTimeZoneInformation" _
    (utc_lpTimeZoneInformation As utc_TIME_ZONE_INFORMATION) As Long
Private Declare PtrSafe Function utc_SystemTimeToTzSpecificLocalTime Lib "kernel32" Alias "SystemTimeToTzSpecificLocalTime" _
    (utc_lpTimeZoneInformation As utc_TIME_ZONE_INFORMATION, utc_lpUniversalTime As utc_SYSTEMTIME, utc_lpLocalTime As utc_SYSTEMTIME) As Long
Private Declare PtrSafe Function utc_TzSpecificLocalTimeToSystemTime Lib "kernel32" Alias "TzSpecificLocalTimeToSystemTime" _
    (utc_lpTimeZoneInformation As utc_TIME_ZONE_INFORMATION, utc_lpLocalTime As utc_SYSTEMTIME, utc_lpUniversalTime As utc_SYSTEMTIME) As Long

#Else

Private Declare Function utc_GetTimeZoneInformation Lib "kernel32" Alias "GetTimeZoneInformation" _
    (utc_lpTimeZoneInformation As utc_TIME_ZONE_INFORMATION) As Long
Private Declare Function utc_SystemTimeToTzSpecificLocalTime Lib "kernel32" Alias "SystemTimeToTzSpecificLocalTime" _
    (utc_lpTimeZoneInformation As utc_TIME_ZONE_INFORMATION, utc_lpUniversalTime As utc_SYSTEMTIME, utc_lpLocalTime As utc_SYSTEMTIME) As Long
Private Declare Function utc_TzSpecificLocalTimeToSystemTime Lib "kernel32" Alias "TzSpecificLocalTimeToSystemTime" _
    (utc_lpTimeZoneInformation As utc_TIME_ZONE_INFORMATION, utc_lpLocalTime As utc_SYSTEMTIME, utc_lpUniversalTime As utc_SYSTEMTIME) As Long

#End If

#If Mac Then

#If VBA7 Then
Private Type utc_ShellResult
    utc_Output As String
    utc_ExitCode As LongPtr
End Type

#Else

Private Type utc_ShellResult
    utc_Output As String
    utc_ExitCode As Long
End Type

#End If

#Else

Private Type utc_SYSTEMTIME
    utc_wYear As Integer
    utc_wMonth As Integer
    utc_wDayOfWeek As Integer
    utc_wDay As Integer
    utc_wHour As Integer
    utc_wMinute As Integer
    utc_wSecond As Integer
    utc_wMilliseconds As Integer
End Type

Private Type utc_TIME_ZONE_INFORMATION
    utc_Bias As Long
    utc_StandardName(0 To 31) As Integer
    utc_StandardDate As utc_SYSTEMTIME
    utc_StandardBias As Long
    utc_DaylightName(0 To 31) As Integer
    utc_DaylightDate As utc_SYSTEMTIME
    utc_DaylightBias As Long
End Type

#End If
' === End VBA-UTC

Private Type json_Options
    ' VBA only stores 15 significant digits, so any numbers larger than that are truncated
    ' This can lead to issues when BIGINT's are used (e.g. for Ids or Credit Cards), as they will be invalid above 15 digits
    ' See: http://support.microsoft.com/kb/269370
    '
    ' By default, VBA-JSON will use String for numbers longer than 15 characters that contain only digits
    ' to override set `JsonConverter.JsonOptions.UseDoubleForLargeNumbers = True`
    UseDoubleForLargeNumbers As Boolean

    ' The JSON standard requires object keys to be quoted (" or '), use this option to allow unquoted keys
    AllowUnquotedKeys As Boolean

    ' The solidus (/) is not required to be escaped, use this option to escape them as \/ in ConvertToJson
    EscapeSolidus As Boolean
End Type
Public JsonOptions As json_Options

' ============================================= '
' Public Methods
' ============================================= '

''
' Convert JSON string to object (Dictionary/Collection)
'
' @method ParseJson
' @param {String} json_String
' @return {Object} (Dictionary or Collection)
' @throws 10001 - JSON parse error
''
Public Function ParseJson(ByVal JsonString As String) As Object
    Dim json_Index As Long
    json_Index = 1

    ' Remove vbCr, vbLf, and vbTab from json_String
    JsonString = VBA.Replace(VBA.Replace(VBA.Replace(JsonString, VBA.vbCr, ""), VBA.vbLf, ""), VBA.vbTab, "")

    json_SkipSpaces JsonString, json_Index
    Select Case VBA.Mid$(JsonString, json_Index, 1)
    Case "{"
        Set ParseJson = json_ParseObject(JsonString, json_Index)
    Case "["
        Set ParseJson = json_ParseArray(JsonString, json_Index)
    Case Else
        ' Error: Invalid JSON string
        Err.Raise 10001, "JSONConverter", json_ParseErrorMessage(JsonString, json_Index, "Expecting '{' or '['")
    End Select
End Function

''
' Convert object (Dictionary/Collection/Array) to JSON
'
' @method ConvertToJson
' @param {Variant} JsonValue (Dictionary, Collection, or Array)
' @param {Integer|String} Whitespace "Pretty" print json with given number of spaces per indentation (Integer) or given string
' @return {String}
''
Public Function ConvertToJson(ByVal JsonValue As Variant, Optional ByVal Whitespace As Variant, Optional ByVal json_CurrentIndentation As Long = 0) As String
    Dim json_Buffer As String
    Dim json_BufferPosition As Long
    Dim json_BufferLength As Long
    Dim json_Index As Long
    Dim json_LBound As Long
    Dim json_UBound As Long
    Dim json_IsFirstItem As Boolean
    Dim json_Index2D As Long
    Dim json_LBound2D As Long
    Dim json_UBound2D As Long
    Dim json_IsFirstItem2D As Boolean
    Dim json_Key As Variant
    Dim json_Value As Variant
    Dim json_DateStr As String
    Dim json_Converted As String
    Dim json_SkipItem As Boolean
    Dim json_PrettyPrint As Boolean
    Dim json_Indentation As String
    Dim json_InnerIndentation As String

    json_LBound = -1
    json_UBound = -1
    json_IsFirstItem = True
    json_LBound2D = -1
    json_UBound2D = -1
    json_IsFirstItem2D = True
    json_PrettyPrint = Not IsMissing(Whitespace)

    Select Case VBA.VarType(JsonValue)
    Case VBA.vbNull
        ConvertToJson = "null"
    Case VBA.vbDate
        ' Date
        json_DateStr = ConvertToIso(VBA.CDate(JsonValue))

        ConvertToJson = """" & json_DateStr & """"
    Case VBA.vbString
        ' String (or large number encoded as string)
        If Not JsonOptions.UseDoubleForLargeNumbers And json_StringIsLargeNumber(JsonValue) Then
            ConvertToJson = JsonValue
        Else
            ConvertToJson = """" & json_Encode(JsonValue) & """"
        End If
    Case VBA.vbBoolean
        If JsonValue Then
            ConvertToJson = "true"
        Else
            ConvertToJson = "false"
        End If
    Case VBA.vbArray To VBA.vbArray + VBA.vbByte
        If json_PrettyPrint Then
            If VBA.VarType(Whitespace) = VBA.vbString Then
                json_Indentation = VBA.String$(json_CurrentIndentation + 1, Whitespace)
                json_InnerIndentation = VBA.String$(json_CurrentIndentation + 2, Whitespace)
            Else
                json_Indentation = VBA.Space$((json_CurrentIndentation + 1) * Whitespace)
                json_InnerIndentation = VBA.Space$((json_CurrentIndentation + 2) * Whitespace)
            End If
        End If

        ' Array
        json_BufferAppend json_Buffer, "[", json_BufferPosition, json_BufferLength

        On Error Resume Next

        json_LBound = LBound(JsonValue, 1)
        json_UBound = UBound(JsonValue, 1)
        json_LBound2D = LBound(JsonValue, 2)
        json_UBound2D = UBound(JsonValue, 2)

        If json_LBound >= 0 And json_UBound >= 0 Then
            For json_Index = json_LBound To json_UBound
                If json_IsFirstItem Then
                    json_IsFirstItem = False
                Else
                    ' Append comma to previous line
                    json_BufferAppend json_Buffer, ",", json_BufferPosition, json_BufferLength
                End If

                If json_LBound2D >= 0 And json_UBound2D >= 0 Then
                    ' 2D Array
                    If json_PrettyPrint Then
                        json_BufferAppend json_Buffer, vbNewLine, json_BufferPosition, json_BufferLength
                    End If
                    json_BufferAppend json_Buffer, json_Indentation & "[", json_BufferPosition, json_BufferLength

                    For json_Index2D = json_LBound2D To json_UBound2D
                        If json_IsFirstItem2D Then
                            json_IsFirstItem2D = False
                        Else
                            json_BufferAppend json_Buffer, ",", json_BufferPosition, json_BufferLength
                        End If

                        json_Converted = ConvertToJson(JsonValue(json_Index, json_Index2D), Whitespace, json_CurrentIndentation + 2)

                        ' For Arrays/Collections, undefined (Empty/Nothing) is treated as null
                        If json_Converted = "" Then
                            ' (nest to only check if converted = "")
                            If json_IsUndefined(JsonValue(json_Index, json_Index2D)) Then
                                json_Converted = "null"
                            End If
                        End If

                        If json_PrettyPrint Then
                            json_Converted = vbNewLine & json_InnerIndentation & json_Converted
                        End If

                        json_BufferAppend json_Buffer, json_Converted, json_BufferPosition, json_BufferLength
                    Next json_Index2D

                    If json_PrettyPrint Then
                        json_BufferAppend json_Buffer, vbNewLine, json_BufferPosition, json_BufferLength
                    End If

                    json_BufferAppend json_Buffer, json_Indentation & "]", json_BufferPosition, json_BufferLength
                    json_IsFirstItem2D = True
                Else
                    ' 1D Array
                    json_Converted = ConvertToJson(JsonValue(json_Index), Whitespace, json_CurrentIndentation + 1)

                    ' For Arrays/Collections, undefined (Empty/Nothing) is treated as null
                    If json_Converted = "" Then
                        ' (nest to only check if converted = "")
                        If json_IsUndefined(JsonValue(json_Index)) Then
                            json_Converted = "null"
                        End If
                    End If

                    If json_PrettyPrint Then
                        json_Converted = vbNewLine & json_Indentation & json_Converted
                    End If

                    json_BufferAppend json_Buffer, json_Converted, json_BufferPosition, json_BufferLength
                End If
            Next json_Index
        End If

        On Error GoTo 0

        If json_PrettyPrint Then
            json_BufferAppend json_Buffer, vbNewLine, json_BufferPosition, json_BufferLength

            If VBA.VarType(Whitespace) = VBA.vbString Then
                json_Indentation = VBA.String$(json_CurrentIndentation, Whitespace)
            Else
                json_Indentation = VBA.Space$(json_CurrentIndentation * Whitespace)
            End If
        End If

        json_BufferAppend json_Buffer, json_Indentation & "]", json_BufferPosition, json_BufferLength

        ConvertToJson = json_BufferToString(json_Buffer, json_BufferPosition)

    ' Dictionary or Collection
    Case VBA.vbObject
        If json_PrettyPrint Then
            If VBA.VarType(Whitespace) = VBA.vbString Then
                json_Indentation = VBA.String$(json_CurrentIndentation + 1, Whitespace)
            Else
                json_Indentation = VBA.Space$((json_CurrentIndentation + 1) * Whitespace)
            End If
        End If

        ' Dictionary
        If VBA.TypeName(JsonValue) = "Dictionary" Then
            json_BufferAppend json_Buffer, "{", json_BufferPosition, json_BufferLength
            For Each json_Key In JsonValue.Keys
                ' For Objects, undefined (Empty/Nothing) is not added to object
                json_Converted = ConvertToJson(JsonValue(json_Key), Whitespace, json_CurrentIndentation + 1)
                If json_Converted = "" Then
                    json_SkipItem = json_IsUndefined(JsonValue(json_Key))
                Else
                    json_SkipItem = False
                End If

                If Not json_SkipItem Then
                    If json_IsFirstItem Then
                        json_IsFirstItem = False
                    Else
                        json_BufferAppend json_Buffer, ",", json_BufferPosition, json_BufferLength
                    End If

                    If json_PrettyPrint Then
                        json_Converted = vbNewLine & json_Indentation & """" & json_Key & """: " & json_Converted
                    Else
                        json_Converted = """" & json_Key & """:" & json_Converted
                    End If

                    json_BufferAppend json_Buffer, json_Converted, json_BufferPosition, json_BufferLength
                End If
            Next json_Key

            If json_PrettyPrint Then
                json_BufferAppend json_Buffer, vbNewLine, json_BufferPosition, json_BufferLength

                If VBA.VarType(Whitespace) = VBA.vbString Then
                    json_Indentation = VBA.String$(json_CurrentIndentation, Whitespace)
                Else
                    json_Indentation = VBA.Space$(json_CurrentIndentation * Whitespace)
                End If
            End If

            json_BufferAppend json_Buffer, json_Indentation & "}", json_BufferPosition, json_BufferLength

        ' Collection
        ElseIf VBA.TypeName(JsonValue) = "Collection" Then
            json_BufferAppend json_Buffer, "[", json_BufferPosition, json_BufferLength
            For Each json_Value In JsonValue
                If json_IsFirstItem Then
                    json_IsFirstItem = False
                Else
                    json_BufferAppend json_Buffer, ",", json_BufferPosition, json_BufferLength
                End If

                json_Converted = ConvertToJson(json_Value, Whitespace, json_CurrentIndentation + 1)

                ' For Arrays/Collections, undefined (Empty/Nothing) is treated as null
                If json_Converted = "" Then
                    ' (nest to only check if converted = "")
                    If json_IsUndefined(json_Value) Then
                        json_Converted = "null"
                    End If
                End If

                If json_PrettyPrint Then
                    json_Converted = vbNewLine & json_Indentation & json_Converted
                End If

                json_BufferAppend json_Buffer, json_Converted, json_BufferPosition, json_BufferLength
            Next json_Value

            If json_PrettyPrint Then
                json_BufferAppend json_Buffer, vbNewLine, json_BufferPosition, json_BufferLength

                If VBA.VarType(Whitespace) = VBA.vbString Then
                    json_Indentation = VBA.String$(json_CurrentIndentation, Whitespace)
                Else
                    json_Indentation = VBA.Space$(json_CurrentIndentation * Whitespace)
                End If
            End If

            json_BufferAppend json_Buffer, json_Indentation & "]", json_BufferPosition, json_BufferLength
        End If

        ConvertToJson = json_BufferToString(json_Buffer, json_BufferPosition)
    Case VBA.vbInteger, VBA.vbLong, VBA.vbSingle, VBA.vbDouble, VBA.vbCurrency, VBA.vbDecimal
        ' Number (use decimals for numbers)
        ConvertToJson = VBA.Replace(JsonValue, ",", ".")
    Case Else
        ' vbEmpty, vbError, vbDataObject, vbByte, vbUserDefinedType
        ' Use VBA's built-in to-string
        On Error Resume Next
        ConvertToJson = JsonValue
        On Error GoTo 0
    End Select
End Function

' ============================================= '
' Private Functions
' ============================================= '

Private Function json_ParseObject(json_String As String, ByRef json_Index As Long) As Dictionary
    Dim json_Key As String
    Dim json_NextChar As String

    Set json_ParseObject = New Dictionary
    json_SkipSpaces json_String, json_Index
    If VBA.Mid$(json_String, json_Index, 1) <> "{" Then
        Err.Raise 10001, "JSONConverter", json_ParseErrorMessage(json_String, json_Index, "Expecting '{'")
    Else
        json_Index = json_Index + 1

        Do
            json_SkipSpaces json_String, json_Index
            If VBA.Mid$(json_String, json_Index, 1) = "}" Then
                json_Index = json_Index + 1
                Exit Function
            ElseIf VBA.Mid$(json_String, json_Index, 1) = "," Then
                json_Index = json_Index + 1
                json_SkipSpaces json_String, json_Index
            End If

            json_Key = json_ParseKey(json_String, json_Index)
            json_NextChar = json_Peek(json_String, json_Index)
            If json_NextChar = "[" Or json_NextChar = "{" Then
                Set json_ParseObject.Item(json_Key) = json_ParseValue(json_String, json_Index)
            Else
                json_ParseObject.Item(json_Key) = json_ParseValue(json_String, json_Index)
            End If
        Loop
    End If
End Function

Private Function json_ParseArray(json_String As String, ByRef json_Index As Long) As Collection
    Set json_ParseArray = New Collection

    json_SkipSpaces json_String, json_Index
    If VBA.Mid$(json_String, json_Index, 1) <> "[" Then
        Err.Raise 10001, "JSONConverter", json_ParseErrorMessage(json_String, json_Index, "Expecting '['")
    Else
        json_Index = json_Index + 1

        Do
            json_SkipSpaces json_String, json_Index
            If VBA.Mid$(json_String, json_Index, 1) = "]" Then
                json_Index = json_Index + 1
                Exit Function
            ElseIf VBA.Mid$(json_String, json_Index, 1) = "," Then
                json_Index = json_Index + 1
                json_SkipSpaces json_String, json_Index
            End If

            json_ParseArray.Add json_ParseValue(json_String, json_Index)
        Loop
    End If
End Function

Private Function json_ParseValue(json_String As String, ByRef json_Index As Long) As Variant
    json_SkipSpaces json_String, json_Index
    Select Case VBA.Mid$(json_String, json_Index, 1)
    Case "{"
        Set json_ParseValue = json_ParseObject(json_String, json_Index)
    Case "["
        Set json_ParseValue = json_ParseArray(json_String, json_Index)
    Case """", "'"
        json_ParseValue = json_ParseString(json_String, json_Index)
    Case Else
        If VBA.Mid$(json_String, json_Index, 4) = "true" Then
            json_ParseValue = True
            json_Index = json_Index + 4
        ElseIf VBA.Mid$(json_String, json_Index, 5) = "false" Then
            json_ParseValue = False
            json_Index = json_Index + 5
        ElseIf VBA.Mid$(json_String, json_Index, 4) = "null" Then
            json_ParseValue = Null
            json_Index = json_Index + 4
        ElseIf VBA.InStr("+-0123456789", VBA.Mid$(json_String, json_Index, 1)) Then
            json_ParseValue = json_ParseNumber(json_String, json_Index)
        Else
            Err.Raise 10001, "JSONConverter", json_ParseErrorMessage(json_String, json_Index, "Expecting 'STRING', 'NUMBER', null, true, false, '{', or '['")
        End If
    End Select
End Function

Private Function json_ParseString(json_String As String, ByRef json_Index As Long) As String
    Dim json_Quote As String
    Dim json_Char As String
    Dim json_Code As String
    Dim json_Buffer As String
    Dim json_BufferPosition As Long
    Dim json_BufferLength As Long

    json_SkipSpaces json_String, json_Index

    ' Store opening quote to look for matching closing quote
    json_Quote = VBA.Mid$(json_String, json_Index, 1)
    json_Index = json_Index + 1

    Do While json_Index > 0 And json_Index <= Len(json_String)
        json_Char = VBA.Mid$(json_String, json_Index, 1)

        Select Case json_Char
        Case "\"
            ' Escaped string, \\, or \/
            json_Index = json_Index + 1
            json_Char = VBA.Mid$(json_String, json_Index, 1)

            Select Case json_Char
            Case """", "\", "/", "'"
                json_BufferAppend json_Buffer, json_Char, json_BufferPosition, json_BufferLength
                json_Index = json_Index + 1
            Case "b"
                json_BufferAppend json_Buffer, vbBack, json_BufferPosition, json_BufferLength
                json_Index = json_Index + 1
            Case "f"
                json_BufferAppend json_Buffer, vbFormFeed, json_BufferPosition, json_BufferLength
                json_Index = json_Index + 1
            Case "n"
                json_BufferAppend json_Buffer, vbCrLf, json_BufferPosition, json_BufferLength
                json_Index = json_Index + 1
            Case "r"
                json_BufferAppend json_Buffer, vbCr, json_BufferPosition, json_BufferLength
                json_Index = json_Index + 1
            Case "t"
                json_BufferAppend json_Buffer, vbTab, json_BufferPosition, json_BufferLength
                json_Index = json_Index + 1
            Case "u"
                ' Unicode character escape (e.g. \u00a9 = Copyright)
                json_Index = json_Index + 1
                json_Code = VBA.Mid$(json_String, json_Index, 4)
                json_BufferAppend json_Buffer, VBA.ChrW(VBA.Val("&h" + json_Code)), json_BufferPosition, json_BufferLength
                json_Index = json_Index + 4
            End Select
        Case json_Quote
            json_ParseString = json_BufferToString(json_Buffer, json_BufferPosition)
            json_Index = json_Index + 1
            Exit Function
        Case Else
            json_BufferAppend json_Buffer, json_Char, json_BufferPosition, json_BufferLength
            json_Index = json_Index + 1
        End Select
    Loop
End Function

Private Function json_ParseNumber(json_String As String, ByRef json_Index As Long) As Variant
    Dim json_Char As String
    Dim json_Value As String
    Dim json_IsLargeNumber As Boolean

    json_SkipSpaces json_String, json_Index

    Do While json_Index > 0 And json_Index <= Len(json_String)
        json_Char = VBA.Mid$(json_String, json_Index, 1)

        If VBA.InStr("+-0123456789.eE", json_Char) Then
            ' Unlikely to have massive number, so use simple append rather than buffer here
            json_Value = json_Value & json_Char
            json_Index = json_Index + 1
        Else
            ' Excel only stores 15 significant digits, so any numbers larger than that are truncated
            ' This can lead to issues when BIGINT's are used (e.g. for Ids or Credit Cards), as they will be invalid above 15 digits
            ' See: http://support.microsoft.com/kb/269370
            '
            ' Fix: Parse -> String, Convert -> String longer than 15/16 characters containing only numbers and decimal points -> Number
            ' (decimal doesn't factor into significant digit count, so if present check for 15 digits + decimal = 16)
            json_IsLargeNumber = IIf(InStr(json_Value, "."), Len(json_Value) >= 17, Len(json_Value) >= 16)
            If Not JsonOptions.UseDoubleForLargeNumbers And json_IsLargeNumber Then
                json_ParseNumber = json_Value
            Else
                ' VBA.Val does not use regional settings, so guard for comma is not needed
                json_ParseNumber = VBA.Val(json_Value)
            End If
            Exit Function
        End If
    Loop
End Function

Private Function json_ParseKey(json_String As String, ByRef json_Index As Long) As String
    ' Parse key with single or double quotes
    If VBA.Mid$(json_String, json_Index, 1) = """" Or VBA.Mid$(json_String, json_Index, 1) = "'" Then
        json_ParseKey = json_ParseString(json_String, json_Index)
    ElseIf JsonOptions.AllowUnquotedKeys Then
        Dim json_Char As String
        Do While json_Index > 0 And json_Index <= Len(json_String)
            json_Char = VBA.Mid$(json_String, json_Index, 1)
            If (json_Char <> " ") And (json_Char <> ":") Then
                json_ParseKey = json_ParseKey & json_Char
                json_Index = json_Index + 1
            Else
                Exit Do
            End If
        Loop
    Else
        Err.Raise 10001, "JSONConverter", json_ParseErrorMessage(json_String, json_Index, "Expecting '""' or '''")
    End If

    ' Check for colon and skip if present or throw if not present
    json_SkipSpaces json_String, json_Index
    If VBA.Mid$(json_String, json_Index, 1) <> ":" Then
        Err.Raise 10001, "JSONConverter", json_ParseErrorMessage(json_String, json_Index, "Expecting ':'")
    Else
        json_Index = json_Index + 1
    End If
End Function

Private Function json_IsUndefined(ByVal json_Value As Variant) As Boolean
    ' Empty / Nothing -> undefined
    Select Case VBA.VarType(json_Value)
    Case VBA.vbEmpty
        json_IsUndefined = True
    Case VBA.vbObject
        Select Case VBA.TypeName(json_Value)
        Case "Empty", "Nothing"
            json_IsUndefined = True
        End Select
    End Select
End Function

Private Function json_Encode(ByVal json_Text As Variant) As String
    ' Reference: http://www.ietf.org/rfc/rfc4627.txt
    ' Escape: ", \, /, backspace, form feed, line feed, carriage return, tab
    Dim json_Index As Long
    Dim json_Char As String
    Dim json_AscCode As Long
    Dim json_Buffer As String
    Dim json_BufferPosition As Long
    Dim json_BufferLength As Long

    For json_Index = 1 To VBA.Len(json_Text)
        json_Char = VBA.Mid$(json_Text, json_Index, 1)
        json_AscCode = VBA.AscW(json_Char)

        ' When AscW returns a negative number, it returns the twos complement form of that number.
        ' To convert the twos complement notation into normal binary notation, add 0xFFF to the return result.
        ' https://support.microsoft.com/kb/272138
        If json_AscCode < 0 Then
            json_AscCode = json_AscCode + 65536
        End If

        ' From spec, ", \, and control characters must be escaped (solidus is optional)

        Select Case json_AscCode
        Case 34
            ' " -> 34 -> \"
            json_Char = "\"""
        Case 92
            ' \ -> 92 -> \\
            json_Char = "\\"
        Case 47
            ' / -> 47 -> \/ (optional)
            If JsonOptions.EscapeSolidus Then
                json_Char = "\/"
            End If
        Case 8
            ' backspace -> 8 -> \b
            json_Char = "\b"
        Case 12
            ' form feed -> 12 -> \f
            json_Char = "\f"
        Case 10
            ' line feed -> 10 -> \n
            json_Char = "\n"
        Case 13
            ' carriage return -> 13 -> \r
            json_Char = "\r"
        Case 9
            ' tab -> 9 -> \t
            json_Char = "\t"
        Case 0 To 31, 127 To 65535
            ' Non-ascii characters -> convert to 4-digit hex
            json_Char = "\u" & VBA.Right$("0000" & VBA.Hex$(json_AscCode), 4)
        End Select

        json_BufferAppend json_Buffer, json_Char, json_BufferPosition, json_BufferLength
    Next json_Index

    json_Encode = json_BufferToString(json_Buffer, json_BufferPosition)
End Function

Private Function json_Peek(json_String As String, ByVal json_Index As Long, Optional json_NumberOfCharacters As Long = 1) As String
    ' "Peek" at the next number of characters without incrementing json_Index (ByVal instead of ByRef)
    json_SkipSpaces json_String, json_Index
    json_Peek = VBA.Mid$(json_String, json_Index, json_NumberOfCharacters)
End Function

Private Sub json_SkipSpaces(json_String As String, ByRef json_Index As Long)
    ' Increment index to skip over spaces
    Do While json_Index > 0 And json_Index <= VBA.Len(json_String) And VBA.Mid$(json_String, json_Index, 1) = " "
        json_Index = json_Index + 1
    Loop
End Sub

Private Function json_StringIsLargeNumber(json_String As Variant) As Boolean
    ' Check if the given string is considered a "large number"
    ' (See json_ParseNumber)

    Dim json_Length As Long
    Dim json_CharIndex As Long
    json_Length = VBA.Len(json_String)

    ' Length with be at least 16 characters and assume will be less than 100 characters
    If json_Length >= 16 And json_Length <= 100 Then
        Dim json_CharCode As String

        json_StringIsLargeNumber = True

        For json_CharIndex = 1 To json_Length
            json_CharCode = VBA.Asc(VBA.Mid$(json_String, json_CharIndex, 1))
            Select Case json_CharCode
            ' Look for .|0-9|E|e
            Case 46, 48 To 57, 69, 101
                ' Continue through characters
            Case Else
                json_StringIsLargeNumber = False
                Exit Function
            End Select
        Next json_CharIndex
    End If
End Function

Private Function json_ParseErrorMessage(json_String As String, ByRef json_Index As Long, ErrorMessage As String)
    ' Provide detailed parse error message, including details of where and what occurred
    '
    ' Example:
    ' Error parsing JSON:
    ' {"abcde":True}
    '          ^
    ' Expecting 'STRING', 'NUMBER', null, true, false, '{', or '['

    Dim json_StartIndex As Long
    Dim json_StopIndex As Long

    ' Include 10 characters before and after error (if possible)
    json_StartIndex = json_Index - 10
    json_StopIndex = json_Index + 10
    If json_StartIndex <= 0 Then
        json_StartIndex = 1
    End If
    If json_StopIndex > VBA.Len(json_String) Then
        json_StopIndex = VBA.Len(json_String)
    End If

    json_ParseErrorMessage = "Error parsing JSON:" & VBA.vbNewLine & _
                             VBA.Mid$(json_String, json_StartIndex, json_StopIndex - json_StartIndex + 1) & VBA.vbNewLine & _
                             VBA.Space$(json_Index - json_StartIndex) & "^" & VBA.vbNewLine & _
                             ErrorMessage
End Function

Private Sub json_BufferAppend(ByRef json_Buffer As String, _
                              ByRef json_Append As Variant, _
                              ByRef json_BufferPosition As Long, _
                              ByRef json_BufferLength As Long)
    ' VBA can be slow to append strings due to allocating a new string for each append
    ' Instead of using the traditional append, allocate a large empty string and then copy string at append position
    '
    ' Example:
    ' Buffer: "abc  "
    ' Append: "def"
    ' Buffer Position: 3
    ' Buffer Length: 5
    '
    ' Buffer position + Append length > Buffer length -> Append chunk of blank space to buffer
    ' Buffer: "abc       "
    ' Buffer Length: 10
    '
    ' Put "def" into buffer at position 3 (0-based)
    ' Buffer: "abcdef    "
    '
    ' Approach based on cStringBuilder from vbAccelerator
    ' http://www.vbaccelerator.com/home/VB/Code/Techniques/RunTime_Debug_Tracing/VB6_Tracer_Utility_zip_cStringBuilder_cls.asp
    '
    ' and clsStringAppend from Philip Swannell
    ' https://github.com/VBA-tools/VBA-JSON/pull/82

    Dim json_AppendLength As Long
    Dim json_LengthPlusPosition As Long

    json_AppendLength = VBA.Len(json_Append)
    json_LengthPlusPosition = json_AppendLength + json_BufferPosition

    If json_LengthPlusPosition > json_BufferLength Then
        ' Appending would overflow buffer, add chunk
        ' (double buffer length or append length, whichever is bigger)
        Dim json_AddedLength As Long
        json_AddedLength = IIf(json_AppendLength > json_BufferLength, json_AppendLength, json_BufferLength)

        json_Buffer = json_Buffer & VBA.Space$(json_AddedLength)
        json_BufferLength = json_BufferLength + json_AddedLength
    End If

    ' Note: Namespacing with VBA.Mid$ doesn't work properly here, throwing compile error:
    ' Function call on left-hand side of assignment must return Variant or Object
    Mid$(json_Buffer, json_BufferPosition + 1, json_AppendLength) = CStr(json_Append)
    json_BufferPosition = json_BufferPosition + json_AppendLength
End Sub

Private Function json_BufferToString(ByRef json_Buffer As String, ByVal json_BufferPosition As Long) As String
    If json_BufferPosition > 0 Then
        json_BufferToString = VBA.Left$(json_Buffer, json_BufferPosition)
    End If
End Function

''
' VBA-UTC v1.0.6
' (c) Tim Hall - https://github.com/VBA-tools/VBA-UtcConverter
'
' UTC/ISO 8601 Converter for VBA
'
' Errors:
' 10011 - UTC parsing error
' 10012 - UTC conversion error
' 10013 - ISO 8601 parsing error
' 10014 - ISO 8601 conversion error
'
' @module UtcConverter
' @author tim.hall.engr@gmail.com
' @license MIT (http://www.opensource.org/licenses/mit-license.php)
'' ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ '

' (Declarations moved to top)

' ============================================= '
' Public Methods
' ============================================= '

''
' Parse UTC date to local date
'
' @method ParseUtc
' @param {Date} UtcDate
' @return {Date} Local date
' @throws 10011 - UTC parsing error
''
Public Function ParseUtc(utc_UtcDate As Date) As Date
    On Error GoTo utc_ErrorHandling

#If Mac Then
    ParseUtc = utc_ConvertDate(utc_UtcDate)
#Else
    Dim utc_TimeZoneInfo As utc_TIME_ZONE_INFORMATION
    Dim utc_LocalDate As utc_SYSTEMTIME

    utc_GetTimeZoneInformation utc_TimeZoneInfo
    utc_SystemTimeToTzSpecificLocalTime utc_TimeZoneInfo, utc_DateToSystemTime(utc_UtcDate), utc_LocalDate

    ParseUtc = utc_SystemTimeToDate(utc_LocalDate)
#End If

    Exit Function

utc_ErrorHandling:
    Err.Raise 10011, "UtcConverter.ParseUtc", "UTC parsing error: " & Err.Number & " - " & Err.Description
End Function

''
' Convert local date to UTC date
'
' @method ConvertToUrc
' @param {Date} utc_LocalDate
' @return {Date} UTC date
' @throws 10012 - UTC conversion error
''
Public Function ConvertToUtc(utc_LocalDate As Date) As Date
    On Error GoTo utc_ErrorHandling

#If Mac Then
    ConvertToUtc = utc_ConvertDate(utc_LocalDate, utc_ConvertToUtc:=True)
#Else
    Dim utc_TimeZoneInfo As utc_TIME_ZONE_INFORMATION
    Dim utc_UtcDate As utc_SYSTEMTIME

    utc_GetTimeZoneInformation utc_TimeZoneInfo
    utc_TzSpecificLocalTimeToSystemTime utc_TimeZoneInfo, utc_DateToSystemTime(utc_LocalDate), utc_UtcDate

    ConvertToUtc = utc_SystemTimeToDate(utc_UtcDate)
#End If

    Exit Function

utc_ErrorHandling:
    Err.Raise 10012, "UtcConverter.ConvertToUtc", "UTC conversion error: " & Err.Number & " - " & Err.Description
End Function

''
' Parse ISO 8601 date string to local date
'
' @method ParseIso
' @param {Date} utc_IsoString
' @return {Date} Local date
' @throws 10013 - ISO 8601 parsing error
''
Public Function ParseIso(utc_IsoString As String) As Date
    On Error GoTo utc_ErrorHandling

    Dim utc_Parts() As String
    Dim utc_DateParts() As String
    Dim utc_TimeParts() As String
    Dim utc_OffsetIndex As Long
    Dim utc_HasOffset As Boolean
    Dim utc_NegativeOffset As Boolean
    Dim utc_OffsetParts() As String
    Dim utc_Offset As Date

    utc_Parts = VBA.Split(utc_IsoString, "T")
    utc_DateParts = VBA.Split(utc_Parts(0), "-")
    ParseIso = VBA.DateSerial(VBA.CInt(utc_DateParts(0)), VBA.CInt(utc_DateParts(1)), VBA.CInt(utc_DateParts(2)))

    If UBound(utc_Parts) > 0 Then
        If VBA.InStr(utc_Parts(1), "Z") Then
            utc_TimeParts = VBA.Split(VBA.Replace(utc_Parts(1), "Z", ""), ":")
        Else
            utc_OffsetIndex = VBA.InStr(1, utc_Parts(1), "+")
            If utc_OffsetIndex = 0 Then
                utc_NegativeOffset = True
                utc_OffsetIndex = VBA.InStr(1, utc_Parts(1), "-")
            End If

            If utc_OffsetIndex > 0 Then
                utc_HasOffset = True
                utc_TimeParts = VBA.Split(VBA.Left$(utc_Parts(1), utc_OffsetIndex - 1), ":")
                utc_OffsetParts = VBA.Split(VBA.Right$(utc_Parts(1), Len(utc_Parts(1)) - utc_OffsetIndex), ":")

                Select Case UBound(utc_OffsetParts)
                Case 0
                    utc_Offset = TimeSerial(VBA.CInt(utc_OffsetParts(0)), 0, 0)
                Case 1
                    utc_Offset = TimeSerial(VBA.CInt(utc_OffsetParts(0)), VBA.CInt(utc_OffsetParts(1)), 0)
                Case 2
                    ' VBA.Val does not use regional settings, use for seconds to avoid decimal/comma issues
                    utc_Offset = TimeSerial(VBA.CInt(utc_OffsetParts(0)), VBA.CInt(utc_OffsetParts(1)), Int(VBA.Val(utc_OffsetParts(2))))
                End Select

                If utc_NegativeOffset Then: utc_Offset = -utc_Offset
            Else
                utc_TimeParts = VBA.Split(utc_Parts(1), ":")
            End If
        End If

        Select Case UBound(utc_TimeParts)
        Case 0
            ParseIso = ParseIso + VBA.TimeSerial(VBA.CInt(utc_TimeParts(0)), 0, 0)
        Case 1
            ParseIso = ParseIso + VBA.TimeSerial(VBA.CInt(utc_TimeParts(0)), VBA.CInt(utc_TimeParts(1)), 0)
        Case 2
            ' VBA.Val does not use regional settings, use for seconds to avoid decimal/comma issues
            ParseIso = ParseIso + VBA.TimeSerial(VBA.CInt(utc_TimeParts(0)), VBA.CInt(utc_TimeParts(1)), Int(VBA.Val(utc_TimeParts(2))))
        End Select

        ParseIso = ParseUtc(ParseIso)

        If utc_HasOffset Then
            ParseIso = ParseIso - utc_Offset
        End If
    End If

    Exit Function

utc_ErrorHandling:
    Err.Raise 10013, "UtcConverter.ParseIso", "ISO 8601 parsing error for " & utc_IsoString & ": " & Err.Number & " - " & Err.Description
End Function

''
' Convert local date to ISO 8601 string
'
' @method ConvertToIso
' @param {Date} utc_LocalDate
' @return {Date} ISO 8601 string
' @throws 10014 - ISO 8601 conversion error
''
Public Function ConvertToIso(utc_LocalDate As Date) As String
    On Error GoTo utc_ErrorHandling

    ConvertToIso = VBA.Format$(ConvertToUtc(utc_LocalDate), "yyyy-mm-ddTHH:mm:ss.000Z")

    Exit Function

utc_ErrorHandling:
    Err.Raise 10014, "UtcConverter.ConvertToIso", "ISO 8601 conversion error: " & Err.Number & " - " & Err.Description
End Function

' ============================================= '
' Private Functions
' ============================================= '

#If Mac Then

Private Function utc_ConvertDate(utc_Value As Date, Optional utc_ConvertToUtc As Boolean = False) As Date
    Dim utc_ShellCommand As String
    Dim utc_Result As utc_ShellResult
    Dim utc_Parts() As String
    Dim utc_DateParts() As String
    Dim utc_TimeParts() As String

    If utc_ConvertToUtc Then
        utc_ShellCommand = "date -ur `date -jf '%Y-%m-%d %H:%M:%S' " & _
            "'" & VBA.Format$(utc_Value, "yyyy-mm-dd HH:mm:ss") & "' " & _
            " +'%s'` +'%Y-%m-%d %H:%M:%S'"
    Else
        utc_ShellCommand = "date -jf '%Y-%m-%d %H:%M:%S %z' " & _
            "'" & VBA.Format$(utc_Value, "yyyy-mm-dd HH:mm:ss") & " +0000' " & _
            "+'%Y-%m-%d %H:%M:%S'"
    End If

    utc_Result = utc_ExecuteInShell(utc_ShellCommand)

    If utc_Result.utc_Output = "" Then
        Err.Raise 10015, "UtcConverter.utc_ConvertDate", "'date' command failed"
    Else
        utc_Parts = Split(utc_Result.utc_Output, " ")
        utc_DateParts = Split(utc_Parts(0), "-")
        utc_TimeParts = Split(utc_Parts(1), ":")

        utc_ConvertDate = DateSerial(utc_DateParts(0), utc_DateParts(1), utc_DateParts(2)) + _
            TimeSerial(utc_TimeParts(0), utc_TimeParts(1), utc_TimeParts(2))
    End If
End Function

Private Function utc_ExecuteInShell(utc_ShellCommand As String) As utc_ShellResult
#If VBA7 Then
    Dim utc_File As LongPtr
    Dim utc_Read As LongPtr
#Else
    Dim utc_File As Long
    Dim utc_Read As Long
#End If

    Dim utc_Chunk As String

    On Error GoTo utc_ErrorHandling
    utc_File = utc_popen(utc_ShellCommand, "r")

    If utc_File = 0 Then: Exit Function

    Do While utc_feof(utc_File) = 0
        utc_Chunk = VBA.Space$(50)
        utc_Read = CLng(utc_fread(utc_Chunk, 1, Len(utc_Chunk) - 1, utc_File))
        If utc_Read > 0 Then
            utc_Chunk = VBA.Left$(utc_Chunk, CLng(utc_Read))
            utc_ExecuteInShell.utc_Output = utc_ExecuteInShell.utc_Output & utc_Chunk
        End If
    Loop

utc_ErrorHandling:
    utc_ExecuteInShell.utc_ExitCode = CLng(utc_pclose(utc_File))
End Function

#Else

Private Function utc_DateToSystemTime(utc_Value As Date) As utc_SYSTEMTIME
    utc_DateToSystemTime.utc_wYear = VBA.Year(utc_Value)
    utc_DateToSystemTime.utc_wMonth = VBA.Month(utc_Value)
    utc_DateToSystemTime.utc_wDay = VBA.Day(utc_Value)
    utc_DateToSystemTime.utc_wHour = VBA.Hour(utc_Value)
    utc_DateToSystemTime.utc_wMinute = VBA.Minute(utc_Value)
    utc_DateToSystemTime.utc_wSecond = VBA.Second(utc_Value)
    utc_DateToSystemTime.utc_wMilliseconds = 0
End Function

Private Function utc_SystemTimeToDate(utc_Value As utc_SYSTEMTIME) As Date
    utc_SystemTimeToDate = DateSerial(utc_Value.utc_wYear, utc_Value.utc_wMonth, utc_Value.utc_wDay) + _
        TimeSerial(utc_Value.utc_wHour, utc_Value.utc_wMinute, utc_Value.utc_wSecond)
End Function

#End If

pictures/unblock.png METASEP

pictures/spreadsheet_screenshot_dashboard.png METASEP

pictures/spreadsheet_screenshot2.png METASEP

pictures/spreadsheet_screenshot.png METASEP

pictures/spreadsheet_paste_query_result.png METASEP

pictures/overview.png METASEP

pictures/macro_warning.png METASEP

pictures/high_level_web_based_view.png METASEP

pictures/graph_import_result.png METASEP

pictures/flaskmysql_screenshot.png METASEP

pictures/defender_settings_4.png METASEP

pictures/defender_settings_3.png METASEP

pictures/defender_settings_2.png METASEP

pictures/defender_settings_1.png METASEP

pictures/defender_settings.png METASEP

pictures/advanced_buttons.png METASEP

checklists/sqldb_security_checklist.pt.json METASEP
{
    "$schema": "checklist.schema.json",
    "categories": [
        {
            "name": "BCDR"
        },
        {
            "name": "Defensor"
        },
        {
            "name": "Encriptação"
        },
        {
            "name": "Identidade"
        },
        {
            "name": "Acesso privilegiado"
        },
        {
            "name": "Livro-razão"
        },
        {
            "name": "Log"
        },
        {
            "name": "Rede"
        },
        {
            "name": "Descoberta e classificação de dados"
        },
        {
            "name": "Mascaramento de dados"
        },
        {
            "name": "Código"
        }
    ],
    "items": [
        {
            "category": "BCDR",
            "description": "Certifique-se de que seus backups estejam protegidos contra ataques. Isso deve incluir a criptografia dos backups para proteger contra a perda de confidencialidade. Para backup de serviço regular do Azure, os dados de backup são criptografados automaticamente usando chaves gerenciadas pela plataforma do Azure. Você também pode optar por criptografar o backup usando uma chave gerenciada pelo cliente. Nesse caso, verifique se essa chave gerenciada pelo cliente no cofre de chaves também está no escopo de backup.",
            "guid": "676f6951-0368-49e9-808d-c33a692c9a64",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-2-encrypt-backup-data",
            "severity": "Média",
            "subcategory": "Cofre da Chave do Azure",
            "text": "Proteja seus dados de backup com criptografia e armazene chaves com segurança no Cofre de Chaves do Azure"
        },
        {
            "category": "BCDR",
            "description": "O Banco de Dados SQL do Azure usa a tecnologia do SQL Server para criar backups completos a cada semana, backup diferencial a cada 12 a 24 horas e backup de log de transações a cada 5 a 10 minutos. Por padrão, o Banco de dados SQL armazena dados em blobs de armazenamento com redundância geográfica que são replicados para uma região emparelhada.",
            "guid": "e2518261-b3bc-4bd1-b331-637fb2df833f",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-1-ensure-regular-automated-backups",
            "severity": "Média",
            "subcategory": "Backup",
            "text": "Configurar backups automatizados do Banco de Dados SQL do Azure"
        },
        {
            "category": "BCDR",
            "description": "Por padrão, o Banco de dados SQL armazena dados em blobs de armazenamento com redundância geográfica que são replicados para uma região emparelhada. Para o Banco de dados SQL, a redundância de armazenamento de backup pode ser configurada no momento da criação do banco de dados ou pode ser atualizada para um banco de dados existente; as alterações feitas em um banco de dados existente se aplicam somente a backups futuros.",
            "guid": "f8c7cda2-3ed7-43fb-a100-85dcd12a0ee4",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/automated-backups-overview?tabs=single-database&view=azuresql#backup-storage-redundancy",
            "severity": "Baixo",
            "subcategory": "Backup",
            "text": "Habilite o armazenamento de backup com redundância geográfica para proteger contra falhas em uma única região e perda de dados"
        },
        {
            "category": "Código",
            "description": "O código mal-intencionado pode potencialmente contornar os controles de segurança. Antes de implantar o código personalizado na produção, é essencial revisar o que está sendo implantado. Use uma ferramenta de banco de dados como o Azure Data Studio que dá suporte ao controle do código-fonte. Implementar ferramentas e lógica para análise de código, vulnerabilidade e verificação de credenciais.",
            "guid": "7ca9f006-d2a9-4652-951c-de8e4ac5e76e",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server",
            "severity": "Média",
            "subcategory": "Controle do código-fonte e revisão de código",
            "text": "Usar sistemas de Controle do Código-Fonte para armazenar, manter e revisar o código do aplicativo implantado no Banco de Dados SQLDB do Azure"
        },
        {
            "category": "Descoberta e classificação de dados",
            "description": "Em caso de requisitos de classificação, a Purview é a opção preferida. Use apenas a Descoberta e Classificação de Dados SQL caso o Purview não seja uma opção. Descubra colunas que potencialmente contêm dados confidenciais. O que é considerado dados confidenciais depende muito do cliente, da regulamentação de conformidade, etc., e precisa ser avaliado pelos usuários responsáveis por esses dados. Classifique as colunas para usar cenários avançados de auditoria e proteção baseados em sensibilidade. Revise os resultados da descoberta automatizada e finalize a classificação, se necessário.",
            "guid": "d401509b-2629-4484-9a7f-af0d29a7778f",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/data-discovery-and-classification-overview?view=azuresql#faq---advanced-classification-capabilities",
            "severity": "Baixo",
            "subcategory": "Descoberta e classificação de dados",
            "text": "Planejar e configurar a Descoberta e Classificação de Dados para proteger os dados confidenciais"
        },
        {
            "category": "Mascaramento de dados",
            "description": "O uso desse recurso é recomendado somente se a criptografia de coluna não for uma opção e houver um requisito específico para preservar tipos e formatos de dados. O mascaramento dinâmico de dados limita a exposição de dados confidenciais, mascarando-os para usuários não privilegiados. O mascaramento dinâmico de dados ajuda a impedir o acesso não autorizado a dados confidenciais, permitindo que os clientes designem a quantidade de dados confidenciais a serem revelados com impacto mínimo na camada de aplicativo.",
            "guid": "9391fd50-135e-453e-90a7-c1a23f88cc13",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/dynamic-data-masking-overview",
            "severity": "Baixo",
            "subcategory": "Mascaramento de dados",
            "text": "Use o mascaramento de dados para impedir o acesso não autorizado a dados de usuários não administradores se nenhuma criptografia for possível"
        },
        {
            "category": "Defensor",
            "description": "O SQL Advanced Threat Detection (ATP) fornece uma camada de segurança que detecta possíveis vulnerabilidades e atividades anômalas em bancos de dados, como ataques de injeção de SQL e padrões de comportamento incomuns. Quando uma ameaça potencial é detectada, a Detecção de Ameaças envia um alerta acionável em tempo real por email e no Microsoft Defender para Nuvem, que inclui etapas claras de investigação e correção para a ameaça específica.",
            "guid": "4e52d73f-5d37-428f-b3a2-e6997e835979",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure",
            "severity": "Alto",
            "subcategory": "Proteção Avançada contra Ameaças",
            "text": "Revise e conclua a configuração da Proteção Avançada contra Ameaças (ATP)"
        },
        {
            "category": "Defensor",
            "description": "Habilite o Microsoft Defender para SQL do Azure no nível de assinatura para integrar e proteger automaticamente todos os servidores e bancos de dados existentes e futuros. Quando você habilita no nível de assinatura, todos os bancos de dados no Banco de Dados SQL do Azure e na Instância Gerenciada SQL do Azure são protegidos. Você pode desativá-los individualmente, se desejar. Se você quiser gerenciar manualmente quais bancos de dados estão protegidos, desabilite no nível de assinatura e habilite cada banco de dados que deseja proteger.",
            "guid": "dff87489-9edb-4cef-bdda-86e8212b2aa1",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/azure-defender-for-sql?view=azuresql#enable-microsoft-defender-for-sql ",
            "severity": "Alto",
            "subcategory": "Defender para SQL do Azure",
            "text": "Habilitar o Microsoft Defender para SQL do Azure"
        },
        {
            "category": "Defensor",
            "description": "O Microsoft Defender para Azure SQL ATP detecta atividades anômalas que indicam tentativas incomuns e potencialmente prejudiciais de acessar ou explorar bancos de dados. Os alertas podem ser configurados e gerados e serão relatados no console do Defender for.",
            "guid": "ca342fdf-d25a-4427-b105-fcd50ff8a0ea",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure",
            "severity": "Alto",
            "subcategory": "Defender para SQL do Azure",
            "text": "Preparar um plano de resposta de segurança para reagir prontamente aos alertas SQL do Microsoft Defender para Azure"
        },
        {
            "category": "Defensor",
            "description": "A avaliação de vulnerabilidade do SQLDB do Azure é um serviço que fornece visibilidade do seu estado de segurança. A avaliação de vulnerabilidades inclui etapas acionáveis para resolver problemas de segurança e aprimorar a segurança do banco de dados. Ele pode ajudá-lo a monitorar um ambiente de banco de dados dinâmico onde as alterações são difíceis de controlar e melhorar sua postura de segurança SQL.",
            "guid": "a6101ae7-534c-45ab-86fd-b34c55ea21ca",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-overview",
            "severity": "Alto",
            "subcategory": "Avaliação de vulnerabilidade",
            "text": "Configurar descobertas de Avaliação de Vulnerabilidade (VA) e recomendações de revisão"
        },
        {
            "category": "Defensor",
            "description": "O Microsoft Defender para Nuvem fornece avaliação de vulnerabilidade para seus Bancos de Dados SQL do Azure. A avaliação de vulnerabilidades verifica seus bancos de dados em busca de vulnerabilidades de software e fornece uma lista de descobertas. Você pode usar as descobertas para corrigir vulnerabilidades de software e desabilitar as descobertas.",
            "guid": "c8c5f112-1e50-4f77-9264-8195b4cd61ac",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-find?view=azuresql",
            "severity": "Alto",
            "subcategory": "Avaliação de vulnerabilidade",
            "text": "Revisar regularmente as descobertas e recomendações da Avaliação de Vulnerabilidade (VA) e preparar um plano para corrigir"
        },
        {
            "category": "Encriptação",
            "description": "O Always Encrypted with Secure Enclaves expande os recursos de computação confidencial do Always Encrypted, permitindo criptografia in-loco e consultas confidenciais mais ricas. O Always Encrypted with Secure Enclaves aborda essas limitações, permitindo alguns cálculos em dados de texto sem formatação dentro de um enclave seguro no lado do servidor. O uso desse recurso é recomendado para os casos em que você precisa limitar o acesso de administrador e precisa que suas consultas ofereçam suporte a mais do que a correspondência de igualdade de colunas criptografadas.",
            "guid": "65d7e54a-10a6-4094-b673-9ff3809c9277",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/encryption/always-encrypted-enclaves",
            "severity": "Média",
            "subcategory": "Sempre criptografado",
            "text": "Se a proteção de dados PII confidenciais de usuários administradores for um requisito fundamental, mas as limitações da Criptografia de Coluna não puderem ser toleradas, considere a adoção do Always Encrypted with Secure Enclaves"
        },
        {
            "category": "Encriptação",
            "description": "Com o Banco de Dados SQL do Azure, você pode aplicar criptografia simétrica a uma coluna de dados usando Transact-SQL. Essa abordagem é chamada de criptografia de coluna, porque você pode usá-la para criptografar colunas específicas com chaves de criptografia diferentes. Isso oferece uma capacidade de criptografia mais granular do que o TDE, que criptografa dados em páginas. Usando Sempre Criptografado para garantir que dados confidenciais não sejam expostos em texto sem formatação no Banco de Dados SQL do Azure ou na Instância Gerenciada SQL, mesmo na memória/em uso. O Always Encrypted protege os dados de administradores de banco de dados (DBAs) e administradores de nuvem (ou agentes mal-intencionados que podem se passar por usuários com privilégios altos, mas não autorizados) e oferece mais controle sobre quem pode acessar seus dados.",
            "guid": "c03ce136-e3d5-4e17-bf25-ed955ee480d3",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#control-access-of-application-users-to-sensitive-data-through-encryption",
            "severity": "Baixo",
            "subcategory": "Criptografia de coluna",
            "text": "Para proteger dados confidenciais de PII de usuários não administradores em colunas de tabela específicas, considere o uso de Criptografia de Coluna"
        },
        {
            "category": "Encriptação",
            "description": "Habilitada por padrão, a TDE (Transparent Data Encryption, criptografia transparente de dados) ajuda a proteger os arquivos de banco de dados contra a divulgação de informações, executando criptografia e descriptografia em tempo real do banco de dados, backups associados e arquivos de log de transações 'em repouso', sem exigir alterações no aplicativo.",
            "guid": "c614ac47-bebf-4061-b0a1-43e0c6b5e00d",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server",
            "severity": "Alto",
            "subcategory": "Criptografia de dados transparente",
            "text": "Garantir que a Criptografia de Dados Transparente (TDE) seja mantida habilitada"
        },
        {
            "category": "Encriptação",
            "description": "Se for necessária a separação de funções no gerenciamento de chaves e dados dentro da organização, aproveite a CMK (Customer Managed Keys) para TDE (Transparent Data Encryption) para seu SQLDB do Azure e use o Cofre de Chaves do Azure para armazenar (consulte sua lista de verificação). Aproveite esse recurso quando você tiver requisitos de segurança rigorosos que não podem ser atendidos pelas chaves de serviço gerenciadas.",
            "guid": "2edb4165-4f54-47cc-a891-5c82c2f21e25",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-overview",
            "severity": "Média",
            "subcategory": "Criptografia de dados transparente",
            "text": "Use chaves gerenciadas pelo cliente (CMK) no Cofre de Chaves do Azure (AKV) se precisar de maior transparência e controle granular sobre a proteção TDE"
        },
        {
            "category": "Encriptação",
            "description": "A configuração de versão mínima de TLS (Transport Layer Security) permite que os clientes escolham qual versão do TLS seu banco de dados SQL usa. É possível alterar a versão mínima do TLS usando o portal do Azure, o Azure PowerShell e a CLI do Azure.",
            "guid": "7754b605-57fd-4bcb-8213-52c39d8e8225",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-settings?source=recommendations&view=azuresql&tabs=azure-portal#minimal-tls-version",
            "severity": "Alto",
            "subcategory": "Segurança da camada de transporte",
            "text": "Impor a versão mínima do TLS à versão mais recente disponível"
        },
        {
            "category": "Identidade",
            "description": "Use a autenticação do Azure Active Directory (Azure AD) para gerenciamento centralizado de identidades. Use a Autenticação SQL somente se realmente necessário e documente como exceções.",
            "guid": "c9b8b6bf-2c6b-453d-b400-de9a43a549d7",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-overview",
            "severity": "Média",
            "subcategory": "Azure Active Directory",
            "text": "Aproveitar a autenticação do Azure AD para conexões com os Bancos de Dados SQL do Azure"
        },
        {
            "category": "Identidade",
            "description": "O uso de grupos do Azure AD simplifica o gerenciamento de permissões e tanto o proprietário do grupo quanto o proprietário do recurso podem adicionar/remover membros de/para o grupo. Crie um grupo separado para administradores do Azure AD para cada servidor lógico. Monitore as alterações de associação de grupo do Azure AD usando os relatórios de atividade de auditoria do Azure AD.",
            "guid": "29820254-1d14-4778-ae90-ff4aeba504a3",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#central-management-for-identities",
            "severity": "Média",
            "subcategory": "Azure Active Directory",
            "text": "Criar um grupo separado do Azure AD com duas contas de administrador para cada servidor lógico do Banco de Dados SQL do Azure"
        },
        {
            "category": "Identidade",
            "description": "Verifique se identidades gerenciadas atribuídas ao sistema e ao usuário distintas, dedicadas à função, com menos permissões atribuídas, sejam usadas para comunicação de serviços e aplicativos do Azure com os bancos de dados SQLDB do Azure.",
            "guid": "df3a09ee-03bb-4198-8637-d141acf5f289",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#minimize-the-use-of-password-based-authentication-for-applications",
            "severity": "Média",
            "subcategory": "Azure Active Directory",
            "text": "Minimizar o uso de autenticação baseada em senha para aplicativos"
        },
        {
            "category": "Identidade",
            "description": "As identidades gerenciadas atribuídas pelo sistema ou pelo usuário permitem que o SQLDB do Azure se autentique em outros serviços de nuvem (por exemplo, Cofre da Chave do Azure) sem armazenar credenciais no código. Uma vez habilitadas, todas as permissões necessárias podem ser concedidas por meio do controle de acesso baseado em função do Azure para a instância SQLDB específica do Azure. Não compartilhe identidades gerenciadas atribuídas pelo usuário em vários serviços, se não for estritamente necessário.",
            "guid": "69891194-5074-4e30-8f69-4efc3c580900",
            "link": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview",
            "severity": "Baixo",
            "subcategory": "Identidades gerenciadas",
            "text": "Atribuir ao Banco de Dados SQL do Azure uma identidade gerenciada para acesso a recursos de saída"
        },
        {
            "category": "Identidade",
            "description": "Use uma autenticação integrada do Azure AD que elimina o uso de senhas. Os métodos de autenticação baseados em senha são uma forma mais fraca de autenticação. As credenciais podem ser comprometidas ou distribuídas por engano. Use a autenticação de logon único usando credenciais do Windows. Federar o domínio do AD local com o Azure AD e usar a autenticação integrada do Windows (para computadores ingressados no domínio com o Azure AD).",
            "guid": "88287d4a-8bb8-4640-ad78-03f51354d003",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-configure?view=azuresql&tabs=azure-powershell#active-directory-integrated-authentication",
            "severity": "Média",
            "subcategory": "Senhas",
            "text": "Minimizar o uso de autenticação baseada em senha para usuários"
        },
        {
            "category": "Livro-razão",
            "description": "O hash do bloco mais recente no livro-razão do banco de dados é chamado de resumo do banco de dados. Ele representa o estado de todas as tabelas contábeis no banco de dados no momento em que o bloco foi gerado. Gerar um resumo de banco de dados é eficiente, porque envolve o cálculo apenas dos hashes dos blocos que foram anexados recentemente. O Razão Confidencial do Azure é um dos armazenamentos com suporte, pode ser usado e dá suporte à geração e ao armazenamento automáticos de resumos de banco de dados. O Azure Ledger fornece recursos de segurança avançados, como a Prova de Livro-Razão Blockchain e Enclaves de Hardware Confidenciais. Use-o somente se recursos de segurança avançados forem necessários, caso contrário, reverta para o armazenamento do Azure.",
            "guid": "0e853380-50ba-4bce-b2fd-5c7391c85ecc",
            "link": "https://learn.microsoft.com/azure/architecture/guide/technology-choices/multiparty-computing-service#confidential-ledger-and-azure-blob-storage",
            "severity": "Média",
            "subcategory": "Resumo do banco de dados",
            "text": "Usar o Razão Confidencial do Azure para armazenar resumos de banco de dados somente se recursos de segurança avançados forem necessários"
        },
        {
            "category": "Livro-razão",
            "description": "O hash do bloco mais recente no livro-razão do banco de dados é chamado de resumo do banco de dados. Ele representa o estado de todas as tabelas contábeis no banco de dados no momento em que o bloco foi gerado. Gerar um resumo de banco de dados é eficiente, porque envolve o cálculo apenas dos hashes dos blocos que foram anexados recentemente. O recurso Armazenamento de Blobs do Azure com Armazenamento Imutável pode ser usado e dá suporte à geração e ao armazenamento automáticos de resumos de banco de dados. Para evitar a violação de seus arquivos de resumo, configure e bloqueie uma política de retenção para seu contêiner.",
            "guid": "afefb2d3-95da-4ac9-acf5-33d18b32ef9a",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-digest-management",
            "severity": "Média",
            "subcategory": "Resumo do banco de dados",
            "text": "Se a conta de armazenamento do Azure for usada para armazenar resumos de banco de dados, verifique se a segurança está configurada corretamente"
        },
        {
            "category": "Livro-razão",
            "description": "O Ledger fornece uma forma de integridade de dados chamada integridade direta, que fornece evidências de adulteração de dados em dados em suas tabelas contábeis. O processo de verificação do banco de dados leva como entrada um ou mais resumos de banco de dados gerados anteriormente. Em seguida, ele recalcula os hashes armazenados no livro-razão do banco de dados com base no estado atual das tabelas contábeis. Se os hashes computados não corresponderem aos resumos de entrada, a verificação falhará. A falha indica que os dados foram adulterados. O processo de verificação relata todas as inconsistências que detecta.",
            "guid": "f8d4ffda-8aac-4cc6-b72b-c81cb8625420",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-database-verification",
            "severity": "Média",
            "subcategory": "Integridade",
            "text": "Agende o processo de verificação do Ledger regularmente para verificar a integridade dos dados"
        },
        {
            "category": "Livro-razão",
            "description": "O recurso Ledger fornece recursos de evidência de violação em seu banco de dados. Você pode atestar criptograficamente a outras partes, como auditores ou outras partes comerciais, que seus dados não foram adulterados. O Ledger ajuda a proteger os dados de qualquer invasor ou usuário com alto privilégio, incluindo administradores de banco de dados (DBAs), administradores de sistema e administradores de nuvem.",
            "guid": "2563f498-e2d3-42ea-9e7b-5517881a06a2",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-overview",
            "severity": "Média",
            "subcategory": "Livro-razão",
            "text": "Se a prova criptográfica da integridade dos dados for um requisito crítico, o recurso Ledger deve ser considerado"
        },
        {
            "category": "Livro-razão",
            "description": "Dependendo do tipo de adulteração, há casos em que você pode reparar o livro-razão sem perder dados. No artigo contido na coluna --Mais informações-, diferentes cenários e técnicas de recuperação são descritos.",
            "guid": "804fc554-6554-4842-91c1-713b32f99902",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-how-to-recover-after-tampering",
            "severity": "Média",
            "subcategory": "Recuperação",
            "text": "Preparar um plano de resposta para investigar e reparar um banco de dados após um evento de violação"
        },
        {
            "category": "Log",
            "description": "A Auditoria do Banco de Dados SQL do Azure rastreia eventos de banco de dados e os grava em um log de auditoria em sua conta de armazenamento do Azure. A auditoria ajuda você a entender a atividade do banco de dados e a obter informações sobre discrepâncias e anomalias que podem indicar preocupações comerciais ou suspeitas de violações de segurança, além de ajudá-lo a atender à conformidade normativa. Por padrão, a diretiva de auditoria inclui todas as ações (consultas, procedimentos armazenados e logons bem-sucedidos e com falha) nos bancos de dados, o que pode resultar em alto volume de logs de auditoria. É recomendável que os clientes configurem a auditoria para diferentes tipos de ações e grupos de ações usando o PowerShell.",
            "guid": "4082e31d-35f4-4a49-8507-d3172cc930a6",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
            "severity": "Média",
            "subcategory": "Auditoria",
            "text": "Verifique se a Auditoria do Banco de Dados SQL do Azure está habilitada no nível do servidor"
        },
        {
            "category": "Log",
            "description": "Os logs de Auditoria do Banco de Dados SQL do Azure podem ser gravados em contas de armazenamento externas, no espaço de trabalho do Log Analytics ou no Hub de Eventos. Certifique-se de proteger o repositório de destino usando backups e configuração segura. Use a Identidade Gerenciada do Banco de Dados SQL do Azure para acessar o armazenamento e definir um período de retenção explícito. Não conceda permissões aos administradores para o repositório de log de auditoria. Use um armazenamento de destino diferente para --Habilitando a auditoria das operações de suporte da Microsoft--. ",
            "guid": "9b64bc50-b60f-4035-bf7a-28c4806dfb46",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
            "severity": "Baixo",
            "subcategory": "Auditoria",
            "text": "Verifique se os logs de Auditoria do Banco de Dados SQL do Azure são copiados e protegidos no tipo de repositório selecionado"
        },
        {
            "category": "Log",
            "description": "O log de atividades do Azure Monitor é um log de plataforma no Azure que fornece informações sobre eventos de nível de assinatura. O registro de atividades inclui informações como quando um recurso é modificado. É recomendável enviar esse log de atividades para o mesmo repositório de armazenamento externo que o Log de Auditoria do Banco de Dados SQL do Azure (conta de armazenamento, espaço de trabalho Análise de Log, Hub de Eventos).",
            "guid": "fcd34708-87ac-4efc-aaf6-57a47f76644a",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
            "severity": "Média",
            "subcategory": "Auditoria",
            "text": "Verifique se o Log de Atividades do Banco de Dados SQL do Azure é coletado e integrado aos logs de Auditoria"
        },
        {
            "category": "Log",
            "description": "Encaminhe todos os logs do SQL do Azure para o SIEM (Gerenciamento de Informações e Eventos de Segurança) e SOAR (Automação e Resposta de Orquestração de Segurança). Verifique se você está monitorando diferentes tipos de ativos do Azure em busca de possíveis ameaças e anomalias. Concentre-se em receber alertas de alta qualidade para reduzir os falsos positivos para os analistas classificarem. Os alertas podem ser obtidos a partir de dados de log, agentes ou outros dados.",
            "guid": "f96e127e-9572-453a-b325-ff89ae9f6b44",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
            "severity": "Média",
            "subcategory": "SIEM/SOAR",
            "text": "Verifique se os logs de Auditoria do Banco de Dados SQL do Azure estão sendo apresentados no SIEM/SOAR de suas organizações"
        },
        {
            "category": "Log",
            "description": "Encaminhe todos os logs do SQL do Azure para o SIEM (Gerenciamento de Informações e Eventos de Segurança) e SOAR (Automação e Resposta de Orquestração de Segurança), que podem ser usados para configurar detecções de ameaças personalizadas. Verifique se você está monitorando diferentes tipos de ativos do Azure em busca de possíveis ameaças e anomalias. Concentre-se em receber alertas de alta qualidade para reduzir os falsos positivos para os analistas classificarem. Os alertas podem ser obtidos a partir de dados de log, agentes ou outros dados.",
            "guid": "41503bf8-73da-4a10-af9f-5f7fceb5456f",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
            "severity": "Média",
            "subcategory": "SIEM/SOAR",
            "text": "Verifique se os dados do Log de Atividades do Banco de Dados SQL do Azure são apresentados em seu SIEM/SOAR"
        },
        {
            "category": "Log",
            "description": "A equipe do Centro de Operações de Segurança (SOC) deve criar um plano de resposta a incidentes (manuais ou respostas manuais) para investigar e mitigar adulterações, atividades maliciosas e outros comportamentos anômalos.",
            "guid": "19ec7c97-c563-4e1d-82f0-54d6ec12e754",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
            "severity": "Média",
            "subcategory": "SIEM/SOAR",
            "text": "Verifique se você tem planos de resposta para eventos de log de auditoria mal-intencionados ou aberrantes"
        },
        {
            "category": "Rede",
            "description": "Quando você cria um servidor lógico a partir do portal do Azure para o Banco de Dados SQL do Azure, o resultado é um ponto de extremidade público que é visível e acessível pela rede pública (Acesso Público). Em seguida, você pode limitar a conectividade com base nas regras de firewall e no Ponto de Extremidade de Serviço. Você também pode configurar a conectividade privada limitando apenas as conexões a redes internas usando o Ponto de Extremidade Privado (Acesso Privado). O Acesso Privado usando o Ponto de Extremidade Privado deve ser o padrão, a menos que se aplique um caso de negócios ou um motivo de desempenho/técnico que não possa suportá-lo. O uso de pontos de extremidade privados tem implicações de desempenho que precisam ser consideradas e avaliadas.",
            "guid": "2c6d356a-1784-475b-a42c-ec187dc8c925",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview",
            "severity": "Alto",
            "subcategory": "Conectividade",
            "text": "Revise os métodos de conectividade de Acesso Público versus Privado e selecione o apropriado para a carga de trabalho"
        },
        {
            "category": "Rede",
            "description": "IMPORTANTE: As conexões com o ponto de extremidade privado oferecem suporte apenas ao Proxy como a política de conexão. Ao usar pontos de extremidade privados, as conexões são intermediadas por proxy por meio do gateway do Banco de Dados SQL do Azure para os nós do banco de dados. Os clientes não terão uma conexão direta.",
            "guid": "557b3ce5-bada-4296-8d52-a2d447bc1718",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-architecture",
            "severity": "Baixo",
            "subcategory": "Conectividade",
            "text": "Manter a Política de Conexão do Banco de Dados SQL do Azure padrão se não for exigida e justificada de forma diferente"
        },
        {
            "category": "Rede",
            "description": "Essa opção configura o firewall para permitir todas as conexões do Azure, incluindo conexões das assinaturas de outros clientes. Se você selecionar essa opção, verifique se as permissões de login e de usuário limitam o acesso somente a usuários autorizados. Se não for estritamente necessário, mantenha essa configuração como OFF.",
            "guid": "f48efacf-4405-4e8d-9dd0-16c5302ed082",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview",
            "severity": "Alto",
            "subcategory": "Conectividade",
            "text": "Verifique se a configuração Permitir que os Serviços e Recursos do Azure acessem este Servidor está desabilitada no firewall do Banco de Dados SQL do Azure"
        },
        {
            "category": "Rede",
            "description": "O Banco de Dados SQL do Azure tem um novo recurso interno que permite a integração nativa com pontos de extremidade REST externos. Isso significa que a integração do Banco de Dados SQL do Azure com o Azure Functions, os Aplicativos Lógicos do Azure, os Serviços Cognitivos, os Hubs de Eventos, a Grade de Eventos, os Contêineres do Azure, o Gerenciamento de API e, em geral, qualquer ponto de extremidade REST ou mesmo GraphQL. Se não for restringido corretamente, o código dentro de um banco de dados do Banco de Dados SQL do Azure poderá aproveitar esse mecanismo para exfiltrar dados. Se não for estritamente necessário, recomenda-se bloquear ou restringir esse recurso usando as Regras de Firewall de Saída.",
            "guid": "cb3274a7-e36d-46f6-8de5-46d30c8dde8e",
            "link": "https://learn.microsoft.com/sql/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql",
            "severity": "Média",
            "subcategory": "Controle de saída",
            "text": "Bloquear ou restringir chamadas de API REST de saída para pontos de extremidade externos"
        },
        {
            "category": "Rede",
            "description": "As regras de firewall de saída limitam o tráfego de rede do servidor lógico do Banco de Dados SQL do Azure a uma lista definida pelo cliente de contas de Armazenamento do Azure e servidores lógicos do Banco de Dados SQL do Azure. Qualquer tentativa de acessar contas de armazenamento ou bancos de dados que não estejam nessa lista é negada.",
            "guid": "a566dd3d-314e-4a94-9378-102c42d82b38",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/outbound-firewall-rule-overview",
            "severity": "Média",
            "subcategory": "Controle de saída",
            "text": "Se o acesso à rede de saída for necessário, é recomendável configurar restrições de rede de saída usando o recurso de controle interno do Banco de Dados SQL do Azure"
        },
        {
            "category": "Rede",
            "description": "O Ponto de Extremidade Privado é criado dentro de uma sub-rede em uma Rede Virtual do Azure. A configuração de segurança adequada deve ser aplicada também ao ambiente de rede que o contém, incluindo NSG/ASG, UDR, firewall, monitoramento e auditoria.",
            "guid": "246cd832-f550-4af0-9c74-ca9baeeb8860",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server",
            "severity": "Média",
            "subcategory": "Acesso Privado",
            "text": "Se a conectividade de Acesso Privado for usada, verifique se você está usando as listas de verificação Ponto de Extremidade Privado, Rede Virtual do Azure, Firewall do Azure e Grupo de Segurança de Rede do Azure"
        },
        {
            "category": "Rede",
            "description": "Ao adicionar uma conexão de Ponto de Extremidade Privado, o roteamento público para o servidor lógico não é bloqueado por padrão. No painel --Firewall e redes virtuais-- , a configuração --Negar acesso à rede pública-- não está selecionada por padrão. Para desabilitar o acesso à rede pública, certifique-se de selecionar --Negar acesso à rede pública--.",
            "guid": "3a0808ee-ea7a-47ab-bdce-920a6a2b3881",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server",
            "severity": "Alto",
            "subcategory": "Acesso Privado",
            "text": "Se o Ponto de Extremidade Privado (Acesso Privado) for usado, considere desabilitar a conectividade do Acesso Público"
        },
        {
            "category": "Rede",
            "description": "O NSG (Grupo de Segurança de Rede) e o ASG (Grupo de Segurança de Aplicativo) agora podem ser aplicados à sub-rede que contém Pontos de Extremidade Privados para restringir as conexões com o SQLDB do Azure com base em intervalos de IP de origem interna.",
            "guid": "8600527e-e8c4-4424-90ef-1f0dca0224f2",
            "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview#network-security-of-private-endpoints",
            "severity": "Média",
            "subcategory": "Acesso Privado",
            "text": "Se o Ponto de Extremidade Privado (Acesso Privado) for usado, aplique o NSG e, eventualmente, o ASG para limitar os intervalos de endereços IP de origem de entrada"
        },
        {
            "category": "Rede",
            "description": "Uma Instância Gerenciada (SQL MI) pode ser isolada dentro de uma rede virtual para impedir o acesso externo. Aplicativos e ferramentas que estão na mesma rede virtual ou emparelhada na mesma região podem acessá-la diretamente. Aplicativos e ferramentas que estão em regiões diferentes podem usar a conexão de rede virtual para rede virtual ou o emparelhamento de circuitos da Rota Expressa para estabelecer a conexão. O cliente deve usar NSG (Network Security Groups) e, eventualmente, firewalls internos, para restringir o acesso pela porta 1433 apenas a recursos que exijam acesso a uma instância gerenciada.",
            "guid": "18123ef4-a0a6-45e3-87fe-7f454f65d975",
            "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/connectivity-architecture-overview",
            "severity": "Média",
            "subcategory": "Acesso Privado",
            "text": "Aplicar NSG (Grupos de Segurança de Rede) e regras de firewall para restringir o acesso à sub-rede interna da Instância Gerenciada SQL do Azure"
        },
        {
            "category": "Rede",
            "description": "O Ponto de Extremidade do Serviço de Rede Virtual do Azure é a solução preferida se você quiser estabelecer uma conexão direta com os nós de back-end do Banco de Dados SQL do Azure usando a política de Redireccionamento. Isso permitirá o acesso no modo de alto desempenho e é a abordagem recomendada do ponto de vista do desempenho.",
            "guid": "55187443-6852-4fbd-99c6-ce303597ca7f",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview?view=azuresql#ip-vs-virtual-network-firewall-rules",
            "severity": "Alto",
            "subcategory": "Acesso Público",
            "text": "Se a conectividade de Acesso Público for usada, aproveite o Ponto de Extremidade de Serviço para restringir o acesso de Redes Virtuais do Azure selecionadas"
        },
        {
            "category": "Rede",
            "description": "O firewall do Banco de Dados SQL do Azure permite que você especifique intervalos de endereços IP dos quais as comunicações são aceitas. Essa abordagem é adequada para endereços IP estáveis que estão fora da rede privada do Azure.",
            "guid": "a73e32da-b3f4-4960-b5ec-2f42a557bf31",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview",
            "severity": "Média",
            "subcategory": "Acesso Público",
            "text": "Se a conectividade de Acesso Público for usada, verifique se apenas IPs conhecidos específicos são adicionados ao firewall"
        },
        {
            "category": "Rede",
            "description": "Recomendamos que você use regras de firewall IP no nível do banco de dados sempre que possível. Essa prática aumenta a segurança e torna seu banco de dados mais portátil. Use regras de firewall IP no nível do servidor para administradores. Use-os também quando tiver muitos bancos de dados com os mesmos requisitos de acesso e não quiser configurar cada banco de dados individualmente.",
            "guid": "e0f31ac9-35c8-4bfd-9865-edb60ffc6768",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/firewall-configure",
            "severity": "Baixo",
            "subcategory": "Acesso Público",
            "text": "Se a conectividade do Acesso Público for usada e controlada pelas regras de firewall do Banco de Dados SQL do Azure, use regras IP no nível do banco de dados sobre as regras IP no nível do servidor"
        },
        {
            "category": "Rede",
            "description": "Uma Instância Gerenciada (SQL MI) pode ser isolada dentro de uma rede virtual para impedir o acesso externo. O ponto de extremidade público da Instância Gerenciada não está habilitado por padrão, deve ser explicitamente habilitado, somente se estritamente necessário. Se a política da empresa não permitir o uso de pontos de extremidade públicos, use a Política do Azure para impedir a habilitação de pontos de extremidade públicos em primeiro lugar.",
            "guid": "b8435656-143e-41a8-9922-61d34edb751a",
            "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview",
            "severity": "Alto",
            "subcategory": "Acesso Público",
            "text": "Não habilitar o ponto de extremidade público da Instância Gerenciada SQL do Azure"
        },
        {
            "category": "Rede",
            "description": "Um ponto de extremidade público de Instância Gerenciada (SQL MI) não está habilitado por padrão, deve ser explicitamente habilitado, somente se estritamente necessário. Nesse caso, recomenda-se aplicar um NSG (Network Security Groups) para restringir o acesso à porta 3342 somente a endereços IP de origem confiáveis.",
            "guid": "057dd298-8726-4aa6-b590-1f81d2e30421",
            "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview",
            "severity": "Alto",
            "subcategory": "Acesso Público",
            "text": "Restringir o acesso se o ponto de extremidade público da Instância Gerenciada SQL do Azure for necessário"
        },
        {
            "category": "Acesso privilegiado",
            "description": "A maioria das operações, suporte e solução de problemas executados pelo pessoal e subprocessadores da Microsoft não requer acesso aos dados do cliente. Nas raras circunstâncias em que esse acesso é necessário, o Customer Lockbox para Microsoft Azure fornece uma interface para que os clientes analisem e aprovem ou rejeitem solicitações de acesso a dados de clientes.  Em cenários de suporte em que a Microsoft precisa acessar dados do cliente, o Banco de Dados SQL do Azure dá suporte ao Customer Lockbox para fornecer uma interface para que você revise e aprove ou rejeite solicitações de acesso a dados do cliente.",
            "guid": "37b6eb0f-553d-488f-8a8a-cb9bf97388ff",
            "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
            "severity": "Baixo",
            "subcategory": "Cofre",
            "text": "Revisar e habilitar o acesso do Customer Lockbox para o Banco de Dados SQL do Azure pelo pessoal da Microsoft"
        },
        {
            "category": "Acesso privilegiado",
            "description": "O princípio do privilégio mínimo afirma que os usuários não devem ter mais privilégios do que o necessário para concluir suas tarefas. Os usuários de banco de dados e servidor com alto privilégio podem executar muitas atividades de configuração e manutenção no banco de dados e também podem descartar bancos de dados na instância SQL do Azure. Rastrear proprietários de bancos de dados e contas privilegiadas é importante para evitar ter permissão excessiva.",
            "guid": "5fe5281f-f0f9-4842-a682-8baf18bd8316",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#implement-principle-of-least-privilege",
            "severity": "Média",
            "subcategory": "Permissões",
            "text": "Certifique-se de que os usuários recebam o nível mínimo de acesso necessário para concluir suas funções de trabalho"
        },
        {
            "category": "Acesso privilegiado",
            "description": "As identidades (Usuários e SPNs) devem ter o escopo da menor quantidade de acesso necessária para executar a função.  Um número maior de SPNs com escopo restrito deve ser usado, em vez de ter um SPN com vários conjuntos de permissões não relacionadas. Por exemplo, se houver três aplicativos Web externos hospedados no local que fazem consultas ao Banco de Dados SQL do Azure, nem todos eles devem usar o mesmo SPN para essas atividades.  Em vez disso, cada um deles deve ter seu próprio SPN de escopo rígido.",
            "guid": "7b5b55e5-4750-4920-be97-eb726c256a5c",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#im-3-use-azure-ad-single-sign-on-sso-for-application-access",
            "severity": "Baixo",
            "subcategory": "Permissões",
            "text": "Verifique se aplicativos distintos receberão credenciais diferentes com permissões mínimas para acessar o Banco de Dados SQL do Azure"
        }
    ],
    "metadata": {
        "name": "Azure SQLDB Security Checklist (Preview)"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Média"
        },
        {
            "name": "Baixo"
        }
    ],
    "status": [
        {
            "description": "Esta verificação ainda não foi analisada",
            "name": "Não verificado"
        },
        {
            "description": "Há um item de ação associado a essa verificação",
            "name": "Abrir"
        },
        {
            "description": "Essa verificação foi verificada e não há mais itens de ação associados a ela",
            "name": "Cumprido"
        },
        {
            "description": "Recomendação entendida, mas não necessária pelos requisitos atuais",
            "name": "Não é necessário"
        },
        {
            "description": "Não aplicável ao projeto atual",
            "name": "N/A"
        }
    ]
}
checklists/sqldb_security_checklist.ko.json METASEP
{
    "$schema": "checklist.schema.json",
    "categories": [
        {
            "name": "증권 시세 표시기"
        },
        {
            "name": "방어자"
        },
        {
            "name": "암호화"
        },
        {
            "name": "신원"
        },
        {
            "name": "권한 있는 액세스"
        },
        {
            "name": "원장"
        },
        {
            "name": "로깅"
        },
        {
            "name": "네트워킹"
        },
        {
            "name": "데이터 검색 및 분류"
        },
        {
            "name": "데이터 마스킹"
        },
        {
            "name": "코드"
        }
    ],
    "items": [
        {
            "category": "증권 시세 표시기",
            "description": "백업이 공격으로부터 보호되는지 확인합니다. 여기에는 기밀성 손실을 방지하기 위한 백업 암호화가 포함되어야 합니다. 정기적인 Azure 서비스 백업의 경우 백업 데이터는 Azure 플랫폼 관리형 키를 사용하여 자동으로 암호화됩니다. 고객 관리형 키를 사용하여 백업을 암호화하도록 선택할 수도 있습니다. 이 경우 키 자격 증명 모음의 이 고객 관리형 키도 백업 범위에 있는지 확인합니다.",
            "guid": "676f6951-0368-49e9-808d-c33a692c9a64",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-2-encrypt-backup-data",
            "severity": "보통",
            "subcategory": "Azure Key Vault",
            "text": "암호화를 사용하여 백업 데이터를 보호하고 Azure 키 자격 증명 모음에 안전하게 키를 저장합니다."
        },
        {
            "category": "증권 시세 표시기",
            "description": "Azure SQL 데이터베이스는 SQL Server 기술을 사용하여 매주 전체 백업, 12-24시간마다 차등 백업 및 5-10분마다 트랜잭션 로그 백업을 만듭니다. 기본적으로 SQL 데이터베이스는 쌍을 이루는 지역에 복제되는 지역 중복 저장소 Blob에 데이터를 저장합니다.",
            "guid": "e2518261-b3bc-4bd1-b331-637fb2df833f",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-1-ensure-regular-automated-backups",
            "severity": "보통",
            "subcategory": "백업",
            "text": "Azure SQL 데이터베이스 자동 백업 구성"
        },
        {
            "category": "증권 시세 표시기",
            "description": "기본적으로 SQL 데이터베이스는 쌍을 이루는 지역에 복제되는 지역 중복 저장소 Blob에 데이터를 저장합니다. SQL Database의 경우 데이터베이스를 만들 때 백업 저장소 중복성을 구성하거나 기존 데이터베이스에 대해 업데이트할 수 있습니다. 기존 데이터베이스에 대한 변경 내용은 이후 백업에만 적용됩니다.",
            "guid": "f8c7cda2-3ed7-43fb-a100-85dcd12a0ee4",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/automated-backups-overview?tabs=single-database&view=azuresql#backup-storage-redundancy",
            "severity": "낮다",
            "subcategory": "백업",
            "text": "지역 중복 백업 스토리지를 사용하도록 설정하여 단일 지역 오류 및 데이터 손실로부터 보호"
        },
        {
            "category": "코드",
            "description": "악성 코드는 잠재적으로 보안 제어를 우회할 수 있습니다. 사용자 지정 코드를 프로덕션에 배포하기 전에 배포 중인 코드를 검토하는 것이 중요합니다. 소스 제어를 지원하는 Azure 데이터 스튜디오와 같은 데이터베이스 도구를 사용합니다. 코드 분석, 취약성 및 자격 증명 검사를 위한 도구와 논리를 구현합니다.",
            "guid": "7ca9f006-d2a9-4652-951c-de8e4ac5e76e",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server",
            "severity": "보통",
            "subcategory": "소스 제어 및 코드 검토",
            "text": "소스 제어 시스템을 사용하여 Azure SQLDB 데이터베이스 내에 배포된 애플리케이션 코드를 저장, 유지 관리 및 검토합니다."
        },
        {
            "category": "데이터 검색 및 분류",
            "description": "분류 요구 사항의 경우 Purview가 선호되는 옵션입니다. Purview가 옵션이 아닌 경우에만 SQL 데이터 검색 및 분류를 사용합니다. 중요한 데이터가 포함될 가능성이 있는 열을 검색합니다. 민감한 데이터로 간주되는 것은 고객, 규정 준수 규정 등에 따라 크게 달라지며 해당 데이터를 담당하는 사용자가 평가해야 합니다. 열을 분류하여 고급 민감도 기반 감사 및 보호 시나리오를 사용합니다. 자동화된 검색 결과를 검토하고 필요한 경우 분류를 완료합니다.",
            "guid": "d401509b-2629-4484-9a7f-af0d29a7778f",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/data-discovery-and-classification-overview?view=azuresql#faq---advanced-classification-capabilities",
            "severity": "낮다",
            "subcategory": "데이터 검색 및 분류",
            "text": "중요한 데이터를 보호하기 위한 데이터 검색 및 분류 계획 및 구성"
        },
        {
            "category": "데이터 마스킹",
            "description": "이 기능은 열 암호화가 옵션이 아니며 데이터 형식 및 형식을 보존해야 하는 특정 요구 사항이 있는 경우에만 사용하는 것이 좋습니다. 동적 데이터 마스킹은 권한이 없는 사용자에게 마스킹하여 중요한 데이터 노출을 제한합니다. 동적 데이터 마스킹은 고객이 애플리케이션 계층에 미치는 영향을 최소화하면서 표시할 중요한 데이터의 양을 지정할 수 있도록 하여 중요한 데이터에 대한 무단 액세스를 방지하는 데 도움이 됩니다.",
            "guid": "9391fd50-135e-453e-90a7-c1a23f88cc13",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/dynamic-data-masking-overview",
            "severity": "낮다",
            "subcategory": "데이터 마스킹",
            "text": "데이터 마스킹을 사용하여 암호화가 불가능한 경우 관리자가 아닌 무단 사용자의 데이터 액세스 방지"
        },
        {
            "category": "방어자",
            "description": "SQL ATP(고급 위협 감지)는 SQL 삽입 공격 및 비정상적인 동작 패턴과 같은 데이터베이스에서 잠재적인 취약성 및 비정상적인 활동을 검색하는 보안 계층을 제공합니다. 잠재적 위협이 감지되면 위협 감지는 특정 위협에 대한 명확한 조사 및 수정 단계를 포함하는 전자 메일 및 클라우드용 Microsoft Defender에서 실행 가능한 실시간 경고를 보냅니다.",
            "guid": "4e52d73f-5d37-428f-b3a2-e6997e835979",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure",
            "severity": "높다",
            "subcategory": "지능형 위협 보호",
            "text": "ATP(고급 위협 보호) 구성 검토 및 완료"
        },
        {
            "category": "방어자",
            "description": "구독 수준에서 Azure SQL용 Microsoft Defender를 사용하도록 설정하여 기존 및 미래의 모든 서버와 데이터베이스를 자동으로 온보딩하고 보호합니다. 구독 수준에서 사용하도록 설정하면 Azure SQL 데이터베이스 및 Azure SQL 관리되는 인스턴스의 모든 데이터베이스가 보호됩니다. 그런 다음 원하는 경우 개별적으로 비활성화할 수 있습니다. 보호되는 데이터베이스를 수동으로 관리하려면 구독 수준에서 사용하지 않도록 설정하고 보호할 각 데이터베이스를 사용하도록 설정합니다.",
            "guid": "dff87489-9edb-4cef-bdda-86e8212b2aa1",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/azure-defender-for-sql?view=azuresql#enable-microsoft-defender-for-sql ",
            "severity": "높다",
            "subcategory": "Defender for Azure SQL",
            "text": "Enable Microsoft Defender for Azure SQL"
        },
        {
            "category": "방어자",
            "description": "Azure SQL ATP용 Microsoft Defender는 데이터베이스에 액세스하거나 악용하려는 비정상적이고 잠재적으로 유해한 시도를 나타내는 비정상적인 활동을 검색합니다. 경고를 구성하고 생성할 수 있으며 콘솔용 Defender에 보고됩니다.",
            "guid": "ca342fdf-d25a-4427-b105-fcd50ff8a0ea",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure",
            "severity": "높다",
            "subcategory": "Defender for Azure SQL",
            "text": "Azure SQL 경고에 대한 Microsoft Defender에 즉시 대응하기 위한 보안 대응 계획 준비"
        },
        {
            "category": "방어자",
            "description": "Azure SQLDB 취약성 평가는 보안 상태에 대한 가시성을 제공하는 서비스입니다. 취약성 평가에는 보안 문제를 해결하고 데이터베이스 보안을 강화하기 위한 실행 가능한 단계가 포함됩니다. 변경 사항을 추적하기 어려운 동적 데이터베이스 환경을 모니터링하고 SQL 보안 상태를 개선하는 데 도움이 될 수 있습니다.",
            "guid": "a6101ae7-534c-45ab-86fd-b34c55ea21ca",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-overview",
            "severity": "높다",
            "subcategory": "취약성 평가",
            "text": "취약성 평가(VA) 결과 구성 및 권장 사항 검토"
        },
        {
            "category": "방어자",
            "description": "Microsoft Defender for Cloud는 Azure SQL Database에 대한 취약성 평가를 제공합니다. 취약성 평가는 데이터베이스에서 소프트웨어 취약성을 검색하고 결과 목록을 제공합니다. 결과를 사용하여 소프트웨어 취약성을 수정하고 결과를 사용하지 않도록 설정할 수 있습니다.",
            "guid": "c8c5f112-1e50-4f77-9264-8195b4cd61ac",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-find?view=azuresql",
            "severity": "높다",
            "subcategory": "취약성 평가",
            "text": "취약성 평가(VA) 결과 및 권장 사항을 정기적으로 검토하고 수정 계획을 준비합니다."
        },
        {
            "category": "암호화",
            "description": "보안 엔클레이브를 사용한 상시 암호화는 현재 위치 암호화 및 보다 풍부한 기밀 쿼리를 활성화하여 상시 암호화의 기밀 컴퓨팅 기능을 확장합니다. 보안 엔클레이브로 항상 암호화는 서버 측의 보안 엔클레이브 내에서 일반 텍스트 데이터에 대한 일부 계산을 허용하여 이러한 제한 사항을 해결합니다. 이 기능은 관리자 액세스를 제한해야 하고 쿼리가 암호화된 열의 동일성 일치 이상을 지원해야 하는 경우에 사용하는 것이 좋습니다.",
            "guid": "65d7e54a-10a6-4094-b673-9ff3809c9277",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/encryption/always-encrypted-enclaves",
            "severity": "보통",
            "subcategory": "상시 암호화",
            "text": "관리자로부터 중요한 PII 데이터를 보호하는 것이 핵심 요구 사항이지만 열 암호화 제한을 허용할 수 없는 경우 보안 엔클레이브를 사용하여 상시 암호화 채택을 고려하십시오."
        },
        {
            "category": "암호화",
            "description": "Azure SQL 데이터베이스에서는 Transact-SQL을 사용하여 데이터 열에 대칭 암호화를 적용할 수 있습니다. 이 방법을 열 암호화라고 하는데, 이는 서로 다른 암호화 키를 사용하여 특정 열을 암호화하는 데 사용할 수 있기 때문입니다. 이렇게 하면 페이지의 데이터를 암호화하는 TDE보다 더 세분화된 암호화 기능이 제공됩니다. 상시 암호화를 사용하여 메모리/사용 중인 경우에도 Azure SQL 데이터베이스 또는 SQL 관리되는 인스턴스에서 중요한 데이터가 일반 텍스트로 노출되지 않도록 합니다. 상시 암호화는 DBA(데이터베이스 관리자) 및 클라우드 관리자(또는 권한이 높지만 권한이 없는 사용자를 가장할 수 있는 악의적인 행위자)로부터 데이터를 보호하고 데이터에 액세스할 수 있는 사용자를 더 잘 제어할 수 있도록 합니다.",
            "guid": "c03ce136-e3d5-4e17-bf25-ed955ee480d3",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#control-access-of-application-users-to-sensitive-data-through-encryption",
            "severity": "낮다",
            "subcategory": "열 암호화",
            "text": "특정 테이블 열에서 관리자가 아닌 사용자로부터 중요한 PII 데이터를 보호하려면 열 암호화를 사용하는 것이 좋습니다."
        },
        {
            "category": "암호화",
            "description": "기본적으로 사용하도록 설정된 TDE(투명한 데이터 암호화)는 응용 프로그램을 변경할 필요 없이 데이터베이스, 연결된 백업 및 '미사용 상태' 트랜잭션 로그 파일의 실시간 암호화 및 암호 해독을 수행하여 정보 유출로부터 데이터베이스 파일을 보호하는 데 도움이 됩니다.",
            "guid": "c614ac47-bebf-4061-b0a1-43e0c6b5e00d",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server",
            "severity": "높다",
            "subcategory": "투명한 데이터 암호화",
            "text": "TDE(투명한 데이터 암호화)가 사용하도록 설정된 상태로 유지되는지 확인"
        },
        {
            "category": "암호화",
            "description": "조직 내에서 키 및 데이터 관리에서 업무를 분리해야 하는 경우 Azure SQLDB에 대한 TDE(투명한 데이터 암호화)에 CMK(고객 관리형 키)를 활용하고 Azure 키 자격 증명 모음을 사용하여 저장합니다(검사 목록 참조). 관리 서비스 키로 충족할 수 없는 엄격한 보안 요구 사항이 있는 경우 이 기능을 활용합니다.",
            "guid": "2edb4165-4f54-47cc-a891-5c82c2f21e25",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-overview",
            "severity": "보통",
            "subcategory": "투명한 데이터 암호화",
            "text": "TDE 보호에 대한 투명성과 세분화된 제어가 필요한 경우 AKV(Azure 키 자격 증명 모음)에서 CMK(고객 관리형 키)를 사용합니다."
        },
        {
            "category": "암호화",
            "description": "최소 TLS(전송 계층 보안) 버전 설정을 통해 고객은 SQL 데이터베이스에서 사용하는 TLS 버전을 선택할 수 있습니다. Azure Portal, Azure PowerShell 및 Azure CLI를 사용하여 최소 TLS 버전을 변경할 수 있습니다.",
            "guid": "7754b605-57fd-4bcb-8213-52c39d8e8225",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-settings?source=recommendations&view=azuresql&tabs=azure-portal#minimal-tls-version",
            "severity": "높다",
            "subcategory": "전송 계층 보안",
            "text": "최소 TLS 버전을 사용 가능한 최신 버전으로 적용"
        },
        {
            "category": "신원",
            "description": "중앙 집중식 ID 관리를 위해 Azure AD(Azure Active Directory) 인증을 사용합니다. 실제로 필요한 경우에만 SQL 인증을 사용하고 예외로 문서화하십시오.",
            "guid": "c9b8b6bf-2c6b-453d-b400-de9a43a549d7",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-overview",
            "severity": "보통",
            "subcategory": "Azure Active Directory",
            "text": "Azure SQL 데이터베이스에 대한 연결을 위해 Azure AD 인증 활용"
        },
        {
            "category": "신원",
            "description": "Azure AD 그룹을 사용하면 권한 관리가 간소화되고 그룹 소유자와 리소스 소유자 모두 그룹에서 구성원을 추가/제거할 수 있습니다. 각 논리 서버에 대해 Azure AD 관리자에 대한 별도의 그룹을 만듭니다. Azure AD 감사 활동 보고서를 사용하여 Azure AD 그룹 멤버 자격 변경을 모니터링합니다.",
            "guid": "29820254-1d14-4778-ae90-ff4aeba504a3",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#central-management-for-identities",
            "severity": "보통",
            "subcategory": "Azure Active Directory",
            "text": "각 Azure SQL 데이터베이스 논리 서버에 대해 두 개의 관리자 계정이 있는 별도의 Azure AD 그룹 만들기"
        },
        {
            "category": "신원",
            "description": "최소 권한이 할당된 함수 전용인 고유한 시스템 및 사용자 할당 관리 ID가 Azure 서비스 및 애플리케이션에서 Azure SQLDB 데이터베이스로의 통신에 사용되는지 확인합니다.",
            "guid": "df3a09ee-03bb-4198-8637-d141acf5f289",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#minimize-the-use-of-password-based-authentication-for-applications",
            "severity": "보통",
            "subcategory": "Azure Active Directory",
            "text": "응용 프로그램에 대한 암호 기반 인증 사용 최소화"
        },
        {
            "category": "신원",
            "description": "시스템 또는 사용자 할당 관리 ID를 사용하면 Azure SQLDB가 코드에 자격 증명을 저장하지 않고도 다른 클라우드 서비스(예: Azure 키 자격 증명 모음)에 인증할 수 있습니다. 사용하도록 설정되면 Azure 역할 기반 액세스 제어를 통해 특정 Azure SQLDB 인스턴스에 필요한 모든 권한을 부여할 수 있습니다. 엄격하게 필요하지 않은 경우 여러 서비스에서 사용자 할당 관리 ID를 공유하지 마세요.",
            "guid": "69891194-5074-4e30-8f69-4efc3c580900",
            "link": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview",
            "severity": "낮다",
            "subcategory": "관리 ID",
            "text": "Azure SQL 데이터베이스에 아웃바운드 리소스 액세스를 위한 관리 ID 할당"
        },
        {
            "category": "신원",
            "description": "암호 사용을 제거하는 Azure AD 통합 인증을 사용합니다. 암호 기반 인증 방법은 더 약한 인증 형식입니다. 자격 증명이 손상되거나 실수로 제공될 수 있습니다. Windows 자격 증명을 사용한 싱글 사인온 인증을 사용합니다. 온-프레미스 AD 도메인을 Azure AD와 페더레이션하고 Windows 통합 인증을 사용합니다(Azure AD를 사용하여 도메인에 가입된 컴퓨터의 경우).",
            "guid": "88287d4a-8bb8-4640-ad78-03f51354d003",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-configure?view=azuresql&tabs=azure-powershell#active-directory-integrated-authentication",
            "severity": "보통",
            "subcategory": "암호",
            "text": "사용자에 대한 암호 기반 인증 사용 최소화"
        },
        {
            "category": "원장",
            "description": "데이터베이스 원장에 있는 최신 블록의 해시를 데이터베이스 다이제스트라고 합니다. 블록이 생성된 시점에 데이터베이스에 있는 모든 원장 테이블의 상태를 나타냅니다. 데이터베이스 다이제스트 생성은 최근에 추가된 블록의 해시만 계산하기 때문에 효율적입니다. Azure 기밀 원장은 지원되는 저장소 중 하나이며 데이터베이스 다이제스트의 자동 생성 및 저장을 지원하고 사용할 수 있습니다. Azure Ledger는 블록체인 원장 증명 및 기밀 하드웨어 엔클레이브와 같은 고급 보안 기능을 제공합니다. 고급 보안 기능이 필요한 경우에만 사용하고, 그렇지 않으면 Azure 저장소로 되돌립니다.",
            "guid": "0e853380-50ba-4bce-b2fd-5c7391c85ecc",
            "link": "https://learn.microsoft.com/azure/architecture/guide/technology-choices/multiparty-computing-service#confidential-ledger-and-azure-blob-storage",
            "severity": "보통",
            "subcategory": "데이터베이스 다이제스트",
            "text": "Azure 기밀 원장을 사용하여 고급 보안 기능이 필요한 경우에만 데이터베이스 다이제스트 저장"
        },
        {
            "category": "원장",
            "description": "데이터베이스 원장에 있는 최신 블록의 해시를 데이터베이스 다이제스트라고 합니다. 블록이 생성된 시점에 데이터베이스에 있는 모든 원장 테이블의 상태를 나타냅니다. 데이터베이스 다이제스트 생성은 최근에 추가된 블록의 해시만 계산하기 때문에 효율적입니다. 변경할 수 없는 저장소 기능이 있는 Azure Blob 저장소를 사용할 수 있으며 데이터베이스 다이제스트의 자동 생성 및 저장소를 지원합니다. 다이제스트 파일의 변조를 방지하려면 컨테이너에 대한 보존 정책을 구성하고 잠급니다.",
            "guid": "afefb2d3-95da-4ac9-acf5-33d18b32ef9a",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-digest-management",
            "severity": "보통",
            "subcategory": "데이터베이스 다이제스트",
            "text": "Azure 저장소 계정을 사용하여 데이터베이스 다이제스트를 저장하는 경우 보안이 올바르게 구성되었는지 확인합니다."
        },
        {
            "category": "원장",
            "description": "Ledger는 원장 테이블의 데이터에 대한 데이터 변조의 증거를 제공하는 정방향 무결성이라는 데이터 무결성 형식을 제공합니다. 데이터베이스 검증 프로세스는 이전에 생성된 하나 이상의 데이터베이스 다이제스트를 입력으로 사용합니다. 그런 다음 원장 테이블의 현재 상태를 기반으로 데이터베이스 원장에 저장된 해시를 다시 계산합니다. 계산된 해시가 입력 다이제스트와 일치하지 않으면 확인이 실패합니다. 이 오류는 데이터가 변조되었음을 나타냅니다. 확인 프로세스는 감지된 모든 불일치를 보고합니다.",
            "guid": "f8d4ffda-8aac-4cc6-b72b-c81cb8625420",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-database-verification",
            "severity": "보통",
            "subcategory": "무결성",
            "text": "데이터 무결성을 확인하기 위해 Ledger 확인 프로세스를 정기적으로 예약합니다."
        },
        {
            "category": "원장",
            "description": "Ledger 기능은 데이터베이스에서 변조 증거 기능을 제공합니다. 감사자 또는 다른 비즈니스 당사자와 같은 다른 당사자에게 데이터가 변조되지 않았음을 암호로 증명할 수 있습니다. Ledger는 데이터베이스 관리자(DBA), 시스템 관리자, 클라우드 관리자를 포함한 모든 공격자 또는 권한이 높은 사용자로부터 데이터를 보호하는 데 도움이 됩니다.",
            "guid": "2563f498-e2d3-42ea-9e7b-5517881a06a2",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-overview",
            "severity": "보통",
            "subcategory": "원장",
            "text": "데이터 무결성에 대한 암호화 증명이 중요한 요구 사항인 경우 Ledger 기능을 고려해야 합니다."
        },
        {
            "category": "원장",
            "description": "변조 유형에 따라 데이터 손실 없이 원장을 복구할 수 있는 경우가 있습니다. --추가 정보-- 열에 포함된 문서에서는 다양한 시나리오와 복구 기술에 대해 설명합니다.",
            "guid": "804fc554-6554-4842-91c1-713b32f99902",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-how-to-recover-after-tampering",
            "severity": "보통",
            "subcategory": "복구",
            "text": "변조 이벤트 후 데이터베이스를 조사하고 복구하기 위한 대응 계획 준비"
        },
        {
            "category": "로깅",
            "description": "Azure SQL 데이터베이스 감사는 데이터베이스 이벤트를 추적하여 Azure 저장소 계정의 감사 로그에 씁니다. 감사는 데이터베이스 작업을 이해하고 비즈니스 문제 또는 의심되는 보안 위반을 나타낼 수 있는 불일치 및 변칙에 대한 통찰력을 얻는 데 도움이 될 뿐만 아니라 규정 준수를 충족하는 데 도움이 됩니다. 기본적으로 감사 정책에는 데이터베이스에 대한 모든 작업(쿼리, 저장 프로시저, 성공 및 실패한 로그인)이 포함되며, 이로 인해 많은 양의 감사 로그가 발생할 수 있습니다. 고객은 PowerShell을 사용하여 다양한 유형의 작업 및 작업 그룹에 대한 감사를 구성하는 것이 좋습니다.",
            "guid": "4082e31d-35f4-4a49-8507-d3172cc930a6",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
            "severity": "보통",
            "subcategory": "감사",
            "text": "Azure SQL 데이터베이스 감사가 서버 수준에서 사용하도록 설정되어 있는지 확인"
        },
        {
            "category": "로깅",
            "description": "Azure SQL 데이터베이스 감사 로그는 외부 저장소 계정, 로그 분석 작업 영역 또는 이벤트 허브에 쓸 수 있습니다. 백업 및 보안 구성을 사용하여 대상 저장소를 보호해야 합니다. Azure SQL 데이터베이스 관리 ID를 사용하여 스토리지에 액세스하고 명시적 보존 기간을 설정합니다. 관리자에게 감사 로그 저장소에 대한 권한을 부여하지 마십시오. --Microsoft 지원 작업의 감사 사용에 다른 대상 저장소를 사용합니다--. ",
            "guid": "9b64bc50-b60f-4035-bf7a-28c4806dfb46",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
            "severity": "낮다",
            "subcategory": "감사",
            "text": "Azure SQL 데이터베이스 감사 로그가 선택한 리포지토리 유형에서 백업 및 보호되는지 확인"
        },
        {
            "category": "로깅",
            "description": "Azure 모니터 활동 로그는 구독 수준 이벤트에 대한 인사이트를 제공하는 Azure의 플랫폼 로그입니다. 활동 로그에는 리소스가 수정된 시기와 같은 정보가 포함됩니다. 이 활동 로그를 Azure SQL 데이터베이스 감사 로그(저장소 계정, 로그 분석 작업 영역, 이벤트 허브)와 동일한 외부 저장소 리포지토리로 보내는 것이 좋습니다.",
            "guid": "fcd34708-87ac-4efc-aaf6-57a47f76644a",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
            "severity": "보통",
            "subcategory": "감사",
            "text": "Azure SQL 데이터베이스 활동 로그가 수집되고 감사 로그와 통합되었는지 확인"
        },
        {
            "category": "로깅",
            "description": "Azure SQL의 모든 로그를 SIEM(보안 정보 및 이벤트 관리) 및 SOAR(보안 오케스트레이션 자동화 및 응답)로 전달합니다. 잠재적인 위협 및 변칙에 대해 다양한 유형의 Azure 자산을 모니터링하고 있는지 확인합니다. 분석가가 분류해야 하는 가양성을 줄이기 위해 고품질 경고를 받는 데 집중합니다. 경고는 로그 데이터, 에이전트 또는 기타 데이터에서 가져올 수 있습니다.",
            "guid": "f96e127e-9572-453a-b325-ff89ae9f6b44",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
            "severity": "보통",
            "subcategory": "SIEM/SOAR",
            "text": "Azure SQL 데이터베이스 감사 로그가 조직에 제공되는지 확인 SIEM/SOAR"
        },
        {
            "category": "로깅",
            "description": "Azure SQL의 모든 로그를 SIEM(보안 정보 및 이벤트 관리) 및 SOAR(보안 오케스트레이션 자동화 및 대응)로 전달하여 사용자 지정 위협 검색을 설정하는 데 사용할 수 있습니다. 잠재적인 위협 및 변칙에 대해 다양한 유형의 Azure 자산을 모니터링하고 있는지 확인합니다. 분석가가 분류해야 하는 가양성을 줄이기 위해 고품질 경고를 받는 데 집중합니다. 경고는 로그 데이터, 에이전트 또는 기타 데이터에서 가져올 수 있습니다.",
            "guid": "41503bf8-73da-4a10-af9f-5f7fceb5456f",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
            "severity": "보통",
            "subcategory": "SIEM/SOAR",
            "text": "Azure SQL 데이터베이스 활동 로그 데이터가 SIEM/SOAR에 표시되는지 확인합니다."
        },
        {
            "category": "로깅",
            "description": "SOC(보안 운영 센터) 팀은 인시던트 대응 계획(플레이북 또는 수동 응답)을 만들어 변조, 악의적인 활동 및 기타 비정상적인 동작을 조사하고 완화해야 합니다.",
            "guid": "19ec7c97-c563-4e1d-82f0-54d6ec12e754",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
            "severity": "보통",
            "subcategory": "SIEM/SOAR",
            "text": "악의적이거나 비정상적인 감사 로깅 이벤트에 대한 대응 계획이 있는지 확인"
        },
        {
            "category": "네트워킹",
            "description": "Azure SQL 데이터베이스용 Azure 포털에서 논리 서버를 만들면 공용 네트워크(공용 액세스)를 통해 표시되고 연결할 수 있는 공용 끝점이 생성됩니다. 그런 다음 방화벽 규칙 및 서비스 엔드포인트에 따라 연결을 제한할 수 있습니다. 프라이빗 엔드포인트(프라이빗 액세스)를 사용하여 내부 네트워크에 대한 연결만 제한하는 프라이빗 연결을 구성할 수도 있습니다. 프라이빗 엔드포인트를 사용하는 프라이빗 액세스는 지원할 수 없는 비즈니스 사례 또는 성능/기술적 이유가 적용되지 않는 한 기본값이어야 합니다. 프라이빗 엔드포인트의 사용에는 고려하고 평가해야 하는 성능 영향이 있습니다.",
            "guid": "2c6d356a-1784-475b-a42c-ec187dc8c925",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview",
            "severity": "높다",
            "subcategory": "인터넷",
            "text": "공용 및 개인 액세스 연결 방법을 검토하고 워크로드에 적합한 방법을 선택합니다."
        },
        {
            "category": "네트워킹",
            "description": "중요: 프라이빗 엔드포인트에 대한 연결은 프록시만 연결 정책으로 지원합니다. 프라이빗 엔드포인트를 사용하는 경우 연결은 Azure SQL 데이터베이스 게이트웨이를 통해 데이터베이스 노드로 프록시됩니다. 클라이언트는 직접 연결되지 않습니다.",
            "guid": "557b3ce5-bada-4296-8d52-a2d447bc1718",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-architecture",
            "severity": "낮다",
            "subcategory": "인터넷",
            "text": "다르게 필요하고 정당화되지 않는 경우 기본 Azure SQL 데이터베이스 연결 정책을 유지합니다."
        },
        {
            "category": "네트워킹",
            "description": "이 옵션은 다른 고객의 구독에서 연결을 포함하여 Azure의 모든 연결을 허용하도록 방화벽을 구성합니다. 이 옵션을 선택하는 경우 로그인 및 사용자 권한이 권한이 있는 사용자로만 액세스를 제한하는지 확인합니다. 꼭 필요한 것이 아닌 경우 이 설정을 OFF로 유지합니다.",
            "guid": "f48efacf-4405-4e8d-9dd0-16c5302ed082",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview",
            "severity": "높다",
            "subcategory": "인터넷",
            "text": "Azure SQL 데이터베이스 방화벽에서 Azure 서비스 및 리소스가 이 서버에 액세스하도록 허용 설정이 비활성화되어 있는지 확인합니다."
        },
        {
            "category": "네트워킹",
            "description": "Azure SQL 데이터베이스에는 외부 REST 엔드포인트와의 기본 통합을 허용하는 새로운 기본 제공 기능이 있습니다. 즉, Azure SQL 데이터베이스를 Azure 함수, Azure 논리 앱, 인지 서비스, 이벤트 허브, 이벤트 그리드, Azure 컨테이너, API 관리 및 일반적으로 모든 REST 또는 GraphQL 끝점과 통합합니다. 적절하게 제한되지 않으면 Azure SQL 데이터베이스 데이터베이스 내의 코드에서 이 메커니즘을 활용하여 데이터를 반출할 수 있습니다. 반드시 필요하지 않은 경우 아웃바운드 방화벽 규칙을 사용하여 이 기능을 차단하거나 제한하는 것이 좋습니다.",
            "guid": "cb3274a7-e36d-46f6-8de5-46d30c8dde8e",
            "link": "https://learn.microsoft.com/sql/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql",
            "severity": "보통",
            "subcategory": "아웃바운드 제어",
            "text": "외부 엔드포인트에 대한 아웃바운드 REST API 호출 차단 또는 제한"
        },
        {
            "category": "네트워킹",
            "description": "아웃바운드 방화벽 규칙은 Azure SQL 데이터베이스 논리 서버의 네트워크 트래픽을 Azure 저장소 계정 및 Azure SQL 데이터베이스 논리 서버의 고객 정의 목록으로 제한합니다. 이 목록에 없는 저장소 계정 또는 데이터베이스에 액세스하려는 모든 시도는 거부됩니다.",
            "guid": "a566dd3d-314e-4a94-9378-102c42d82b38",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/outbound-firewall-rule-overview",
            "severity": "보통",
            "subcategory": "아웃바운드 제어",
            "text": "아웃바운드 네트워크 액세스가 필요한 경우 기본 제공 Azure SQL Database 제어 기능을 사용하여 아웃바운드 네트워킹 제한을 구성하는 것이 좋습니다."
        },
        {
            "category": "네트워킹",
            "description": "프라이빗 엔드포인트는 Azure 가상 네트워크의 서브넷 내에 만들어집니다. NSG/ASG, UDR, 방화벽, 모니터링 및 감사를 포함하여 포함하는 네트워크 환경에도 적절한 보안 구성을 적용해야 합니다.",
            "guid": "246cd832-f550-4af0-9c74-ca9baeeb8860",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server",
            "severity": "보통",
            "subcategory": "비공개 액세스",
            "text": "프라이빗 액세스 연결을 사용하는 경우 프라이빗 엔드포인트, Azure 가상 네트워크, Azure 방화벽 및 Azure 네트워크 보안 그룹 검사 목록을 사용하고 있는지 확인합니다."
        },
        {
            "category": "네트워킹",
            "description": "프라이빗 엔드포인트 연결을 추가할 때 논리 서버에 대한 퍼블릭 라우팅은 기본적으로 차단되지 않습니다. --방화벽 및 가상 네트워크-- 창에서 --공용 네트워크 액세스 거부-- 설정은 기본적으로 선택되어 있지 않습니다. 공용 네트워크 액세스를 사용하지 않도록 설정하려면 --공용 네트워크 액세스 거부를 선택해야 합니다--.",
            "guid": "3a0808ee-ea7a-47ab-bdce-920a6a2b3881",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server",
            "severity": "높다",
            "subcategory": "비공개 액세스",
            "text": "프라이빗 엔드포인트(프라이빗 액세스)를 사용하는 경우 퍼블릭 액세스 연결을 사용하지 않도록 설정하는 것이 좋습니다."
        },
        {
            "category": "네트워킹",
            "description": "이제 NSG(네트워크 보안 그룹) 및 ASG(애플리케이션 보안 그룹)를 프라이빗 엔드포인트가 포함된 서브넷에 적용하여 내부 원본 IP 범위에 따라 Azure SQLDB에 대한 연결을 제한할 수 있습니다.",
            "guid": "8600527e-e8c4-4424-90ef-1f0dca0224f2",
            "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview#network-security-of-private-endpoints",
            "severity": "보통",
            "subcategory": "비공개 액세스",
            "text": "프라이빗 엔드포인트(프라이빗 액세스)를 사용하는 경우 NSG 및 최종적으로 ASG를 적용하여 들어오는 원본 IP 주소 범위를 제한합니다."
        },
        {
            "category": "네트워킹",
            "description": "관리되는 인스턴스(SQL MI)는 외부 액세스를 방지하기 위해 가상 네트워크 내에서 격리될 수 있습니다. 동일한 지역의 동일하거나 피어링된 가상 네트워크에 있는 애플리케이션 및 도구는 직접 액세스할 수 있습니다. 다른 지역에 있는 응용 프로그램 및 도구는 가상 네트워크 간 연결 또는 ExpressRoute 회로 피어링을 사용하여 연결을 설정할 수 있습니다. 고객은 NSG(네트워크 보안 그룹)와 결국 내부 방화벽을 사용하여 포트 1433을 통한 액세스를 관리되는 인스턴스에 액세스해야 하는 리소스로만 제한해야 합니다.",
            "guid": "18123ef4-a0a6-45e3-87fe-7f454f65d975",
            "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/connectivity-architecture-overview",
            "severity": "보통",
            "subcategory": "비공개 액세스",
            "text": "NSG(네트워크 보안 그룹) 및 방화벽 규칙을 적용하여 Azure SQL 관리되는 인스턴스 내부 서브넷에 대한 액세스를 제한합니다."
        },
        {
            "category": "네트워킹",
            "description": "Azure 가상 네트워크 서비스 엔드포인트는 리디렉션 정책을 사용하여 Azure SQL 데이터베이스 백 엔드 노드에 직접 연결하려는 경우 기본 솔루션입니다. 이렇게 하면 고성능 모드에서 액세스할 수 있으며 성능 관점에서 권장되는 접근 방식입니다.",
            "guid": "55187443-6852-4fbd-99c6-ce303597ca7f",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview?view=azuresql#ip-vs-virtual-network-firewall-rules",
            "severity": "높다",
            "subcategory": "공개 액세스",
            "text": "공용 액세스 연결을 사용하는 경우 서비스 엔드포인트를 활용하여 선택한 Azure 가상 네트워크의 액세스를 제한합니다."
        },
        {
            "category": "네트워킹",
            "description": "Azure SQL 데이터베이스 방화벽을 사용하면 통신이 허용되는 IP 주소 범위를 지정할 수 있습니다. 이 방법은 Azure 개인 네트워크 외부에 있는 안정적인 IP 주소에 적합합니다.",
            "guid": "a73e32da-b3f4-4960-b5ec-2f42a557bf31",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview",
            "severity": "보통",
            "subcategory": "공개 액세스",
            "text": "공용 액세스 연결을 사용하는 경우 알려진 특정 IP만 방화벽에 추가되었는지 확인합니다."
        },
        {
            "category": "네트워킹",
            "description": "가능하면 데이터베이스 수준 IP 방화벽 규칙을 사용하는 것이 좋습니다. 이렇게 하면 보안이 강화되고 데이터베이스의 이식성이 향상됩니다. 관리자에 대해 서버 수준 IP 방화벽 규칙을 사용합니다. 또한 액세스 요구 사항이 동일한 데이터베이스가 많고 각 데이터베이스를 개별적으로 구성하지 않으려는 경우에도 사용합니다.",
            "guid": "e0f31ac9-35c8-4bfd-9865-edb60ffc6768",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/firewall-configure",
            "severity": "낮다",
            "subcategory": "공개 액세스",
            "text": "공용 액세스 연결이 Azure SQL 데이터베이스 방화벽 규칙에 의해 사용되고 제어되는 경우 서버 수준 IP 규칙보다 데이터베이스 수준 사용"
        },
        {
            "category": "네트워킹",
            "description": "관리되는 인스턴스(SQL MI)는 외부 액세스를 방지하기 위해 가상 네트워크 내에서 격리될 수 있습니다. 관리되는 인스턴스 퍼블릭 엔드포인트는 기본적으로 사용하도록 설정되지 않으며, 엄격하게 필요한 경우에만 명시적으로 사용하도록 설정해야 합니다. 회사 정책에서 퍼블릭 엔드포인트 사용을 허용하지 않는 경우 Azure Policy를 사용하여 퍼블릭 엔드포인트를 처음부터 사용하도록 설정하지 않도록 합니다.",
            "guid": "b8435656-143e-41a8-9922-61d34edb751a",
            "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview",
            "severity": "높다",
            "subcategory": "공개 액세스",
            "text": "Azure SQL 관리 되는 인스턴스 공용 끝점을 사용 하도록 설정 하지 마십시오."
        },
        {
            "category": "네트워킹",
            "description": "관리되는 인스턴스(SQL MI) 퍼블릭 엔드포인트는 기본적으로 사용하도록 설정되지 않으며, 엄격하게 필요한 경우에만 명시적으로 사용하도록 설정해야 합니다. 이 경우 NSG(네트워크 보안 그룹)를 적용하여 포트 3342에 대한 액세스를 신뢰할 수 있는 원본 IP 주소로만 제한하는 것이 좋습니다.",
            "guid": "057dd298-8726-4aa6-b590-1f81d2e30421",
            "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview",
            "severity": "높다",
            "subcategory": "공개 액세스",
            "text": "Azure SQL 관리되는 인스턴스 퍼블릭 엔드포인트가 필요한 경우 액세스 제한"
        },
        {
            "category": "권한 있는 액세스",
            "description": "Microsoft 직원 및 하위 프로세서가 수행하는 대부분의 작업, 지원 및 문제 해결에는 고객 데이터에 액세스할 필요가 없습니다. 이러한 액세스가 필요한 드문 상황에서 Microsoft Azure용 고객 Lockbox는 고객이 고객 데이터 액세스 요청을 검토하고 승인하거나 거부할 수 있는 인터페이스를 제공합니다.  Microsoft가 고객 데이터에 액세스해야 하는 지원 시나리오에서 Azure SQL 데이터베이스는 고객 데이터 액세스 요청을 검토하고 승인하거나 거부할 수 있는 인터페이스를 제공하기 위해 고객 Lockbox를 지원합니다.",
            "guid": "37b6eb0f-553d-488f-8a8a-cb9bf97388ff",
            "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
            "severity": "낮다",
            "subcategory": "사물함",
            "text": "Microsoft 직원의 Azure SQL 데이터베이스 액세스에 대한 고객 Lockbox를 검토하고 사용하도록 설정"
        },
        {
            "category": "권한 있는 액세스",
            "description": "최소 권한의 원칙에 따르면 사용자는 작업을 완료하는 데 필요한 것보다 더 많은 권한을 가질 수 없습니다. 권한이 높은 데이터베이스 및 서버 사용자는 데이터베이스에서 많은 구성 및 유지 관리 작업을 수행할 수 있으며 Azure SQL 인스턴스에서 데이터베이스를 삭제할 수도 있습니다. 데이터베이스 소유자 및 권한 있는 계정을 추적하는 것은 과도한 권한을 갖지 않도록 하는 데 중요합니다.",
            "guid": "5fe5281f-f0f9-4842-a682-8baf18bd8316",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#implement-principle-of-least-privilege",
            "severity": "보통",
            "subcategory": "권한을",
            "text": "사용자에게 작업 기능을 완료하기 위해 필요한 최소 수준의 액세스 권한이 할당되었는지 확인"
        },
        {
            "category": "권한 있는 액세스",
            "description": "ID(사용자 및 SPN 모두)는 기능을 수행하는 데 필요한 최소 액세스 권한으로 범위를 지정해야 합니다.  관련이 없는 여러 사용 권한 집합이 있는 하나의 SPN을 사용하는 대신 더 많은 수의 엄격한 범위의 SPN을 사용해야 합니다. 예를 들어 온-프레미스에서 Azure SQL 데이터베이스에 대한 쿼리를 수행하는 세 개의 외부 웹 응용 프로그램이 있는 경우 이러한 작업에 모두 동일한 SPN을 사용해서는 안 됩니다.  대신 각각 범위가 엄격하게 지정된 SPN이 있어야 합니다.",
            "guid": "7b5b55e5-4750-4920-be97-eb726c256a5c",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#im-3-use-azure-ad-single-sign-on-sso-for-application-access",
            "severity": "낮다",
            "subcategory": "권한을",
            "text": "고유한 응용 프로그램에 Azure SQL 데이터베이스에 액세스할 수 있는 최소 권한으로 다른 자격 증명이 할당되는지 확인"
        }
    ],
    "metadata": {
        "name": "Azure SQLDB Security Checklist (Preview)"
    },
    "severities": [
        {
            "name": "높다"
        },
        {
            "name": "보통"
        },
        {
            "name": "낮다"
        }
    ],
    "status": [
        {
            "description": "이 검사는 아직 검토되지 않았습니다.",
            "name": "확인되지 않음"
        },
        {
            "description": "이 검사와 연결된 작업 항목이 있습니다.",
            "name": "열다"
        },
        {
            "description": "이 검사가 확인되었으며 연결된 추가 작업 항목이 없습니다.",
            "name": "성취"
        },
        {
            "description": "권장 사항을 이해했지만 현재 요구 사항에서 필요하지 않음",
            "name": "필요하지 않음"
        },
        {
            "description": "현재 디자인에는 적용되지 않음",
            "name": "해당 없음"
        }
    ]
}
checklists/sqldb_security_checklist.ja.json METASEP
{
    "$schema": "checklist.schema.json",
    "categories": [
        {
            "name": "ティッカー"
        },
        {
            "name": "ディフェンダー"
        },
        {
            "name": "暗号化"
        },
        {
            "name": "同一性"
        },
        {
            "name": "特権アクセス"
        },
        {
            "name": "台帳"
        },
        {
            "name": "伐採"
        },
        {
            "name": "ネットワーキング"
        },
        {
            "name": "データの検出と分類"
        },
        {
            "name": "データマスキング"
        },
        {
            "name": "コード"
        }
    ],
    "items": [
        {
            "category": "ティッカー",
            "description": "バックアップが攻撃から保護されていることを確認します。これには、機密性の損失から保護するためのバックアップの暗号化を含める必要があります。通常の Azure サービス バックアップの場合、バックアップ データは Azure プラットフォーム マネージド キーを使用して自動的に暗号化されます。カスタマー マネージド キーを使用してバックアップを暗号化することもできます。この場合は、キー コンテナー内のこのカスタマー マネージド キーもバックアップ スコープ内にあることを確認します。",
            "guid": "676f6951-0368-49e9-808d-c33a692c9a64",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-2-encrypt-backup-data",
            "severity": "中程度",
            "subcategory": "Azure Key Vault",
            "text": "バックアップ データを暗号化で保護し、キーを Azure Key Vault に安全に格納する"
        },
        {
            "category": "ティッカー",
            "description": "Azure SQL Database では、SQL Server テクノロジを使用して、毎週完全バックアップ、12 時間から 24 時間ごとの差分バックアップ、5 分から 10 分ごとにトランザクション ログ バックアップを作成します。既定では、SQL Database は、ペアのリージョンにレプリケートされる geo 冗長ストレージ BLOB にデータを格納します。",
            "guid": "e2518261-b3bc-4bd1-b331-637fb2df833f",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-1-ensure-regular-automated-backups",
            "severity": "中程度",
            "subcategory": "バックアップ",
            "text": "Azure SQL データベースの自動バックアップを構成する"
        },
        {
            "category": "ティッカー",
            "description": "既定では、SQL Database は、ペアのリージョンにレプリケートされる geo 冗長ストレージ BLOB にデータを格納します。SQL Database の場合、バックアップ ストレージの冗長性は、データベースの作成時に構成することも、既存のデータベース用に更新することもできます。既存のデータベースに加えられた変更は、今後のバックアップにのみ適用されます。",
            "guid": "f8c7cda2-3ed7-43fb-a100-85dcd12a0ee4",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/automated-backups-overview?tabs=single-database&view=azuresql#backup-storage-redundancy",
            "severity": "低い",
            "subcategory": "バックアップ",
            "text": "geo 冗長バックアップ ストレージを有効にして、単一リージョンの障害やデータ損失から保護"
        },
        {
            "category": "コード",
            "description": "悪意のあるコードは、セキュリティ制御を回避する可能性があります。カスタム コードを運用環境にデプロイする前に、デプロイされている内容を確認することが不可欠です。ソース管理をサポートする Azure Data Studio などのデータベース ツールを使用します。コード分析、脆弱性、および資格情報のスキャンのためのツールとロジックを実装します。",
            "guid": "7ca9f006-d2a9-4652-951c-de8e4ac5e76e",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server",
            "severity": "中程度",
            "subcategory": "ソース管理とコード レビュー",
            "text": "ソース管理システムを使用して、Azure SQLDB データベース内にデプロイされたアプリケーション コードを格納、保守、およびレビューする"
        },
        {
            "category": "データの検出と分類",
            "description": "分類要件の場合は、Purview が推奨されるオプションです。SQL Data Discovery & Classification は、Purview がオプションではない場合にのみ使用してください。機密データが含まれている可能性のある列を検出します。機密データと見なされるものは、顧客、コンプライアンス規制などに大きく依存し、そのデータを担当するユーザーが評価する必要があります。高度な秘密度ベースの監査と保護のシナリオを使用するように列を分類します。自動検出の結果を確認し、必要に応じて分類を確定します。",
            "guid": "d401509b-2629-4484-9a7f-af0d29a7778f",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/data-discovery-and-classification-overview?view=azuresql#faq---advanced-classification-capabilities",
            "severity": "低い",
            "subcategory": "データの検出と分類",
            "text": "機密データを保護するためのデータ検出と分類の計画と構成"
        },
        {
            "category": "データマスキング",
            "description": "この機能の使用は、列の暗号化がオプションではなく、データ型と形式を保持するための特定の要件がある場合にのみ推奨されます。動的データ マスクは、特権のないユーザーに機密データをマスクすることで、機密データの露出を制限します。動的データ マスクは、アプリケーション レイヤーへの影響を最小限に抑えながら、公開する機密データの量を指定することで、機密データへの不正アクセスを防ぐのに役立ちます。",
            "guid": "9391fd50-135e-453e-90a7-c1a23f88cc13",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/dynamic-data-masking-overview",
            "severity": "低い",
            "subcategory": "データマスキング",
            "text": "データマスキングを使用して、暗号化が不可能な場合に管理者以外の不正なユーザーのデータアクセスを防止します"
        },
        {
            "category": "ディフェンダー",
            "description": "SQL 高度な脅威検出 (ATP) は、SQL インジェクション攻撃や異常な動作パターンなど、データベース内の潜在的な脆弱性や異常なアクティビティを検出するセキュリティ レイヤーを提供します。潜在的な脅威が検出されると、脅威検出は、電子メールと Microsoft Defender for Cloud で、特定の脅威に対する明確な調査と修復の手順を含む、実用的なリアルタイム アラートを送信します。",
            "guid": "4e52d73f-5d37-428f-b3a2-e6997e835979",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure",
            "severity": "高い",
            "subcategory": "高度な脅威対策",
            "text": "高度な脅威対策 (ATP) の構成を確認して完了する"
        },
        {
            "category": "ディフェンダー",
            "description": "サブスクリプション レベルで Microsoft Defender for Azure SQL を有効にして、既存および将来のすべてのサーバーとデータベースを自動的にオンボードして保護します。サブスクリプション レベルで有効にすると、Azure SQL データベースと Azure SQL マネージド インスタンス内のすべてのデータベースが保護されます。その後、必要に応じて個別に無効にすることができます。保護するデータベースを手動で管理する場合は、サブスクリプション レベルで無効にし、保護する各データベースを有効にします。",
            "guid": "dff87489-9edb-4cef-bdda-86e8212b2aa1",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/azure-defender-for-sql?view=azuresql#enable-microsoft-defender-for-sql ",
            "severity": "高い",
            "subcategory": "Defender for Azure SQL",
            "text": "Enable Microsoft Defender for Azure SQL"
        },
        {
            "category": "ディフェンダー",
            "description": "Microsoft Defender for Azure SQL ATP は、データベースにアクセスまたは悪用しようとする異常で潜在的に有害な試みを示す異常なアクティビティを検出します。アラートは構成および生成でき、コンソールの Defender で報告されます。",
            "guid": "ca342fdf-d25a-4427-b105-fcd50ff8a0ea",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure",
            "severity": "高い",
            "subcategory": "Defender for Azure SQL",
            "text": "Microsoft Defender for Azure SQL アラートに迅速に対応するためのセキュリティ対応計画を準備する"
        },
        {
            "category": "ディフェンダー",
            "description": "Azure SQLDB の脆弱性評価は、セキュリティ状態を可視化するサービスです。脆弱性評価には、セキュリティの問題を解決し、データベースのセキュリティを強化するための実用的な手順が含まれます。これは、変更の追跡が困難な動的データベース環境を監視し、SQL セキュリティ体制を改善するのに役立ちます。",
            "guid": "a6101ae7-534c-45ab-86fd-b34c55ea21ca",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-overview",
            "severity": "高い",
            "subcategory": "脆弱性診断",
            "text": "脆弱性評価 (VA) の結果を構成し、推奨事項を確認する"
        },
        {
            "category": "ディフェンダー",
            "description": "Microsoft Defender for Cloud は、Azure SQL Database の脆弱性評価を提供します。脆弱性評価は、データベースでソフトウェアの脆弱性をスキャンし、結果のリストを提供します。検出結果を使用して、ソフトウェアの脆弱性を修正し、検出結果を無効にすることができます。",
            "guid": "c8c5f112-1e50-4f77-9264-8195b4cd61ac",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-find?view=azuresql",
            "severity": "高い",
            "subcategory": "脆弱性診断",
            "text": "脆弱性評価 (VA) の調査結果と推奨事項を定期的に確認し、修正計画を準備する"
        },
        {
            "category": "暗号化",
            "description": "セキュリティで保護されたエンクレーブを使用した Always Encrypted は、インプレース暗号化とより豊富な機密クエリを有効にすることで、Always Encrypted の機密コンピューティング機能を拡張します。Always Encrypted with Secure Enclaves は、サーバー側のセキュリティで保護されたエンクレーブ内のプレーンテキスト データに対する計算を許可することで、これらの制限に対処します。この機能の使用は、管理者アクセスを制限する必要があり、暗号化された列の等価一致以上のものをクエリでサポートする必要がある場合に推奨されます。",
            "guid": "65d7e54a-10a6-4094-b673-9ff3809c9277",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/encryption/always-encrypted-enclaves",
            "severity": "中程度",
            "subcategory": "常に暗号化",
            "text": "管理者ユーザーから機密性の高い PII データを保護することが重要な要件であるが、列暗号化の制限が許容できない場合は、セキュリティで保護されたエンクレーブで常に暗号化される"
        },
        {
            "category": "暗号化",
            "description": "Azure SQL データベースでは、Transact-SQL を使用してデータの列に対称暗号化を適用できます。この方法は、異なる暗号化キーを使用して特定の列を暗号化できるため、列の暗号化と呼ばれます。これにより、ページ内のデータを暗号化する TDE よりも詳細な暗号化機能が提供されます。Always Encrypted を使用して、メモリ内または使用中であっても、機密データが Azure SQL Database または SQL マネージド インスタンスでプレーンテキストで公開されないようにします。Always Encrypted は、データベース管理者 (DBA) やクラウド管理者 (または、高い特権を持つが承認されていないユーザーを偽装できる悪意のある人物) からデータを保護し、データにアクセスできるユーザーをより詳細に制御できるようにします。",
            "guid": "c03ce136-e3d5-4e17-bf25-ed955ee480d3",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#control-access-of-application-users-to-sensitive-data-through-encryption",
            "severity": "低い",
            "subcategory": "列の暗号化",
            "text": "特定のテーブル列の管理者以外のユーザーから機密性の高い PII データを保護するには、列の暗号化の使用を検討してください。"
        },
        {
            "category": "暗号化",
            "description": "既定で有効になっている透過的なデータ暗号化 (TDE) は、アプリケーションを変更することなく、データベース、関連するバックアップ、およびトランザクション ログ ファイルのリアルタイムの暗号化と暗号化解除を \"保存中\" で実行することで、データベース ファイルを情報漏えいから保護するのに役立ちます。",
            "guid": "c614ac47-bebf-4061-b0a1-43e0c6b5e00d",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server",
            "severity": "高い",
            "subcategory": "透過的なデータ暗号化",
            "text": "透過的なデータ暗号化 (TDE) が有効になっていることを確認する"
        },
        {
            "category": "暗号化",
            "description": "組織内のキーとデータの管理における職務の分離が必要な場合は、Azure SQLDB の透過的なデータ暗号化 (TDE) にカスタマー マネージド キー (CMK) を活用し、Azure Key Vault を使用して格納します (チェックリストを参照)。この機能は、マネージド サービス キーでは満たすことができない厳格なセキュリティ要件がある場合に活用してください。",
            "guid": "2edb4165-4f54-47cc-a891-5c82c2f21e25",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-overview",
            "severity": "中程度",
            "subcategory": "透過的なデータ暗号化",
            "text": "Azure Key Vault (AKV) でカスタマー マネージド キー (CMK) を使用する (TDE 保護の透明性を高め、きめ細かく制御する必要がある場合)"
        },
        {
            "category": "暗号化",
            "description": "トランスポート層セキュリティ (TLS) の最小バージョン設定を使用すると、お客様は SQL データベースで使用する TLS のバージョンを選択できます。TLS の最小バージョンは、Azure portal、Azure PowerShell、および Azure CLI を使用して変更できます。",
            "guid": "7754b605-57fd-4bcb-8213-52c39d8e8225",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-settings?source=recommendations&view=azuresql&tabs=azure-portal#minimal-tls-version",
            "severity": "高い",
            "subcategory": "トランスポート層セキュリティ",
            "text": "TLS の最小バージョンを利用可能な最新のバージョンに適用する"
        },
        {
            "category": "同一性",
            "description": "一元化された ID 管理のために Azure Active Directory (Azure AD) 認証を使用します。SQL 認証は、本当に必要な場合にのみ使用し、例外として文書化します。",
            "guid": "c9b8b6bf-2c6b-453d-b400-de9a43a549d7",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-overview",
            "severity": "中程度",
            "subcategory": "Azure Active Directory",
            "text": "Azure SQL データベースへの接続に Azure AD 認証を活用する"
        },
        {
            "category": "同一性",
            "description": "Azure AD グループを使用すると、アクセス許可の管理が簡素化され、グループ所有者とリソース所有者の両方がグループにメンバーを追加したり、グループからメンバーを削除したりできます。論理サーバーごとに Azure AD 管理者用の個別のグループを作成します。Azure AD 監査アクティビティ レポートを使用して、Azure AD グループ メンバーシップの変更を監視します。",
            "guid": "29820254-1d14-4778-ae90-ff4aeba504a3",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#central-management-for-identities",
            "severity": "中程度",
            "subcategory": "Azure Active Directory",
            "text": "Azure SQL データベース論理サーバーごとに 2 つの管理者アカウントを持つ個別の Azure AD グループを作成する"
        },
        {
            "category": "同一性",
            "description": "Azure サービスおよびアプリケーションから Azure SQLDB データベースへの通信に、最小限のアクセス許可が割り当てられた、機能専用の個別のシステムおよびユーザー割り当てマネージド ID が使用されていることを確認します。",
            "guid": "df3a09ee-03bb-4198-8637-d141acf5f289",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#minimize-the-use-of-password-based-authentication-for-applications",
            "severity": "中程度",
            "subcategory": "Azure Active Directory",
            "text": "アプリケーションでのパスワードベースの認証の使用を最小限に抑える"
        },
        {
            "category": "同一性",
            "description": "システムまたはユーザー割り当てマネージド ID を使用すると、Azure SQLDB は、資格情報をコードに格納することなく、他のクラウド サービス (Azure Key Vault など) に対する認証を行うことができます。有効にすると、必要なすべてのアクセス許可を、Azure ロールベースのアクセス制御を介して特定の Azure SQLDB インスタンスに付与できます。厳密に必要でない場合は、複数のサービス間でユーザー割り当てマネージド ID を共有しないでください。",
            "guid": "69891194-5074-4e30-8f69-4efc3c580900",
            "link": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview",
            "severity": "低い",
            "subcategory": "マネージド ID",
            "text": "Azure SQL データベースに送信リソース アクセス用のマネージド ID を割り当てる"
        },
        {
            "category": "同一性",
            "description": "パスワードの使用を排除する Azure AD 統合認証を使用します。パスワードベースの認証方法は、認証の弱い形式です。資格情報が侵害されたり、誤って譲渡されたりする可能性があります。Windows 資格情報を使用したシングル サインオン認証を使用します。オンプレミスの AD ドメインを Azure AD とフェデレーションし、統合 Windows 認証を使用します (Azure AD を持つドメインに参加しているマシンの場合)。",
            "guid": "88287d4a-8bb8-4640-ad78-03f51354d003",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-configure?view=azuresql&tabs=azure-powershell#active-directory-integrated-authentication",
            "severity": "中程度",
            "subcategory": "パスワード",
            "text": "ユーザーのパスワードベースの認証の使用を最小限に抑える"
        },
        {
            "category": "台帳",
            "description": "データベース台帳内の最新のブロックのハッシュは、データベースダイジェストと呼ばれます。これは、ブロックが生成された時点でのデータベース内のすべての台帳テーブルの状態を表します。データベース ダイジェストの生成は、最近追加されたブロックのハッシュのみを計算する必要があるため、効率的です。Azure 社外秘台帳はサポートされているストアの 1 つであり、データベース ダイジェストの自動生成と格納をサポートして使用できます。Azure Ledger には、ブロックチェーン元帳証明や機密ハードウェア エンクレーブなどの高度なセキュリティ機能が用意されています。高度なセキュリティ機能が必要な場合にのみ使用し、それ以外の場合は Azure ストレージに戻します。",
            "guid": "0e853380-50ba-4bce-b2fd-5c7391c85ecc",
            "link": "https://learn.microsoft.com/azure/architecture/guide/technology-choices/multiparty-computing-service#confidential-ledger-and-azure-blob-storage",
            "severity": "中程度",
            "subcategory": "データベースダイジェスト",
            "text": "Azure 機密元帳を使用してデータベース ダイジェストを格納するのは、高度なセキュリティ機能が必要な場合のみにしてください。"
        },
        {
            "category": "台帳",
            "description": "データベース台帳内の最新のブロックのハッシュは、データベースダイジェストと呼ばれます。これは、ブロックが生成された時点でのデータベース内のすべての台帳テーブルの状態を表します。データベース ダイジェストの生成は、最近追加されたブロックのハッシュのみを計算する必要があるため、効率的です。不変ストレージを使用した Azure BLOB ストレージ機能は使用でき、データベース ダイジェストの自動生成とストレージをサポートします。ダイジェストファイルの改ざんを防ぐには、コンテナーのアイテム保持ポリシーを構成してロックします。",
            "guid": "afefb2d3-95da-4ac9-acf5-33d18b32ef9a",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-digest-management",
            "severity": "中程度",
            "subcategory": "データベースダイジェスト",
            "text": "Azure ストレージ アカウントを使用してデータベース ダイジェストを格納する場合は、セキュリティが適切に構成されていることを確認する"
        },
        {
            "category": "台帳",
            "description": "Ledgerは、前方整合性と呼ばれるデータ整合性の形式を提供し、台帳テーブル内のデータのデータ改ざんの証拠を提供します。データベース検証プロセスは、以前に生成された 1 つ以上のデータベース ダイジェストを入力として受け取ります。次に、台帳テーブルの現在の状態に基づいて、データベース台帳に格納されているハッシュを再計算します。計算されたハッシュが入力ダイジェストと一致しない場合、検証は失敗します。このエラーは、データが改ざんされたことを示します。検証プロセスでは、検出されたすべての不整合が報告されます。",
            "guid": "f8d4ffda-8aac-4cc6-b72b-c81cb8625420",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-database-verification",
            "severity": "中程度",
            "subcategory": "整合性",
            "text": "Ledgerの検証プロセスを定期的にスケジュールして、データの整合性を検証します"
        },
        {
            "category": "台帳",
            "description": "台帳機能は、データベースに改ざん証拠機能を提供します。監査人や他のビジネス関係者など、データが改ざんされていないことを他の関係者に暗号で証明できます。Ledgerは、データベース管理者(DBA)、システム管理者、クラウド管理者など、攻撃者や高い権限を持つユーザーからデータを保護するのに役立ちます。",
            "guid": "2563f498-e2d3-42ea-9e7b-5517881a06a2",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-overview",
            "severity": "中程度",
            "subcategory": "台帳",
            "text": "データ整合性の暗号化証明が重要な要件である場合は、Ledger機能を検討する必要があります"
        },
        {
            "category": "台帳",
            "description": "改ざんの種類によっては、データを失うことなく台帳を修復できる場合があります。「詳細情報」列に含まれる記事では、さまざまなシナリオと回復手法について説明します。",
            "guid": "804fc554-6554-4842-91c1-713b32f99902",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-how-to-recover-after-tampering",
            "severity": "中程度",
            "subcategory": "回復",
            "text": "改ざんイベント後にデータベースを調査および修復するための対応計画を準備する"
        },
        {
            "category": "伐採",
            "description": "Azure SQL データベース監査は、データベース イベントを追跡し、Azure ストレージ アカウントの監査ログに書き込みます。監査は、データベースアクティビティを理解し、ビジネス上の懸念やセキュリティ違反の疑いを示す可能性のある不一致や異常に関する洞察を得るのに役立ち、規制コンプライアンスを満たすのに役立ちます。既定では、監査ポリシーにはデータベースに対するすべてのアクション (クエリ、ストアド プロシージャ、成功および失敗したログイン) が含まれているため、大量の監査ログが発生する可能性があります。PowerShell を使用して、さまざまな種類のアクションとアクション グループの監査を構成することをお勧めします。",
            "guid": "4082e31d-35f4-4a49-8507-d3172cc930a6",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
            "severity": "中程度",
            "subcategory": "聴講",
            "text": "Azure SQL データベース監査がサーバー レベルで有効になっていることを確認する"
        },
        {
            "category": "伐採",
            "description": "Azure SQL データベース監査ログは、外部ストレージ アカウント、Log Analytics ワークスペース、またはイベント ハブに書き込むことができます。ターゲットリポジトリは、バックアップと安全な設定を使用して保護してください。Azure SQL データベース マネージド ID を使用してストレージにアクセスし、明示的な保有期間を設定します。監査ログリポジトリへのアクセス許可を管理者に付与しないでください。別のターゲット ストレージを使用する -- Microsoft サポート操作の監査を有効にします--.",
            "guid": "9b64bc50-b60f-4035-bf7a-28c4806dfb46",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
            "severity": "低い",
            "subcategory": "聴講",
            "text": "Azure SQL データベース監査ログがバックアップされ、選択したリポジトリの種類でセキュリティで保護されていることを確認する"
        },
        {
            "category": "伐採",
            "description": "Azure Monitor アクティビティ ログは、サブスクリプション レベルのイベントに関する分析情報を提供する Azure のプラットフォーム ログです。アクティビティ ログには、リソースがいつ変更されたかなどの情報が含まれます。このアクティビティ ログは、Azure SQL データベース監査ログと同じ外部ストレージ リポジトリ (ストレージ アカウント、Log Analytics ワークスペース、イベント ハブ) に送信することをお勧めします。",
            "guid": "fcd34708-87ac-4efc-aaf6-57a47f76644a",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
            "severity": "中程度",
            "subcategory": "聴講",
            "text": "Azure SQL データベース アクティビティ ログが収集され、監査ログと統合されていることを確認する"
        },
        {
            "category": "伐採",
            "description": "Azure SQL からセキュリティ情報イベント管理 (SIEM) とセキュリティ オーケストレーションの自動化と応答 (SOAR) にログを転送します。さまざまな種類の Azure 資産を監視して、潜在的な脅威や異常がないことを確認します。アナリストが分類する誤検知を減らすために、高品質のアラートの取得に重点を置きます。アラートは、ログデータ、エージェント、またはその他のデータから取得できます。",
            "guid": "f96e127e-9572-453a-b325-ff89ae9f6b44",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
            "severity": "中程度",
            "subcategory": "シェム/ソア",
            "text": "Azure SQL Database 監査ログが組織の SIEM/SOAR に提示されていることを確認する"
        },
        {
            "category": "伐採",
            "description": "Azure SQL からのログを、カスタム脅威検出の設定に使用できるセキュリティ情報イベント管理 (SIEM) とセキュリティ オーケストレーションの自動化と対応 (SOAR) に転送します。さまざまな種類の Azure 資産を監視して、潜在的な脅威や異常がないことを確認します。アナリストが分類する誤検知を減らすために、高品質のアラートの取得に重点を置きます。アラートは、ログデータ、エージェント、またはその他のデータから取得できます。",
            "guid": "41503bf8-73da-4a10-af9f-5f7fceb5456f",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
            "severity": "中程度",
            "subcategory": "シェム/ソア",
            "text": "Azure SQL データベース アクティビティ ログ データが SIEM/SOAR に表示されていることを確認する"
        },
        {
            "category": "伐採",
            "description": "セキュリティ オペレーション センター (SOC) チームは、インシデント対応計画 (プレイブックまたは手動対応) を作成して、改ざん、悪意のあるアクティビティ、およびその他の異常な動作を調査して軽減する必要があります。",
            "guid": "19ec7c97-c563-4e1d-82f0-54d6ec12e754",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
            "severity": "中程度",
            "subcategory": "シェム/ソア",
            "text": "悪意のある監査ログイベントまたは異常な監査ログ イベントに対する対応計画があることを確認する"
        },
        {
            "category": "ネットワーキング",
            "description": "Azure SQL データベース用の Azure portal から論理サーバーを作成すると、パブリック ネットワーク経由で表示および到達可能なパブリック エンドポイント (パブリック アクセス) が作成されます。その後、ファイアウォール規則とサービス エンドポイントに基づいて接続を制限できます。プライベート エンドポイント (プライベート アクセス) を使用して、内部ネットワークへの接続を制限するプライベート接続のみを構成することもできます。プライベート エンドポイントを使用したプライベート アクセスは、それをサポートできないビジネス ケースまたはパフォーマンス/技術的な理由が適用されない限り、既定にする必要があります。プライベート エンドポイントの使用には、考慮および評価する必要があるパフォーマンスへの影響があります。",
            "guid": "2c6d356a-1784-475b-a42c-ec187dc8c925",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview",
            "severity": "高い",
            "subcategory": "接続",
            "text": "パブリック アクセスとプライベート アクセスの接続方法を確認し、ワークロードに適した接続方法を選択する"
        },
        {
            "category": "ネットワーキング",
            "description": "重要: プライベート エンドポイントへの接続では、接続ポリシーとしてプロキシのみがサポートされます。プライベート エンドポイントを使用する場合、接続は Azure SQL Database ゲートウェイ経由でデータベース ノードにプロキシされます。クライアントは直接接続されません。",
            "guid": "557b3ce5-bada-4296-8d52-a2d447bc1718",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-architecture",
            "severity": "低い",
            "subcategory": "接続",
            "text": "既定の Azure SQL データベース接続ポリシーを保持する (特に必要でなく、正当化されない場合)"
        },
        {
            "category": "ネットワーキング",
            "description": "このオプションは、他の顧客のサブスクリプションからの接続を含め、Azure からのすべての接続を許可するようにファイアウォールを構成します。このオプションを選択する場合は、ログイン権限とユーザー権限で、アクセスを許可されたユーザーのみに制限してください。厳密には必須でない場合は、この設定を OFF のままにします。",
            "guid": "f48efacf-4405-4e8d-9dd0-16c5302ed082",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview",
            "severity": "高い",
            "subcategory": "接続",
            "text": "Azure サービスとリソースにこのサーバーへのアクセスを許可する設定が Azure SQL データベース ファイアウォールで無効になっていることを確認する"
        },
        {
            "category": "ネットワーキング",
            "description": "Azure SQL データベースには、外部 REST エンドポイントとのネイティブ統合を可能にする新しい組み込み機能があります。これは、Azure SQL Database と Azure Functions、Azure Logic Apps、Cognitive Services、Event Hubs、Event Grid、Azure Containers、API Management、そして一般的には任意の REST または GraphQL エンドポイントとの統合を意味します。適切に制限されていない場合、Azure SQL データベース データベース内のコードは、このメカニズムを利用してデータを盗み出す可能性があります。厳密に必要でない場合は、送信ファイアウォール規則を使用してこの機能をブロックまたは制限することをお勧めします。",
            "guid": "cb3274a7-e36d-46f6-8de5-46d30c8dde8e",
            "link": "https://learn.microsoft.com/sql/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql",
            "severity": "中程度",
            "subcategory": "アウトバウンド制御",
            "text": "外部エンドポイントへの送信 REST API 呼び出しをブロックまたは制限する"
        },
        {
            "category": "ネットワーキング",
            "description": "送信ファイアウォール規則は、Azure SQL データベース論理サーバーからのネットワーク トラフィックを、Azure ストレージ アカウントと Azure SQL データベース論理サーバーの顧客定義の一覧に制限します。この一覧にないストレージ アカウントまたはデータベースにアクセスしようとすると、拒否されます。",
            "guid": "a566dd3d-314e-4a94-9378-102c42d82b38",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/outbound-firewall-rule-overview",
            "severity": "中程度",
            "subcategory": "アウトバウンド制御",
            "text": "送信ネットワーク アクセスが必要な場合は、組み込みの Azure SQL Database コントロール機能を使用して送信ネットワークの制限を構成することをお勧めします。"
        },
        {
            "category": "ネットワーキング",
            "description": "プライベート エンドポイントは、Azure 仮想ネットワーク内のサブネット内に作成されます。適切なセキュリティ構成は、NSG/ASG、UDR、ファイアウォール、監視、監査など、包含ネットワーク環境にも適用する必要があります。",
            "guid": "246cd832-f550-4af0-9c74-ca9baeeb8860",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server",
            "severity": "中程度",
            "subcategory": "プライベートアクセス",
            "text": "プライベート アクセス接続を使用する場合は、プライベート エンドポイント、Azure 仮想ネットワーク、Azure ファイアウォール、および Azure ネットワーク セキュリティ グループのチェックリストを使用していることを確認します。"
        },
        {
            "category": "ネットワーキング",
            "description": "プライベート エンドポイント接続を追加する場合、論理サーバーへのパブリック ルーティングは既定ではブロックされません。[-- ファイアウォールと仮想ネットワーク] ウィンドウでは、[パブリック ネットワーク アクセスを拒否する] 設定が既定では選択されていません。パブリックネットワークアクセスを無効にするには、必ず --パブリックネットワークアクセスを拒否する を選択します--.",
            "guid": "3a0808ee-ea7a-47ab-bdce-920a6a2b3881",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server",
            "severity": "高い",
            "subcategory": "プライベートアクセス",
            "text": "プライベート エンドポイント (プライベート アクセス) を使用する場合は、パブリック アクセス接続を無効にすることを検討してください。"
        },
        {
            "category": "ネットワーキング",
            "description": "ネットワーク セキュリティ グループ (NSG) とアプリケーション セキュリティ グループ (ASG) をプライベート エンドポイントを含むサブネットに適用して、内部ソース IP 範囲に基づいて Azure SQLDB への接続を制限できるようになりました。",
            "guid": "8600527e-e8c4-4424-90ef-1f0dca0224f2",
            "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview#network-security-of-private-endpoints",
            "severity": "中程度",
            "subcategory": "プライベートアクセス",
            "text": "プライベート エンドポイント (プライベート アクセス) を使用する場合は、NSG を適用し、最終的には ASG を適用して、受信ソース IP アドレス範囲を制限します。"
        },
        {
            "category": "ネットワーキング",
            "description": "マネージド インスタンス (SQL MI) を仮想ネットワーク内に分離して、外部アクセスを防ぐことができます。同じリージョン内の同じ仮想ネットワークまたはピアリングされた仮想ネットワーク内にあるアプリケーションとツールは、直接アクセスできます。異なるリージョンにあるアプリケーションとツールは、仮想ネットワーク間接続または ExpressRoute 回線ピアリングを使用して接続を確立できます。お客様は、ネットワーク セキュリティ グループ (NSG) と最終的には内部ファイアウォールを使用して、ポート 1433 経由のアクセスをマネージド インスタンスへのアクセスを必要とするリソースのみに制限する必要があります。",
            "guid": "18123ef4-a0a6-45e3-87fe-7f454f65d975",
            "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/connectivity-architecture-overview",
            "severity": "中程度",
            "subcategory": "プライベートアクセス",
            "text": "ネットワーク セキュリティ グループ (NSG) とファイアウォール規則を適用して、Azure SQL マネージド インスタンスの内部サブネットへのアクセスを制限する"
        },
        {
            "category": "ネットワーキング",
            "description": "Azure 仮想ネットワーク サービス エンドポイントは、リダイレクト ポリシーを使用して Azure SQL Database バックエンド ノードへの直接接続を確立する場合に推奨されるソリューションです。これにより、高パフォーマンス モードでのアクセスが可能になり、パフォーマンスの観点から推奨されるアプローチです。",
            "guid": "55187443-6852-4fbd-99c6-ce303597ca7f",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview?view=azuresql#ip-vs-virtual-network-firewall-rules",
            "severity": "高い",
            "subcategory": "パブリックアクセス",
            "text": "パブリック アクセス接続が使用されている場合は、サービス エンドポイントを利用して、選択した Azure 仮想ネットワークからのアクセスを制限します。"
        },
        {
            "category": "ネットワーキング",
            "description": "Azure SQL データベース ファイアウォールでは、通信を受け入れる IP アドレス範囲を指定できます。この方法は、Azure プライベート ネットワークの外部にある安定した IP アドレスに適しています。",
            "guid": "a73e32da-b3f4-4960-b5ec-2f42a557bf31",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview",
            "severity": "中程度",
            "subcategory": "パブリックアクセス",
            "text": "パブリック アクセス接続を使用する場合は、特定の既知の IP のみがファイアウォールに追加されていることを確認します。"
        },
        {
            "category": "ネットワーキング",
            "description": "可能な限り、データベース レベルの IP ファイアウォール規則を使用することをお勧めします。これにより、セキュリティが強化され、データベースの移植性が向上します。管理者にはサーバー レベルの IP ファイアウォール規則を使用します。また、同じアクセス要件を持つデータベースが多数あり、各データベースを個別に構成したくない場合にも使用します。",
            "guid": "e0f31ac9-35c8-4bfd-9865-edb60ffc6768",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/firewall-configure",
            "severity": "低い",
            "subcategory": "パブリックアクセス",
            "text": "パブリック アクセス接続が Azure SQL Database のファイアウォール規則によって使用および制御されている場合は、サーバー レベルの IP 規則よりもデータベース レベルの IP 規則を使用します。"
        },
        {
            "category": "ネットワーキング",
            "description": "マネージド インスタンス (SQL MI) を仮想ネットワーク内に分離して、外部アクセスを防ぐことができます。マネージド インスタンスのパブリック エンドポイントは既定では有効になっていないため、厳密に必要な場合にのみ明示的に有効にする必要があります。会社のポリシーでパブリック エンドポイントの使用が許可されていない場合は、Azure Policy を使用して、最初にパブリック エンドポイントを有効にしないようにします。",
            "guid": "b8435656-143e-41a8-9922-61d34edb751a",
            "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview",
            "severity": "高い",
            "subcategory": "パブリックアクセス",
            "text": "Azure SQL マネージド インスタンスのパブリック エンドポイントを有効にしない"
        },
        {
            "category": "ネットワーキング",
            "description": "マネージド インスタンス (SQL MI) パブリック エンドポイントは既定では有効にならず、厳密に必要な場合にのみ明示的に有効にする必要があります。この場合、ネットワーク セキュリティ グループ (NSG) を適用して、ポート 3342 へのアクセスを信頼できるソース IP アドレスのみに制限することをお勧めします。",
            "guid": "057dd298-8726-4aa6-b590-1f81d2e30421",
            "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview",
            "severity": "高い",
            "subcategory": "パブリックアクセス",
            "text": "Azure SQL マネージド インスタンスのパブリック エンドポイントが必要な場合にアクセスを制限する"
        },
        {
            "category": "特権アクセス",
            "description": "Microsoft の担当者と副処理者が実行するほとんどの操作、サポート、およびトラブルシューティングでは、顧客データにアクセスする必要はありません。このようなアクセスが必要なまれな状況では、Microsoft Azure のカスタマー ロックボックスは、顧客が顧客データ アクセス要求を確認して承認または拒否するためのインターフェイスを提供します。 Microsoft が顧客データにアクセスする必要があるサポート シナリオでは、Azure SQL Database はカスタマー ロックボックスをサポートし、顧客データ アクセス要求を確認して承認または拒否するためのインターフェイスを提供します。",
            "guid": "37b6eb0f-553d-488f-8a8a-cb9bf97388ff",
            "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
            "severity": "低い",
            "subcategory": "貸金庫",
            "text": "マイクロソフトの担当者による Azure SQL データベース アクセスのカスタマー ロックボックスを確認して有効にする"
        },
        {
            "category": "特権アクセス",
            "description": "最小特権の原則では、ユーザーはタスクを完了するために必要な以上の特権を持つべきではないと規定されています。高い特権を持つデータベースとサーバー ユーザーは、データベースに対して多くの構成およびメンテナンス アクティビティを実行でき、Azure SQL インスタンス内のデータベースを削除することもできます。データベース所有者と特権アカウントを追跡することは、過剰なアクセス許可を持たないようにするために重要です。",
            "guid": "5fe5281f-f0f9-4842-a682-8baf18bd8316",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#implement-principle-of-least-privilege",
            "severity": "中程度",
            "subcategory": "権限",
            "text": "ユーザーには、職務を完了するために最低限のアクセスレベルが割り当てられていることを確認します。"
        },
        {
            "category": "特権アクセス",
            "description": "ID (ユーザーと SPN の両方) は、機能を実行するために必要な最小限のアクセス量にスコープを設定する必要があります。 関連性のないアクセス許可の複数のセットを持つ 1 つの SPN を持つのではなく、スコープが狭い SPN の数を増やす必要があります。たとえば、オンプレミスでホストされている 3 つの外部 Web アプリケーションが Azure SQL Database に対してクエリを実行する場合、すべてのアプリケーションがこれらのアクティビティに同じ SPN を使用するべきではありません。 代わりに、それぞれに独自の厳密なスコープの SPN が必要です。",
            "guid": "7b5b55e5-4750-4920-be97-eb726c256a5c",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#im-3-use-azure-ad-single-sign-on-sso-for-application-access",
            "severity": "低い",
            "subcategory": "権限",
            "text": "個別のアプリケーションには、Azure SQL データベースにアクセスするための最小限のアクセス許可を持つ異なる資格情報が割り当てられるようにする"
        }
    ],
    "metadata": {
        "name": "Azure SQLDB Security Checklist (Preview)"
    },
    "severities": [
        {
            "name": "高い"
        },
        {
            "name": "中程度"
        },
        {
            "name": "低い"
        }
    ],
    "status": [
        {
            "description": "このチェックはまだ確認されていません",
            "name": "未確認"
        },
        {
            "description": "このチェックに関連付けられているアクションアイテムがあります",
            "name": "開ける"
        },
        {
            "description": "このチェックは検証済みであり、それ以上のアクションアイテムは関連付けられていません",
            "name": "達成"
        },
        {
            "description": "推奨事項は理解されていますが、現在の要件では必要ありません",
            "name": "必須ではありません"
        },
        {
            "description": "現在のデザインには適用できません",
            "name": "該当なし"
        }
    ]
}
checklists/sqldb_security_checklist.es.json METASEP
{
    "$schema": "checklist.schema.json",
    "categories": [
        {
            "name": "BCDR"
        },
        {
            "name": "Defensor"
        },
        {
            "name": "Encriptación"
        },
        {
            "name": "Identidad"
        },
        {
            "name": "Acceso privilegiado"
        },
        {
            "name": "Libro mayor"
        },
        {
            "name": "Registro"
        },
        {
            "name": "Gestión de redes"
        },
        {
            "name": "Descubrimiento y clasificación de datos"
        },
        {
            "name": "Enmascaramiento de datos"
        },
        {
            "name": "Código"
        }
    ],
    "items": [
        {
            "category": "BCDR",
            "description": "Asegúrese de que sus copias de seguridad estén protegidas contra ataques. Esto debe incluir el cifrado de las copias de seguridad para proteger contra la pérdida de confidencialidad. Para la copia de seguridad regular del servicio de Azure, los datos de copia de seguridad se cifran automáticamente con claves administradas por la plataforma Azure. También puede optar por cifrar la copia de seguridad mediante una clave administrada por el cliente. En este caso, asegúrese de que esta clave administrada por el cliente en el almacén de claves también esté en el ámbito de copia de seguridad.",
            "guid": "676f6951-0368-49e9-808d-c33a692c9a64",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-2-encrypt-backup-data",
            "severity": "Medio",
            "subcategory": "Azure Key Vault",
            "text": "Proteja sus datos de copia de seguridad con cifrado y almacene claves de forma segura en Azure Key Vault"
        },
        {
            "category": "BCDR",
            "description": "Base de datos SQL de Azure usa la tecnología de SQL Server para crear copias de seguridad completas cada semana, copias de seguridad diferenciales cada 12 a 24 horas y copias de seguridad del registro de transacciones cada 5 a 10 minutos. De forma predeterminada, Base de datos SQL almacena datos en blobs de almacenamiento con redundancia geográfica que se replican en una región emparejada.",
            "guid": "e2518261-b3bc-4bd1-b331-637fb2df833f",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-1-ensure-regular-automated-backups",
            "severity": "Medio",
            "subcategory": "Copia de seguridad",
            "text": "Configuración de copias de seguridad automatizadas de Base de datos SQL de Azure"
        },
        {
            "category": "BCDR",
            "description": "De forma predeterminada, Base de datos SQL almacena datos en blobs de almacenamiento con redundancia geográfica que se replican en una región emparejada. Para Base de datos SQL, la redundancia de almacenamiento de copia de seguridad se puede configurar en el momento de la creación de la base de datos o se puede actualizar para una base de datos existente; Los cambios realizados en una base de datos existente solo se aplican a futuras copias de seguridad.",
            "guid": "f8c7cda2-3ed7-43fb-a100-85dcd12a0ee4",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/automated-backups-overview?tabs=single-database&view=azuresql#backup-storage-redundancy",
            "severity": "Bajo",
            "subcategory": "Copia de seguridad",
            "text": "Habilite el almacenamiento de copia de seguridad con redundancia geográfica para proteger contra fallas en una sola región y pérdida de datos"
        },
        {
            "category": "Código",
            "description": "El código malintencionado puede eludir potencialmente los controles de seguridad. Antes de implementar código personalizado en producción, es esencial revisar lo que se está implementando. Use una herramienta de base de datos como Azure Data Studio que admita el control de código fuente. Implementar herramientas y lógica para el análisis de código, vulnerabilidad y escaneo de credenciales.",
            "guid": "7ca9f006-d2a9-4652-951c-de8e4ac5e76e",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server",
            "severity": "Medio",
            "subcategory": "Control de código fuente y revisión de código",
            "text": "Uso de sistemas de control de código fuente para almacenar, mantener y revisar el código de aplicación implementado en Azure SQLDB Database"
        },
        {
            "category": "Descubrimiento y clasificación de datos",
            "description": "En caso de requisitos de clasificación, Purview es la opción preferida. Solo use SQL Data Discovery & Classification en caso de que Purview no sea una opción. Descubra columnas que potencialmente contengan datos confidenciales. Lo que se considera datos confidenciales depende en gran medida del cliente, la regulación de cumplimiento, etc., y debe ser evaluado por los usuarios a cargo de esos datos. Clasifique las columnas para usar escenarios avanzados de auditoría y protección basados en sensibilidad. Revise los resultados del descubrimiento automatizado y finalice la clasificación si es necesario.",
            "guid": "d401509b-2629-4484-9a7f-af0d29a7778f",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/data-discovery-and-classification-overview?view=azuresql#faq---advanced-classification-capabilities",
            "severity": "Bajo",
            "subcategory": "Descubrimiento y clasificación de datos",
            "text": "Planificar y configurar la clasificación y descubrimiento de datos para proteger los datos confidenciales"
        },
        {
            "category": "Enmascaramiento de datos",
            "description": "El uso de esta característica se recomienda solo si el cifrado de columnas no es una opción y existe un requisito específico para conservar los tipos y formatos de datos. El enmascaramiento dinámico de datos limita la exposición de datos confidenciales al enmascararlos a usuarios sin privilegios. El enmascaramiento dinámico de datos ayuda a evitar el acceso no autorizado a datos confidenciales al permitir a los clientes designar la cantidad de datos confidenciales que se revelarán con un impacto mínimo en la capa de aplicación.",
            "guid": "9391fd50-135e-453e-90a7-c1a23f88cc13",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/dynamic-data-masking-overview",
            "severity": "Bajo",
            "subcategory": "Enmascaramiento de datos",
            "text": "Utilice el enmascaramiento de datos para evitar el acceso no autorizado a los datos de usuarios no administradores si no es posible el cifrado"
        },
        {
            "category": "Defensor",
            "description": "SQL Advanced Threat Detection (ATP) proporciona una capa de seguridad que detecta posibles vulnerabilidades y actividad anómala en bases de datos, como ataques de inyección SQL y patrones de comportamiento inusuales. Cuando se detecta una amenaza potencial, Detección de amenazas envía una alerta procesable en tiempo real por correo electrónico y en Microsoft Defender para la nube, que incluye pasos claros de investigación y corrección para la amenaza específica.",
            "guid": "4e52d73f-5d37-428f-b3a2-e6997e835979",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure",
            "severity": "Alto",
            "subcategory": "Protección avanzada contra amenazas",
            "text": "Revisar y completar la configuración de Advanced Threat Protection (ATP)"
        },
        {
            "category": "Defensor",
            "description": "Habilite Microsoft Defender para Azure SQL en el nivel de suscripción para incorporar y proteger automáticamente todos los servidores y bases de datos existentes y futuros. Cuando se habilita en el nivel de suscripción, todas las bases de datos de Base de datos SQL de Azure y Instancia administrada de SQL de Azure están protegidas. A continuación, puede deshabilitarlos individualmente si lo desea. Si desea administrar manualmente qué bases de datos están protegidas, deshabilite en el nivel de suscripción y habilite cada base de datos que desee proteger.",
            "guid": "dff87489-9edb-4cef-bdda-86e8212b2aa1",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/azure-defender-for-sql?view=azuresql#enable-microsoft-defender-for-sql ",
            "severity": "Alto",
            "subcategory": "Defender para Azure SQL",
            "text": "Habilitar Microsoft Defender para Azure SQL"
        },
        {
            "category": "Defensor",
            "description": "Microsoft Defender para Azure SQL ATP detecta actividades anómalas que indican intentos inusuales y potencialmente dañinos de acceso a bases de datos o aprovecharlas. Las alertas se pueden configurar y generar, y se informarán en el Defender para consola.",
            "guid": "ca342fdf-d25a-4427-b105-fcd50ff8a0ea",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure",
            "severity": "Alto",
            "subcategory": "Defender para Azure SQL",
            "text": "Preparar un plan de respuesta de seguridad para reaccionar rápidamente a las alertas SQL de Microsoft Defender para Azure"
        },
        {
            "category": "Defensor",
            "description": "La evaluación de vulnerabilidades de Azure SQLDB es un servicio que proporciona visibilidad del estado de seguridad. La evaluación de vulnerabilidades incluye pasos prácticos para resolver problemas de seguridad y mejorar la seguridad de la base de datos. Puede ayudarle a supervisar un entorno de base de datos dinámico donde los cambios son difíciles de rastrear y mejorar su postura de seguridad SQL.",
            "guid": "a6101ae7-534c-45ab-86fd-b34c55ea21ca",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-overview",
            "severity": "Alto",
            "subcategory": "Evaluación de vulnerabilidades",
            "text": "Configurar los hallazgos de la evaluación de vulnerabilidades (VA) y revisar las recomendaciones"
        },
        {
            "category": "Defensor",
            "description": "Microsoft Defender para la nube proporciona una evaluación de vulnerabilidades para las bases de datos SQL de Azure. La evaluación de vulnerabilidades analiza las bases de datos en busca de vulnerabilidades de software y proporciona una lista de hallazgos. Puede usar los hallazgos para corregir vulnerabilidades de software y deshabilitar hallazgos.",
            "guid": "c8c5f112-1e50-4f77-9264-8195b4cd61ac",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-find?view=azuresql",
            "severity": "Alto",
            "subcategory": "Evaluación de vulnerabilidades",
            "text": "Revisar regularmente los hallazgos y recomendaciones de la Evaluación de Vulnerabilidades (VA) y preparar un plan para corregir"
        },
        {
            "category": "Encriptación",
            "description": "Always Encrypted with Secure Enclaves amplía las capacidades informáticas confidenciales de Always Encrypted al permitir el cifrado in situ y consultas confidenciales más ricas. Always Encrypted with Secure Enclaves aborda estas limitaciones al permitir algunos cálculos en datos de texto sin formato dentro de un enclave seguro en el lado del servidor. Se recomienda el uso de esta función para los casos en los que necesite limitar el acceso de administrador y necesite que sus consultas admitan más que la coincidencia de igualdad de columnas cifradas.",
            "guid": "65d7e54a-10a6-4094-b673-9ff3809c9277",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/encryption/always-encrypted-enclaves",
            "severity": "Medio",
            "subcategory": "Siempre encriptado",
            "text": "Si proteger los datos PII confidenciales de los usuarios administradores es un requisito clave, pero no se pueden tolerar las limitaciones del cifrado de columnas, considere la adopción de Always Encrypted with Secure Enclaves"
        },
        {
            "category": "Encriptación",
            "description": "Con Base de datos SQL de Azure, puede aplicar cifrado simétrico a una columna de datos mediante Transact-SQL. Este enfoque se denomina cifrado de columnas, ya que puede usarlo para cifrar columnas específicas con diferentes claves de cifrado. Hacerlo le brinda una capacidad de cifrado más granular que TDE, que cifra los datos en las páginas. Usar Always Encrypted para garantizar que los datos confidenciales no se expongan en texto sin formato en Base de datos SQL de Azure o Instancia administrada de SQL, incluso en memoria o en uso. Always Encrypted protege los datos de los administradores de bases de datos (DBA) y los administradores de la nube (o los malos actores que pueden hacerse pasar por usuarios con altos privilegios pero no autorizados) y le da más control sobre quién puede acceder a sus datos.",
            "guid": "c03ce136-e3d5-4e17-bf25-ed955ee480d3",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#control-access-of-application-users-to-sensitive-data-through-encryption",
            "severity": "Bajo",
            "subcategory": "Cifrado de columnas",
            "text": "Para proteger los datos confidenciales de PII de usuarios que no son administradores en columnas de tabla específicas, considere la posibilidad de usar el cifrado de columnas"
        },
        {
            "category": "Encriptación",
            "description": "Habilitado de forma predeterminada, el cifrado de datos transparente (TDE) ayuda a proteger los archivos de base de datos contra la divulgación de información mediante el cifrado y descifrado en tiempo real de la base de datos, las copias de seguridad asociadas y los archivos de registro de transacciones \"en reposo\", sin necesidad de realizar cambios en la aplicación.",
            "guid": "c614ac47-bebf-4061-b0a1-43e0c6b5e00d",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server",
            "severity": "Alto",
            "subcategory": "Cifrado de datos transparente",
            "text": "Asegúrese de que el cifrado de datos transparente (TDE) se mantenga habilitado"
        },
        {
            "category": "Encriptación",
            "description": "Si se requiere la separación de tareas en la administración de claves y datos dentro de la organización, aproveche Customer Managed Keys (CMK) for Transparent Data Encryption (TDE) para su SQLDB de Azure y use Azure Key Vault para almacenar (consulte su lista de comprobación). Aproveche esta característica cuando tenga requisitos de seguridad estrictos que no puedan cumplir las claves de servicio administradas.",
            "guid": "2edb4165-4f54-47cc-a891-5c82c2f21e25",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-overview",
            "severity": "Medio",
            "subcategory": "Cifrado de datos transparente",
            "text": "Use claves administradas por el cliente (CMK) en Azure Key Vault (AKV) si necesita mayor transparencia y control granular sobre la protección TDE"
        },
        {
            "category": "Encriptación",
            "description": "La configuración de versión mínima de Seguridad de la capa de transporte (TLS) permite a los clientes elegir qué versión de TLS utiliza su base de datos SQL. Es posible cambiar la versión mínima de TLS mediante Azure Portal, Azure PowerShell y la CLI de Azure.",
            "guid": "7754b605-57fd-4bcb-8213-52c39d8e8225",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-settings?source=recommendations&view=azuresql&tabs=azure-portal#minimal-tls-version",
            "severity": "Alto",
            "subcategory": "Seguridad de la capa de transporte",
            "text": "Aplicar la versión mínima de TLS a la última disponible"
        },
        {
            "category": "Identidad",
            "description": "Use la autenticación de Azure Active Directory (Azure AD) para la administración centralizada de identidades. Utilice la autenticación de SQL solo si es realmente necesario y documente como excepciones.",
            "guid": "c9b8b6bf-2c6b-453d-b400-de9a43a549d7",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-overview",
            "severity": "Medio",
            "subcategory": "Azure Active Directory",
            "text": "Aprovechar la autenticación de Azure AD para las conexiones a Bases de datos SQL de Azure"
        },
        {
            "category": "Identidad",
            "description": "El uso de grupos de Azure AD simplifica la administración de permisos y tanto el propietario del grupo como el propietario del recurso pueden agregar o quitar miembros del grupo. Cree un grupo independiente para los administradores de Azure AD para cada servidor lógico. Supervise los cambios de pertenencia a grupos de Azure AD mediante los informes de actividad de auditoría de Azure AD.",
            "guid": "29820254-1d14-4778-ae90-ff4aeba504a3",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#central-management-for-identities",
            "severity": "Medio",
            "subcategory": "Azure Active Directory",
            "text": "Creación de un grupo de Azure AD independiente con dos cuentas de administrador para cada servidor lógico de Base de datos SQL de Azure"
        },
        {
            "category": "Identidad",
            "description": "Asegúrese de que se usan distintas identidades administradas asignadas por el sistema y el usuario, dedicadas a la función, con menos permisos asignados, para la comunicación entre los servicios y aplicaciones de Azure a las bases de datos SQLDB de Azure.",
            "guid": "df3a09ee-03bb-4198-8637-d141acf5f289",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#minimize-the-use-of-password-based-authentication-for-applications",
            "severity": "Medio",
            "subcategory": "Azure Active Directory",
            "text": "Minimice el uso de la autenticación basada en contraseña para las aplicaciones"
        },
        {
            "category": "Identidad",
            "description": "Las identidades administradas asignadas por el sistema o el usuario permiten que Azure SQLDB se autentique en otros servicios en la nube (por ejemplo, Azure Key Vault) sin almacenar credenciales en el código. Una vez habilitado, se pueden conceder todos los permisos necesarios a través de Azure role-based-access-control a la instancia específica de Azure SQLDB. No comparta identidades administradas asignadas por el usuario en varios servicios si no es estrictamente necesario.",
            "guid": "69891194-5074-4e30-8f69-4efc3c580900",
            "link": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview",
            "severity": "Bajo",
            "subcategory": "Identidades administradas",
            "text": "Asignación de una identidad administrada a Base de datos SQL de Azure para el acceso a recursos salientes"
        },
        {
            "category": "Identidad",
            "description": "Use una autenticación integrada de Azure AD que elimine el uso de contraseñas. Los métodos de autenticación basados en contraseña son una forma más débil de autenticación. Las credenciales pueden verse comprometidas o regalarse por error. Use la autenticación de inicio de sesión único con credenciales de Windows. Federe el dominio de AD local con Azure AD y use la autenticación integrada de Windows (para máquinas unidas a un dominio con Azure AD).",
            "guid": "88287d4a-8bb8-4640-ad78-03f51354d003",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-configure?view=azuresql&tabs=azure-powershell#active-directory-integrated-authentication",
            "severity": "Medio",
            "subcategory": "Contraseñas",
            "text": "Minimice el uso de la autenticación basada en contraseña para los usuarios"
        },
        {
            "category": "Libro mayor",
            "description": "El hash del último bloque en el libro mayor de la base de datos se denomina resumen de la base de datos. Representa el estado de todas las tablas de contabilidad de la base de datos en el momento en que se generó el bloque. Generar un resumen de base de datos es eficiente, ya que implica calcular solo los hashes de los bloques que se agregaron recientemente. Azure Confidential Ledger es uno de los almacenes compatibles, se puede usar y admite la generación y el almacenamiento automáticos de resúmenes de bases de datos. Azure Ledger proporciona características de seguridad avanzadas como Blockchain Ledger Proof y Confidential Hardware Enclaves. Úselo solo si se requieren características de seguridad avanzadas y, de lo contrario, vuelva al almacenamiento de Azure.",
            "guid": "0e853380-50ba-4bce-b2fd-5c7391c85ecc",
            "link": "https://learn.microsoft.com/azure/architecture/guide/technology-choices/multiparty-computing-service#confidential-ledger-and-azure-blob-storage",
            "severity": "Medio",
            "subcategory": "Resumen de base de datos",
            "text": "Usar Azure Confidential Ledger para almacenar resúmenes de base de datos solo si se requieren características de seguridad avanzadas"
        },
        {
            "category": "Libro mayor",
            "description": "El hash del último bloque en el libro mayor de la base de datos se denomina resumen de la base de datos. Representa el estado de todas las tablas de contabilidad de la base de datos en el momento en que se generó el bloque. Generar un resumen de base de datos es eficiente, ya que implica calcular solo los hashes de los bloques que se agregaron recientemente. La característica Azure Blob Storage with Immutable Storage se puede usar y admite la generación y el almacenamiento automáticos de resúmenes de bases de datos. Para evitar la manipulación de los archivos de resumen, configure y bloquee una directiva de retención para el contenedor.",
            "guid": "afefb2d3-95da-4ac9-acf5-33d18b32ef9a",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-digest-management",
            "severity": "Medio",
            "subcategory": "Resumen de base de datos",
            "text": "Si se usa la cuenta de almacenamiento de Azure para almacenar resúmenes de base de datos, asegúrese de que la seguridad esté configurada correctamente"
        },
        {
            "category": "Libro mayor",
            "description": "El libro mayor proporciona una forma de integridad de datos denominada integridad hacia adelante, que proporciona evidencia de manipulación de datos en los datos de las tablas del libro mayor. El proceso de verificación de la base de datos toma como entrada uno o más resúmenes de base de datos generados previamente. A continuación, vuelve a calcular los hashes almacenados en el libro mayor de la base de datos en función del estado actual de las tablas del libro mayor. Si los hashes calculados no coinciden con los resúmenes de entrada, se produce un error en la verificación. El error indica que los datos han sido manipulados. El proceso de verificación informa de todas las inconsistencias que detecta.",
            "guid": "f8d4ffda-8aac-4cc6-b72b-c81cb8625420",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-database-verification",
            "severity": "Medio",
            "subcategory": "Integridad",
            "text": "Programe el proceso de verificación del libro mayor regularmente para verificar la integridad de los datos"
        },
        {
            "category": "Libro mayor",
            "description": "La función Ledger proporciona capacidades de evidencia de manipulación en su base de datos. Puede dar fe criptográficamente a otras partes, como auditores u otras partes comerciales, de que sus datos no han sido manipulados. Ledger ayuda a proteger los datos de cualquier atacante o usuario con privilegios altos, incluidos los administradores de bases de datos (DBA), los administradores de sistemas y los administradores de la nube.",
            "guid": "2563f498-e2d3-42ea-9e7b-5517881a06a2",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-overview",
            "severity": "Medio",
            "subcategory": "Libro mayor",
            "text": "Si la prueba criptográfica de la integridad de los datos es un requisito crítico, se debe considerar la función Ledger"
        },
        {
            "category": "Libro mayor",
            "description": "Dependiendo del tipo de manipulación, hay casos en los que puede reparar el libro mayor sin perder datos. En el artículo contenido en la columna --Más información-- se describen diferentes escenarios y técnicas de recuperación.",
            "guid": "804fc554-6554-4842-91c1-713b32f99902",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-how-to-recover-after-tampering",
            "severity": "Medio",
            "subcategory": "Recuperación",
            "text": "Preparar un plan de respuesta para investigar y reparar una base de datos después de un evento de manipulación"
        },
        {
            "category": "Registro",
            "description": "Azure SQL Database Auditing realiza un seguimiento de los eventos de la base de datos y los escribe en un registro de auditoría de la cuenta de almacenamiento de Azure. La auditoría le ayuda a comprender la actividad de la base de datos y a obtener información sobre discrepancias y anomalías que podrían indicar problemas empresariales o sospechas de infracciones de seguridad, así como a cumplir las normativas. De forma predeterminada, la directiva de auditoría incluye todas las acciones (consultas, procedimientos almacenados e inicios de sesión correctos y erróneos) en las bases de datos, lo que puede dar lugar a un gran volumen de registros de auditoría. Se recomienda que los clientes configuren la auditoría para diferentes tipos de acciones y grupos de acciones mediante PowerShell.",
            "guid": "4082e31d-35f4-4a49-8507-d3172cc930a6",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
            "severity": "Medio",
            "subcategory": "Auditoría",
            "text": "Asegúrese de que Azure SQL Database Auditing está habilitado en el nivel de servidor"
        },
        {
            "category": "Registro",
            "description": "Los registros de auditoría de Base de datos SQL de Azure se pueden escribir en cuentas de almacenamiento externo, en el área de trabajo de Log Analytics o en el Centro de eventos. Asegúrese de proteger el repositorio de destino mediante copias de seguridad y configuración segura. Use Azure SQL Database Managed Identity para acceder al almacenamiento y establecer un período de retención explícito. No conceda permisos a los administradores para el repositorio del registro de auditoría. Utilice un almacenamiento de destino diferente para --Habilitación de la auditoría de las operaciones de soporte técnico de Microsoft--. ",
            "guid": "9b64bc50-b60f-4035-bf7a-28c4806dfb46",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
            "severity": "Bajo",
            "subcategory": "Auditoría",
            "text": "Asegúrese de que los registros de auditoría de Base de datos SQL de Azure están respaldados y protegidos en el tipo de repositorio seleccionado"
        },
        {
            "category": "Registro",
            "description": "El registro de actividad de Azure Monitor es un registro de plataforma en Azure que proporciona información sobre los eventos de nivel de suscripción. El registro de actividad incluye información como cuando se modifica un recurso. Se recomienda enviar este registro de actividad al mismo repositorio de almacenamiento externo que el registro de auditoría de Base de datos SQL de Azure (cuenta de almacenamiento, área de trabajo de Log Analytics, Centro de eventos).",
            "guid": "fcd34708-87ac-4efc-aaf6-57a47f76644a",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
            "severity": "Medio",
            "subcategory": "Auditoría",
            "text": "Asegúrese de que el registro de actividad de Base de datos SQL de Azure se recopila e integra con los registros de auditoría"
        },
        {
            "category": "Registro",
            "description": "Reenvíe los registros de Azure SQL a su administración de eventos e información de seguridad (SIEM) y a Security Orchestration Automation and Response (SOAR). Asegúrese de que está supervisando diferentes tipos de activos de Azure para detectar posibles amenazas y anomalías. Concéntrese en obtener alertas de alta calidad para reducir los falsos positivos para que los analistas los clasifiquen. Las alertas pueden obtenerse de datos de registro, agentes u otros datos.",
            "guid": "f96e127e-9572-453a-b325-ff89ae9f6b44",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview",
            "severity": "Medio",
            "subcategory": "SIEM/SOAR",
            "text": "Asegúrese de que los registros de auditoría de Base de datos SQL de Azure se presentan en SIEM/SOAR de su organización"
        },
        {
            "category": "Registro",
            "description": "Reenvíe los registros de Azure SQL a su Administración de eventos e información de seguridad (SIEM) y Automatización y respuesta de orquestación de seguridad (SOAR), que se pueden usar para configurar detecciones de amenazas personalizadas. Asegúrese de que está supervisando diferentes tipos de activos de Azure para detectar posibles amenazas y anomalías. Concéntrese en obtener alertas de alta calidad para reducir los falsos positivos para que los analistas los clasifiquen. Las alertas pueden obtenerse de datos de registro, agentes u otros datos.",
            "guid": "41503bf8-73da-4a10-af9f-5f7fceb5456f",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
            "severity": "Medio",
            "subcategory": "SIEM/SOAR",
            "text": "Asegúrese de que los datos del registro de actividad de Base de datos SQL de Azure se presentan en su SIEM/SOAR"
        },
        {
            "category": "Registro",
            "description": "El equipo del Centro de Operaciones de Seguridad (SOC) debe crear un plan de respuesta a incidentes (cuadernos de jugadas o respuestas manuales) para investigar y mitigar la manipulación, las actividades maliciosas y otros comportamientos anómalos.",
            "guid": "19ec7c97-c563-4e1d-82f0-54d6ec12e754",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
            "severity": "Medio",
            "subcategory": "SIEM/SOAR",
            "text": "Asegúrese de que tiene planes de respuesta para eventos de registro de auditoría malintencionados o aberrantes"
        },
        {
            "category": "Gestión de redes",
            "description": "Al crear un servidor lógico desde Azure Portal para Base de datos SQL de Azure, el resultado es un punto de conexión público visible y accesible a través de la red pública (acceso público). A continuación, puede limitar la conectividad en función de las reglas de firewall y Service Endpoint. También puede configurar la conectividad privada limitando solo las conexiones a redes internas mediante Private Endpoint (Private Access). El acceso privado mediante un punto de conexión privado debe ser el valor predeterminado, a menos que se aplique un caso de negocio o una razón técnica o de rendimiento que no pueda admitirlo. El uso de puntos finales privados tiene implicaciones de rendimiento que deben tenerse en cuenta y evaluarse.",
            "guid": "2c6d356a-1784-475b-a42c-ec187dc8c925",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview",
            "severity": "Alto",
            "subcategory": "Conectividad",
            "text": "Revise los métodos de conectividad de acceso público frente al acceso privado y seleccione el adecuado para la carga de trabajo"
        },
        {
            "category": "Gestión de redes",
            "description": "IMPORTANTE: Las conexiones a un punto de enlace privado solo admiten proxy como directiva de conexión. Cuando se usan puntos de conexión privados, las conexiones se envían mediante proxy a través de la puerta de enlace de Base de datos SQL de Azure a los nodos de la base de datos. Los clientes no tendrán una conexión directa.",
            "guid": "557b3ce5-bada-4296-8d52-a2d447bc1718",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-architecture",
            "severity": "Bajo",
            "subcategory": "Conectividad",
            "text": "Mantener la directiva de conexión predeterminada de Base de datos SQL de Azure si no se requiere y justifica de manera diferente"
        },
        {
            "category": "Gestión de redes",
            "description": "Esta opción configura el firewall para permitir todas las conexiones de Azure, incluidas las conexiones de las suscripciones de otros clientes. Si selecciona esta opción, asegúrese de que sus permisos de inicio de sesión y de usuario limiten el acceso solo a usuarios autorizados. Si no es estrictamente necesario, mantenga esta configuración en OFF.",
            "guid": "f48efacf-4405-4e8d-9dd0-16c5302ed082",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview",
            "severity": "Alto",
            "subcategory": "Conectividad",
            "text": "Asegúrese de que la opción Permitir que los servicios y recursos de Azure accedan a este servidor esté deshabilitada en el firewall de Base de datos SQL de Azure."
        },
        {
            "category": "Gestión de redes",
            "description": "Base de datos SQL de Azure tiene una nueva característica integrada que permite la integración nativa con puntos de conexión REST externos. Esto significa que la integración de Azure SQL Database con Azure Functions, Azure Logic Apps, Cognitive Services, Event Hubs, Event Grid, Azure Containers, API Management y, en general, cualquier punto de conexión REST o incluso GraphQL. Si no se restringe correctamente, el código dentro de una base de datos de Base de datos SQL de Azure podría aprovechar este mecanismo para filtrar datos. Si no es estrictamente necesario, se recomienda bloquear o restringir esta función mediante las reglas de firewall saliente.",
            "guid": "cb3274a7-e36d-46f6-8de5-46d30c8dde8e",
            "link": "https://learn.microsoft.com/sql/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql",
            "severity": "Medio",
            "subcategory": "Control de salida",
            "text": "Bloquear o restringir las llamadas salientes a la API de REST a puntos de conexión externos"
        },
        {
            "category": "Gestión de redes",
            "description": "Las reglas de firewall saliente limitan el tráfico de red desde el servidor lógico de Base de datos SQL de Azure a una lista definida por el cliente de cuentas de almacenamiento de Azure y servidores lógicos de Base de datos SQL de Azure. Se deniega cualquier intento de obtener acceso a cuentas de almacenamiento o bases de datos que no estén en esta lista.",
            "guid": "a566dd3d-314e-4a94-9378-102c42d82b38",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/outbound-firewall-rule-overview",
            "severity": "Medio",
            "subcategory": "Control de salida",
            "text": "Si se requiere acceso a la red saliente, se recomienda configurar las restricciones de red salientes mediante la característica de control integrada Base de datos SQL de Azure."
        },
        {
            "category": "Gestión de redes",
            "description": "Private Endpoint se crea dentro de una subred en una red virtual de Azure. La configuración de seguridad adecuada debe aplicarse también al entorno de red que lo contiene, incluidos NSG / ASG, UDR, firewall, monitoreo y auditoría.",
            "guid": "246cd832-f550-4af0-9c74-ca9baeeb8860",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server",
            "severity": "Medio",
            "subcategory": "Acceso privado",
            "text": "Si se usa la conectividad de acceso privado, asegúrese de que está usando las listas de comprobación Punto de conexión privado, Red virtual de Azure, Firewall de Azure y Grupo de seguridad de red de Azure."
        },
        {
            "category": "Gestión de redes",
            "description": "Al agregar una conexión de extremo privado, el enrutamiento público al servidor lógico no se bloquea de forma predeterminada. En el panel --Firewall y redes virtuales-- , la configuración --Denegar acceso a la red pública-- no está seleccionada de forma predeterminada. Para deshabilitar el acceso a la red pública, asegúrese de seleccionar --Denegar acceso a la red pública--.",
            "guid": "3a0808ee-ea7a-47ab-bdce-920a6a2b3881",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server",
            "severity": "Alto",
            "subcategory": "Acceso privado",
            "text": "Si se usa el extremo privado (acceso privado), considere la posibilidad de deshabilitar la conectividad de acceso público"
        },
        {
            "category": "Gestión de redes",
            "description": "El grupo de seguridad de red (NSG) y el grupo de seguridad de aplicaciones (ASG) ahora se pueden aplicar a subredes que contienen puntos de conexión privados para restringir las conexiones a Azure SQLDB en función de intervalos IP de origen internos.",
            "guid": "8600527e-e8c4-4424-90ef-1f0dca0224f2",
            "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview#network-security-of-private-endpoints",
            "severity": "Medio",
            "subcategory": "Acceso privado",
            "text": "Si se usa Private Endpoint (Private Access), aplique NSG y, finalmente, ASG para limitar los intervalos de direcciones IP de origen entrantes"
        },
        {
            "category": "Gestión de redes",
            "description": "Una instancia administrada (SQL MI) se puede aislar dentro de una red virtual para evitar el acceso externo. Las aplicaciones y herramientas que se encuentran en la misma red virtual o emparejada en la misma región podrían acceder a ella directamente. Las aplicaciones y herramientas que se encuentran en diferentes regiones podrían usar la conexión de red virtual a red virtual o el emparejamiento de circuitos ExpressRoute para establecer la conexión. El cliente debe usar grupos de seguridad de red (NSG) y, finalmente, firewalls internos, para restringir el acceso a través del puerto 1433 solo a los recursos que requieren acceso a una instancia administrada.",
            "guid": "18123ef4-a0a6-45e3-87fe-7f454f65d975",
            "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/connectivity-architecture-overview",
            "severity": "Medio",
            "subcategory": "Acceso privado",
            "text": "Aplicación de grupos de seguridad de red (NSG) y reglas de firewall para restringir el acceso a la subred interna de Azure SQL Managed Instance"
        },
        {
            "category": "Gestión de redes",
            "description": "Azure Virtual Network Service Endpoint es la solución preferida si desea establecer una conexión directa con los nodos back-end de Base de datos SQL de Azure mediante la directiva Redirect. Esto permitirá el acceso en modo de alto rendimiento y es el enfoque recomendado desde una perspectiva de rendimiento.",
            "guid": "55187443-6852-4fbd-99c6-ce303597ca7f",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview?view=azuresql#ip-vs-virtual-network-firewall-rules",
            "severity": "Alto",
            "subcategory": "Acceso público",
            "text": "Si se usa la conectividad de acceso público, aproveche Service Endpoint para restringir el acceso desde redes virtuales de Azure seleccionadas"
        },
        {
            "category": "Gestión de redes",
            "description": "El firewall de Base de datos SQL de Azure permite especificar intervalos de direcciones IP desde los que se aceptan las comunicaciones. Este enfoque está bien para direcciones IP estables que están fuera de la red privada de Azure.",
            "guid": "a73e32da-b3f4-4960-b5ec-2f42a557bf31",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview",
            "severity": "Medio",
            "subcategory": "Acceso público",
            "text": "Si se usa conectividad de acceso público, asegúrese de que solo se agreguen IP conocidas específicas al firewall."
        },
        {
            "category": "Gestión de redes",
            "description": "Se recomienda utilizar reglas de firewall IP de nivel de base de datos siempre que sea posible. Esta práctica mejora la seguridad y hace que su base de datos sea más portátil. Utilice reglas de firewall IP de nivel de servidor para los administradores. Utilícelos también cuando tenga muchas bases de datos que tengan los mismos requisitos de acceso y no desee configurar cada base de datos individualmente.",
            "guid": "e0f31ac9-35c8-4bfd-9865-edb60ffc6768",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/firewall-configure",
            "severity": "Bajo",
            "subcategory": "Acceso público",
            "text": "Si las reglas de firewall de Base de datos SQL de Azure usan y controlan la conectividad de acceso público, use reglas IP de nivel de base de datos sobre de nivel de servidor"
        },
        {
            "category": "Gestión de redes",
            "description": "Una instancia administrada (SQL MI) se puede aislar dentro de una red virtual para evitar el acceso externo. El punto de enlace público de instancia administrada no está habilitado de forma predeterminada, debe habilitarse explícitamente, solo si es estrictamente necesario. Si la directiva de la empresa no permite el uso de puntos de conexión públicos, use Azure Policy para evitar la habilitación de puntos de conexión públicos en primer lugar.",
            "guid": "b8435656-143e-41a8-9922-61d34edb751a",
            "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview",
            "severity": "Alto",
            "subcategory": "Acceso público",
            "text": "No habilitar el punto de conexión público de Azure SQL Managed Instance"
        },
        {
            "category": "Gestión de redes",
            "description": "Un extremo público de instancia administrada (SQL MI) no está habilitado de forma predeterminada, debe habilitarse explícitamente, solo si es estrictamente necesario. En este caso, se recomienda aplicar un grupo de seguridad de red (NSG) para restringir el acceso al puerto 3342 solo a las direcciones IP de origen de confianza.",
            "guid": "057dd298-8726-4aa6-b590-1f81d2e30421",
            "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview",
            "severity": "Alto",
            "subcategory": "Acceso público",
            "text": "Restringir el acceso si se requiere un punto de conexión público de Azure SQL Managed Instance"
        },
        {
            "category": "Acceso privilegiado",
            "description": "La mayoría de las operaciones, el soporte técnico y la solución de problemas realizados por el personal y los subprocesadores de Microsoft no requieren acceso a los datos del cliente. En las raras circunstancias en las que se requiere dicho acceso, Customer Lockbox for Microsoft Azure proporciona una interfaz para que los clientes revisen y aprueben o rechacen las solicitudes de acceso a los datos del cliente.  En escenarios de soporte técnico en los que Microsoft necesita acceder a los datos del cliente, Base de datos SQL de Azure admite Customer Lockbox para proporcionar una interfaz para que pueda revisar y aprobar o rechazar las solicitudes de acceso a datos del cliente.",
            "guid": "37b6eb0f-553d-488f-8a8a-cb9bf97388ff",
            "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview",
            "severity": "Bajo",
            "subcategory": "Caja",
            "text": "Revisión y habilitación del acceso de Microsoft a Customer Lockbox para Azure SQL Database"
        },
        {
            "category": "Acceso privilegiado",
            "description": "El principio de privilegios mínimos establece que los usuarios no deben tener más privilegios de los necesarios para completar sus tareas. Los usuarios de bases de datos y servidores con privilegios altos pueden realizar muchas actividades de configuración y mantenimiento en la base de datos y también pueden quitar bases de datos en la instancia de Azure SQL. El seguimiento de los propietarios de bases de datos y las cuentas privilegiadas es importante para evitar tener permisos excesivos.",
            "guid": "5fe5281f-f0f9-4842-a682-8baf18bd8316",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#implement-principle-of-least-privilege",
            "severity": "Medio",
            "subcategory": "Permisos",
            "text": "Asegúrese de que a los usuarios se les asigne el nivel mínimo de acceso necesario para completar sus funciones de trabajo"
        },
        {
            "category": "Acceso privilegiado",
            "description": "El ámbito de las identidades (tanto Usuarios como SPN) debe tener la menor cantidad de acceso necesaria para realizar la función.  Se debe usar un mayor número de SPN de ámbito estricto, en lugar de tener un SPN con varios conjuntos de permisos no relacionados. Por ejemplo, si hay tres aplicaciones web externas hospedadas localmente que realizan consultas a Base de datos SQL de Azure, no todas deben usar el mismo SPN para estas actividades.  En su lugar, cada uno debe tener su propio SPN de alcance estricto.",
            "guid": "7b5b55e5-4750-4920-be97-eb726c256a5c",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#im-3-use-azure-ad-single-sign-on-sso-for-application-access",
            "severity": "Bajo",
            "subcategory": "Permisos",
            "text": "Asegúrese de que a distintas aplicaciones se les asignarán credenciales diferentes con permisos mínimos para acceder a Base de datos SQL de Azure."
        }
    ],
    "metadata": {
        "name": "Azure SQLDB Security Checklist (Preview)"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Medio"
        },
        {
            "name": "Bajo"
        }
    ],
    "status": [
        {
            "description": "Esta comprobación aún no se ha examinado",
            "name": "No verificado"
        },
        {
            "description": "Hay un elemento de acción asociado a esta comprobación",
            "name": "Abrir"
        },
        {
            "description": "Esta comprobación se ha comprobado y no hay más elementos de acción asociados a ella",
            "name": "Cumplido"
        },
        {
            "description": "Recomendación entendida, pero no necesaria por los requisitos actuales",
            "name": "No es necesario"
        },
        {
            "description": "No aplicable para el diseño actual",
            "name": "N/A"
        }
    ]
}
checklists/sqldb_security_checklist.en.json METASEP
{
    "$schema": "checklist.schema.json",
    "items": [
        {
            "category": "BCDR",
            "subcategory": "Azure Key Vault",
            "text": "Protect your backup data with encryption and store keys safely in Azure Key Vault",
            "description": "Ensure that your backups are protected against attacks. This should include encryption of the backups to protect against loss of confidentiality. For regular Azure service backup, backup data is automatically encrypted using Azure platform-managed keys. You can also choose to encrypt the backup using a customer-managed key. In this case, ensure this customer-managed key in the key vault is also in the backup scope.",
            "guid": "676f6951-0368-49e9-808d-c33a692c9a64",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-2-encrypt-backup-data"
        },
        {
            "category": "BCDR",
            "subcategory": "Backup",
            "text": "Configure Azure SQL Database automated backups",
            "description": "Azure SQL Database uses SQL Server technology to create full backups every week, differential backup every 12-24 hours, and transaction log backup every 5 to 10 minutes. By default, SQL Database stores data in geo-redundant storage blobs that are replicated to a paired region.",
            "guid": "e2518261-b3bc-4bd1-b331-637fb2df833f",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-1-ensure-regular-automated-backups"
        },
        {
            "category": "BCDR",
            "subcategory": "Backup",
            "text": "Enable geo-redundant backup storage to protect against single region failure and data loss",
            "description": "By default, SQL Database stores data in geo-redundant storage blobs that are replicated to a paired region. For SQL Database, the backup storage redundancy can be configured at the time of database creation or can be updated for an existing database; the changes made to an existing database apply to future backups only.",
            "guid": "f8c7cda2-3ed7-43fb-a100-85dcd12a0ee4",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/automated-backups-overview?tabs=single-database&view=azuresql#backup-storage-redundancy"
        },
        {
            "category": "Code",
            "subcategory": "Source Control and Code Review",
            "text": "Use Source Control systems to store, maintain and review application code deployed inside Azure SQLDB Database",
            "description": "Malicious code can potentially circumvent security controls. Before deploying custom code to production, it is essential to review what's being deployed. Use a database tool like Azure Data Studio that supports source control. Implement tools and logic for code analysis, vulnerability and credential scanning.",
            "guid": "7ca9f006-d2a9-4652-951c-de8e4ac5e76e",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server"
        },
        {
            "category": "Data Discovery and Classification",
            "subcategory": "Data Discovery and Classification",
            "text": "Plan and configure Data Discovery & Classification to protect the sensitive data",
            "description": "In case of classification requirements Purview is the preferred option. Only use SQL Data Discovery & Classification in case Purview is not an option. Discover columns that potentially contain sensitive data. What is considered sensitive data heavily depends on the customer, compliance regulation, etc., and needs to be evaluated by the users in charge of that data. Classify the columns to use advanced sensitivity-based auditing and protection scenarios. Review results of automated discovery and finalize the classification if necessary.",
            "guid": "d401509b-2629-4484-9a7f-af0d29a7778f",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/data-discovery-and-classification-overview?view=azuresql#faq---advanced-classification-capabilities"
        },
        {
            "category": "Data Masking",
            "subcategory": "Data Masking",
            "text": "Use Data Masking to prevent unauthorized non-admin users data access if no encryption is possible",
            "description": "Usage of this feature is recommended only if column encryption is not an option and there is a specific requirement to preserve data types and formats. Dynamic data masking limits sensitive data exposure by masking it to non-privileged users. Dynamic data masking helps prevent unauthorized access to sensitive data by enabling customers to designate how much of the sensitive data to reveal with minimal impact on the application layer.",
            "guid": "9391fd50-135e-453e-90a7-c1a23f88cc13",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/dynamic-data-masking-overview"
        },
        {
            "category": "Defender",
            "subcategory": "Advanced Threat Protection",
            "text": "Review and complete Advanced Threat Protection (ATP) configuration",
            "description": "SQL Advanced Threat Detection (ATP) provides a layer of security that detects potential vulnerabilities and anomalous activity in databases such as SQL injection attacks and unusual behavior patterns. When a potential threat is detected Threat Detection sends an actionable real-time alert by email and in Microsoft Defender for Cloud, which includes clear investigation and remediation steps for the specific threat.",
            "guid": "4e52d73f-5d37-428f-b3a2-e6997e835979",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure"
        },
        {
            "category": "Defender",
            "subcategory": "Defender for Azure SQL",
            "text": "Enable Microsoft Defender for Azure SQL",
            "description": "Enable Microsoft Defender for Azure SQL at the subscription level to automatically onboard and protect all existing and future servers and databases. When you enable on the subscription level, all databases in Azure SQL Database and Azure SQL Managed Instance are protected. You can then disable them individually if you choose. If you want to manually manage which databases are protected, disable at the subscription level and enable each database that you want protected.",
            "guid": "dff87489-9edb-4cef-bdda-86e8212b2aa1",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/azure-defender-for-sql?view=azuresql#enable-microsoft-defender-for-sql "
        },
        {
            "category": "Defender",
            "subcategory": "Defender for Azure SQL",
            "text": "Prepare a security response plan to promptly react to Microsoft Defender for Azure SQL alerts",
            "description": "Microsoft Defender for Azure SQL ATP detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases. Alerts can be configured and generated and will be reported in the Defender for console.",
            "guid": "ca342fdf-d25a-4427-b105-fcd50ff8a0ea",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure"
        },
        {
            "category": "Defender",
            "subcategory": "Vulnerability Assessment",
            "text": "Configure Vulnerability Assessment (VA) findings and review recommendations",
            "description": "Azure SQLDB vulnerability assessment is a service that provides visibility into your security state. Vulnerability assessment includes actionable steps to resolve security issues and enhance your database security. It can help you to monitor a dynamic database environment where changes are difficult to track and improve your SQL security posture.",
            "guid": "a6101ae7-534c-45ab-86fd-b34c55ea21ca",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-overview"
        },
        {
            "category": "Defender",
            "subcategory": "Vulnerability Assessment",
            "text": "Regularly review of Vulnerability Assessment (VA) findings and recommendations and prepare a plan to fix",
            "description": "Microsoft Defender for Cloud provides vulnerability assessment for your Azure SQL Databases. Vulnerability assessment scans your databases for software vulnerabilities and provides a list of findings. You can use the findings to remediate software vulnerabilities and disable findings.",
            "guid": "c8c5f112-1e50-4f77-9264-8195b4cd61ac",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-find?view=azuresql"
        },
        {
            "category": "Encryption",
            "subcategory": "Always Encrypted",
            "text": "If protecting sensitive PII data from admin users is a key requirement, but Column Encryption limitations cannot be tolerated, consider the adoption of Always Encrypted with Secure Enclaves",
            "description": "Always Encrypted with Secure Enclaves expands confidential computing capabilities of Always Encrypted by enabling in-place encryption and richer confidential queries. Always Encrypted with Secure Enclaves addresses these limitations by allowing some computations on plaintext data inside a secure enclave on the server side. Usage of this feature is recommended for the cases where you need to limit administrator access and need your queries to support more than equality matching of encrypted columns.",
            "guid": "65d7e54a-10a6-4094-b673-9ff3809c9277",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/encryption/always-encrypted-enclaves"
        },
        {
            "category": "Encryption",
            "subcategory": "Column Encryption",
            "text": "To protect sensitive PII data from non-admin users in specific table columns, consider using Column Encryption",
            "description": "With Azure SQL Database, you can apply symmetric encryption to a column of data by using Transact-SQL. This approach is called column encryption, because you can use it to encrypt specific columns with different encryption keys. Doing so gives you more granular encryption capability than TDE, which encrypts data in pages. Using Always Encrypted to ensure sensitive data isn't exposed in plaintext in Azure SQL Database or SQL Managed Instance, even in memory/in use. Always Encrypted protects the data from Database Administrators (DBAs) and cloud admins (or bad actors who can impersonate high-privileged but unauthorized users) and gives you more control over who can access your data.",
            "guid": "c03ce136-e3d5-4e17-bf25-ed955ee480d3",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#control-access-of-application-users-to-sensitive-data-through-encryption"
        },
        {
            "category": "Encryption",
            "subcategory": "Transparent Data Encryption",
            "text": "Ensure Transparent Data Encryption (TDE) is kept enabled",
            "description": "Enabled by default, Transparent data encryption (TDE) helps to protect the database files against information disclosure by performing real-time encryption and decryption of the database, associated backups, and transaction log files 'at rest', without requiring changes to the application.",
            "guid": "c614ac47-bebf-4061-b0a1-43e0c6b5e00d",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server"
        },
        {
            "category": "Encryption",
            "subcategory": "Transparent Data Encryption",
            "text": "Use customer-managed keys (CMK) in Azure Key Vault (AKV) if you need increased transparency and granular control over the TDE protection",
            "description": "If separation of duties in the management of keys and data within the organization is required, leverage Customer Managed Keys (CMK) for Transparent Data Encryption (TDE) for your Azure SQLDB and use Azure Key Vault to store (refer to its checklist). Leverage this feature when you have strict security requirements which cannot be met by the managed service keys.",
            "guid": "2edb4165-4f54-47cc-a891-5c82c2f21e25",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-overview"
        },
        {
            "category": "Encryption",
            "subcategory": "Transport Layer Security",
            "text": "Enforce minimum TLS version to the latest available",
            "description": "The minimal Transport Layer Security (TLS) version setting allows customers to choose which version of TLS their SQL database uses. It's possible to change the minimum TLS version by using the Azure portal, Azure PowerShell, and the Azure CLI.",
            "guid": "7754b605-57fd-4bcb-8213-52c39d8e8225",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-settings?source=recommendations&view=azuresql&tabs=azure-portal#minimal-tls-version"
        },
        {
            "category": "Identity",
            "subcategory": "Azure Active Directory",
            "text": "Leverage Azure AD authentication for connections to Azure SQL Databases",
            "description": "Use Azure Active Directory (Azure AD) authentication for centralized identity management. Use SQL Authentication only if really necessary and document as exceptions.",
            "guid": "c9b8b6bf-2c6b-453d-b400-de9a43a549d7",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-overview"
        },
        {
            "category": "Identity",
            "subcategory": "Azure Active Directory",
            "text": "Create a separate Azure AD group with two admin accounts for each Azure SQL Database logical server",
            "description": "Using Azure AD groups simplifies permission management and both the group owner, and the resource owner can add/remove members to/from the group. Create a separate group for Azure AD administrators for each  logical server. Monitor Azure AD group membership changes using Azure AD audit activity reports.",
            "guid": "29820254-1d14-4778-ae90-ff4aeba504a3",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#central-management-for-identities"
        },
        {
            "category": "Identity",
            "subcategory": "Azure Active Directory",
            "text": "Minimize the use of password-based authentication for applications",
            "description": "Ensure that distinct system and user assigned managed identities, that are dedicated to the function, with least permissions assigned, are used for communication from Azure services and applications to the Azure SQLDB databases.",
            "guid": "df3a09ee-03bb-4198-8637-d141acf5f289",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#minimize-the-use-of-password-based-authentication-for-applications"
        },
        {
            "category": "Identity",
            "subcategory": "Managed Identities",
            "text": "Assign Azure SQL Database a managed identity for outbound resource access",
            "description": "System or User assigned managed identities enable Azure SQLDB to authenticate to other cloud services (e.g. Azure Key Vault) without storing credentials in code. Once enabled, all necessary permissions can be granted via Azure role-based-access-control to the specific Azure SQLDB instance. Do not share user assigned managed identities across multiple services if not strictly required.",
            "guid": "69891194-5074-4e30-8f69-4efc3c580900",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview"
        },
        {
            "category": "Identity",
            "subcategory": "Passwords",
            "text": "Minimize the use of password-based authentication for users",
            "description": "Use an Azure AD integrated authentication that eliminates the use of passwords. Password-based authentication methods are a weaker form of authentication. Credentials can be compromised or mistakenly given away. Use single sign-on authentication using Windows credentials. Federate the on-premises AD domain with Azure AD and use integrated Windows authentication (for domain-joined machines with Azure AD).",
            "guid": "88287d4a-8bb8-4640-ad78-03f51354d003",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-configure?view=azuresql&tabs=azure-powershell#active-directory-integrated-authentication"
        },
        {
            "category": "Ledger",
            "subcategory": "Database Digest",
            "text": "Use Azure Confidential Ledger to store database digests only if advanced security features are required",
            "description": "The hash of the latest block in the database ledger is called the database digest. It represents the state of all ledger tables in the database at the time when the block was generated. Generating a database digest is efficient, because it involves computing only the hashes of the blocks that were recently appended. Azure Confidential Ledger is one of the supported store, it can be used and supports automatic generation and storage of database digests. Azure Ledger provides advanced security features like Blockchain Ledger Proof and Confidential Hardware Enclaves. Use it only if advanced security features are required, otherwise revert to Azure storage.",
            "guid": "0e853380-50ba-4bce-b2fd-5c7391c85ecc",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/architecture/guide/technology-choices/multiparty-computing-service#confidential-ledger-and-azure-blob-storage"
        },
        {
            "category": "Ledger",
            "subcategory": "Database Digest",
            "text": "If Azure storage account is used to store database digests, ensure security is properly configured",
            "description": "The hash of the latest block in the database ledger is called the database digest. It represents the state of all ledger tables in the database at the time when the block was generated. Generating a database digest is efficient, because it involves computing only the hashes of the blocks that were recently appended. Azure Blob Storage with Immutable Storage feature can be used and supports automatic generation and storage of database digests. To prevent tampering of your digest files, configure and lock a retention policy for your container.",
            "guid": "afefb2d3-95da-4ac9-acf5-33d18b32ef9a",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-digest-management"
        },
        {
            "category": "Ledger",
            "subcategory": "Integrity",
            "text": "Schedule the Ledger verification process regularly to verify data integrity",
            "description": "Ledger provides a form of data integrity called forward integrity, which provides evidence of data tampering on data in your ledger tables. The database verification process takes as input one or more previously generated database digests. It then recomputes the hashes stored in the database ledger based on the current state of the ledger tables. If the computed hashes don't match the input digests, the verification fails. The failure indicates that the data has been tampered with. The verification process reports all inconsistencies that it detects.",
            "guid": "f8d4ffda-8aac-4cc6-b72b-c81cb8625420",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-database-verification"
        },
        {
            "category": "Ledger",
            "subcategory": "Ledger",
            "text": "If cryptographic proof of data integrity  is a critical requirement, Ledger feature should be considered",
            "description": "The Ledger feature provides tamper-evidence capabilities in your database. You can cryptographically attest to other parties, such as auditors or other business parties, that your data hasn't been tampered with. Ledger helps protect data from any attacker or high-privileged user, including database administrators (DBAs), system administrators, and cloud administrators.",
            "guid": "2563f498-e2d3-42ea-9e7b-5517881a06a2",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-overview"
        },
        {
            "category": "Ledger",
            "subcategory": "Recovery",
            "text": "Prepare a response plan to investigate and repair a database after a tampering event",
            "description": "Depending on the type of tampering, there are cases where you can repair the ledger without losing data. In the article contained in the --More Info-- column, different scenarios and recovery techniques are described.",
            "guid": "804fc554-6554-4842-91c1-713b32f99902",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-how-to-recover-after-tampering"
        },
        {
            "category": "Logging",
            "subcategory": "Auditing",
            "text": "Ensure that Azure SQL Database Auditing is enabled at the server level",
            "description": "Azure SQL Database Auditing tracks database events and writes them to an audit log in your Azure storage account. Auditing helps you understand database activity and gain insight into discrepancies and anomalies that could indicate business concerns or suspected security violations as well as helps you meet regulatory compliance. By default auditing policy includes all actions (queries, stored procedures and successful and failed logins) against the databases, which may result in high volume of audit logs. It's recommended for customers to configure auditing for different types of actions and action groups using PowerShell.",
            "guid": "4082e31d-35f4-4a49-8507-d3172cc930a6",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview"
        },
        {
            "category": "Logging",
            "subcategory": "Auditing",
            "text": "Ensure that Azure SQL Database Auditing logs are backed up and secured in the selected repository type",
            "description": "Azure SQL Database Auditing logs can be written to external storage accounts, Log Analytics workspace or Event Hub. Be sure to protect the target repository using backups and secured configuration. Use Azure SQL Database Managed Identity to access the storage and set an explicit retention period. Do not grant permissions to administrators to the audit log repository. Use a different target storage for --Enabling Auditing of Microsoft support operations--. ",
            "guid": "9b64bc50-b60f-4035-bf7a-28c4806dfb46",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview"
        },
        {
            "category": "Logging",
            "subcategory": "Auditing",
            "text": "Ensure that Azure SQL Database Activity Log is collected and integrated with Auditing logs",
            "description": "The Azure Monitor activity log is a platform log in Azure that provides insight into subscription-level events. The activity log includes information like when a resource is modified. It is recommended to send this activity log to the same external storage repository as the Azure SQL Database Audit Log (storage account, Log Analytics workspace, Event Hub).",
            "guid": "fcd34708-87ac-4efc-aaf6-57a47f76644a",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log"
        },
        {
            "category": "Logging",
            "subcategory": "SIEM/SOAR",
            "text": "Ensure that Azure SQL Database Auditing logs are being presented in to your organizations SIEM/SOAR",
            "description": "Forward any logs from Azure SQL to your  Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR). Ensure that you are monitoring different types of Azure assets for potential threats and anomalies. Focus on getting high-quality alerts to reduce false positives for analysts to sort through. Alerts can be sourced from log data, agents, or other data.",
            "guid": "f96e127e-9572-453a-b325-ff89ae9f6b44",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview"
        },
        {
            "category": "Logging",
            "subcategory": "SIEM/SOAR",
            "text": "Ensure that Azure SQL Database Activity Log data is presented in to your SIEM/SOAR",
            "description": "Forward any logs from Azure SQL to your  Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR), which can be used to set up custom threat detections. Ensure that you are monitoring different types of Azure assets for potential threats and anomalies. Focus on getting high-quality alerts to reduce false positives for analysts to sort through. Alerts can be sourced from log data, agents, or other data.",
            "guid": "41503bf8-73da-4a10-af9f-5f7fceb5456f",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log"
        },
        {
            "category": "Logging",
            "subcategory": "SIEM/SOAR",
            "text": "Ensure that you have response plans for malicious or aberrant audit logging events",
            "description": "Security Operation Center (SOC) team should create an incident response plan (playbooks or manual responses) to investigate and mitigate tampering, malicious activities, and other anomalous behaviors.",
            "guid": "19ec7c97-c563-4e1d-82f0-54d6ec12e754",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log"
        },
        {
            "category": "Networking",
            "subcategory": "Connectivity",
            "text": "Review Public vs. Private Access connectivity methods and select the appropriate one for the workload",
            "description": "When you create a logical server from the Azure portal for Azure SQL Database, the result is a public endpoint that is visible and reachable over the public network (Public Access). You can then limit connectivity based on firewall rules and Service Endpoint. You can also configure private connectivity only limiting connections to internal networks using Private Endpoint (Private Access). Private Access using Private Endpoint should be the default unless a business case or performance/technical reason applies that cannot support it. Usage of Private Endpoints has performance implications that need to be considered and assessed.",
            "guid": "2c6d356a-1784-475b-a42c-ec187dc8c925",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview"
        },
        {
            "category": "Networking",
            "subcategory": "Connectivity",
            "text": "Keep default Azure SQL Database Connection Policy if not differently required and justified",
            "description": "IMPORTANT: Connections to private endpoint only support Proxy as the connection policy. When using private endpoints connections are proxied via the Azure SQL Database gateway to the database nodes. Clients will not have a direct connection.",
            "guid": "557b3ce5-bada-4296-8d52-a2d447bc1718",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-architecture"
        },
        {
            "category": "Networking",
            "subcategory": "Connectivity",
            "text": "Ensure Allow Azure Services and Resources to Access this Server setting is disabled in Azure SQL Database firewall",
            "description": "This option configures the firewall to allow all connections from Azure, including connections from the subscriptions of other customers. If you select this option, make sure that your login and user permissions limit access to authorized users only. If not strictly required, keep this setting to OFF.",
            "guid": "f48efacf-4405-4e8d-9dd0-16c5302ed082",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview"
        },
        {
            "category": "Networking",
            "subcategory": "Outbound Control",
            "text": "Block or restrict outbound REST API calls to external endpoints",
            "description": "Azure SQL Database has a new built-in feature that allows native integration with external REST endpoints. This means that integration of Azure SQL Database with Azure Functions, Azure Logic Apps, Cognitive Services, Event Hubs, Event Grid, Azure Containers, API Management and in general any REST or even GraphQL endpoint. If not properly restricted, code inside an Azure SQL Database database could leverage this mechanism to exfiltrate data. If not strictly required, it is recommended to block or restrict this feature using Outbound Firewall Rules.",
            "guid": "cb3274a7-e36d-46f6-8de5-46d30c8dde8e",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/sql/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql"
        },
        {
            "category": "Networking",
            "subcategory": "Outbound Control",
            "text": "If outbound network access is required, it is recommended to configure outbound networking restrictions using built-in Azure SQL Database control feature",
            "description": "Outbound firewall rules limit network traffic from the Azure SQL Database logical server to a customer defined list of Azure Storage accounts and Azure SQL Database logical servers. Any attempt to access storage accounts or databases not in this list is denied.",
            "guid": "a566dd3d-314e-4a94-9378-102c42d82b38",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/outbound-firewall-rule-overview"
        },
        {
            "category": "Networking",
            "subcategory": "Private Access",
            "text": "If Private Access connectivity is used, ensure that you are using the Private Endpoint, Azure Virtual Network, Azure Firewall, and Azure Network Security Group checklists",
            "description": "Private Endpoint is created inside a subnet in an Azure Virtual Network. Proper security configuration must be applied also to the containing network environment, including NSG/ASG, UDR, firewall, monitoring and auditing.",
            "guid": "246cd832-f550-4af0-9c74-ca9baeeb8860",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server"
        },
        {
            "category": "Networking",
            "subcategory": "Private Access",
            "text": "If Private Endpoint (Private Access) is used, consider disabling Public Access connectivity",
            "description": "When adding a Private Endpoint connection, public routing to your logical server isn't blocked by default. In the --Firewall and virtual networks-- pane, the setting --Deny public network access-- is not selected by default. To disable public network access, ensure that you select --Deny public network access--.",
            "guid": "3a0808ee-ea7a-47ab-bdce-920a6a2b3881",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server"
        },
        {
            "category": "Networking",
            "subcategory": "Private Access",
            "text": "If Private Endpoint (Private Access) is used, apply NSG and eventually ASG to limit incoming source IP address ranges",
            "description": "Network Security Group (NSG) and Application Security Group (ASG) can be now applied to subnet containing Private Endpoints to restrict connections to Azure SQLDB based on internal source IP ranges.",
            "guid": "8600527e-e8c4-4424-90ef-1f0dca0224f2",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview#network-security-of-private-endpoints"
        },
        {
            "category": "Networking",
            "subcategory": "Private Access",
            "text": "Apply Network Security Groups (NSG) and firewall rules to restrict access to Azure SQL Managed Instance internal subnet",
            "description": "A Managed Instance (SQL MI) can be isolated inside a virtual network to prevent external access. Applications and tools that are in the same or peered virtual network in the same region could access it directly. Applications and tools that are in different region could use virtual-network-to-virtual-network connection or ExpressRoute circuit peering to establish connection. Customer should use Network Security Groups (NSG), and eventually internal firewalls, to restrict access over port 1433 only to resources that require access to a managed instance.",
            "guid": "18123ef4-a0a6-45e3-87fe-7f454f65d975",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/connectivity-architecture-overview"
        },
        {
            "category": "Networking",
            "subcategory": "Public Access",
            "text": "If Public Access connectivity is used, leverage Service Endpoint to restrict access from selected Azure Virtual Networks",
            "description": "Azure Virtual Network Service Endpoint is preferred solution if you want to establish a direct connection to the Azure SQL Database backend nodes using Redirect policy. This will allow access in high performance mode and is the recommended approach from a performance perspective.",
            "guid": "55187443-6852-4fbd-99c6-ce303597ca7f",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview?view=azuresql#ip-vs-virtual-network-firewall-rules"
        },
        {
            "category": "Networking",
            "subcategory": "Public Access",
            "text": "If Public Access connectivity is used, ensure that only specific known IPs are added to the firewall",
            "description": "The Azure SQL Database firewall allows you to specify IP address ranges from which communications are accepted. This approach is fine for stable IP addresses that are outside the Azure private network.",
            "guid": "a73e32da-b3f4-4960-b5ec-2f42a557bf31",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview"
        },
        {
            "category": "Networking",
            "subcategory": "Public Access",
            "text": "If Public Access connectivity is used and controlled by Azure SQL Database firewall rules, use database-level over server-level IP rules",
            "description": "We recommend that you use database-level IP firewall rules whenever possible. This practice enhances security and makes your database more portable. Use server-level IP firewall rules for administrators. Also use them when you have many databases that have the same access requirements, and you don't want to configure each database individually.",
            "guid": "e0f31ac9-35c8-4bfd-9865-edb60ffc6768",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/firewall-configure"
        },
        {
            "category": "Networking",
            "subcategory": "Public Access",
            "text": "Do not enable Azure SQL Managed Instance public endpoint",
            "description": "A Managed Instance (SQL MI) can be isolated inside a virtual network to prevent external access. The Managed Instance public endpoint is not enabled by default, must be explicitly enabled, only if strictly required. If company policy disallows the use of public endpoints, use Azure Policy to prevent enabling public endpoints in the first place.",
            "guid": "b8435656-143e-41a8-9922-61d34edb751a",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview"
        },
        {
            "category": "Networking",
            "subcategory": "Public Access",
            "text": "Restrict access if Azure SQL Managed Instance public endpoint is required",
            "description": "A Managed Instance (SQL MI) public endpoint is not enabled by default, must be explicitly enabled, only if strictly required. In this case, it is recommended to apply a Network Security Groups (NSG) to restrict access to port 3342 only to trusted source IP addresses.",
            "guid": "057dd298-8726-4aa6-b590-1f81d2e30421",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview"
        },
        {
            "category": "Privileged Access",
            "subcategory": "Lockbox",
            "text": "Review and enable Customer Lockbox for Azure SQL Database access by Microsoft personnel",
            "description": "Most operations, support, and troubleshooting performed by Microsoft personnel and sub-processors do not require access to customer data. In those rare circumstances where such access is required, Customer Lockbox for Microsoft Azure provides an interface for customers to review and approve or reject customer data access requests.  In support scenarios where Microsoft needs to access customer data, Azure SQL Database supports Customer Lockbox to provide an interface for you to review and approve or reject customer data access requests.",
            "guid": "37b6eb0f-553d-488f-8a8a-cb9bf97388ff",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview"
        },
        {
            "category": "Privileged Access",
            "subcategory": "Permissions",
            "text": "Ensure that users are assigned the minimum level of access necessarily to complete their job functions",
            "description": "The principle of least privilege states that users shouldn't have more privileges than needed to complete their tasks. High-privileged database and server users can perform many configuration and maintenance activities on the database and can also drop databases in Azure SQL instance. Tracking database owners and privileged accounts is important to avoid having excessive permission.",
            "guid": "5fe5281f-f0f9-4842-a682-8baf18bd8316",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#implement-principle-of-least-privilege"
        },
        {
            "category": "Privileged Access",
            "subcategory": "Permissions",
            "text": "Ensure that distinct applications will be assigned different credentials with minimal permissions to access Azure SQL Database",
            "description": "Identities (both Users and SPNs) should be scoped to the least amount of access needed to perform the function.  A higher number of tightly scoped SPNs should be used, instead of having one SPN with multiple sets of unrelated permissions. For example, if there are three external web applications hosted on-prem that make queries to the Azure SQL Database, they should not all use the same SPN for these activities.  Instead, they should each have their own tightly scoped SPN.",
            "guid": "7b5b55e5-4750-4920-be97-eb726c256a5c",
            "severity": "Low",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#im-3-use-azure-ad-single-sign-on-sso-for-application-access"
        }
    ],
    "categories": [
        {
            "name": "BCDR"
        },
        {
            "name": "Defender"
        },
        {
            "name": "Encryption"
        },
        {
            "name": "Identity"
        },
        {
            "name": "Privileged Access"
        },
        {
            "name": "Ledger"
        },
        {
            "name": "Logging"
        },
        {
            "name": "Networking"
        },
        {
            "name": "Data Discovery and Classification"
        },
        {
            "name": "Data Masking"
        },
        {
            "name": "Code"
        }
    ],
    "status": [
        {
            "name": "Not verified",
            "description": "This check has not been looked at yet"
        },
        {
            "name": "Open",
            "description": "There is an action item associated to this check"
        },
        {
            "name": "Fulfilled",
            "description": "This check has been verified, and there are no further action items associated to it"
        },
        {
            "name": "Not required",
            "description": "Recommendation understood, but not needed by current requirements"
        },
        {
            "name": "N/A",
            "description": "Not applicable for current design"
        }
    ],
    "severities": [
        {
            "name": "High"
        },
        {
            "name": "Medium"
        },
        {
            "name": "Low"
        }
    ],
    "metadata": {
        "name": "Azure SQLDB Security Checklist (Preview)",
        "state": "Preview",
        "timestamp": "Feb 13, 2023"
    }
}
checklists/security_checklist.pt.json METASEP
{
  "metadata": {
    "name": "Lista de verificação de revisão de segurança do Azure"
  },
  "items": [
    {
      "category": "Defender para nuvem",
      "subcategory": "Preços e Configurações",
      "text": "Centro de segurança/Defender habilita em todas as assinaturas",
      "guid": "54174158-33fb-43ae-9c2d-e743165c3acb",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Preços e Configurações",
      "text": "Centro de segurança/Defender ativado em todos os espaços de trabalho do Log Analytics",
      "guid": "349f0364-d28d-442e-abbb-c868255abc91",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Preços e Configurações",
      "text": "Coleta de dados definida como 'Comum'",
      "guid": "64e9a19a-e28c-484c-93b6-b7818ca0e6c4",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-data-collection?tabs=autoprovision-feature#what-event-types-are-stored-for-common-and-minimal"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Preços e Configurações",
      "text": "Os recursos de segurança aprimorados do Defender for Cloud estão todos habilitados",
      "guid": "2149d414-a923-4c35-94d1-1029bd6aaf11",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Preços e Configurações",
      "text": "Provisionamento automático habilitado de acordo com a política da empresa (a política deve existir)",
      "guid": "e6b84ee5-ef43-4d29-a248-1718d5d1f5f7",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-enable-data-collection"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Preços e Configurações",
      "text": "Notificações por e-mail habilitadas de acordo com a política da empresa (a política deve existir)",
      "guid": "25759e35-680e-4782-9ac9-32213d027ff4",
      "severity": "Baixo",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-provide-security-contact-details"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Preços e Configurações",
      "text": "Ativar as opções de integrações são selecionadas ",
      "guid": "12f70993-0631-4583-9ee7-9d6c6d363206",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-wdatp?WT.mc_id=Portal-Microsoft_Azure_Security_CloudNativeCompute&tabs=windows"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Preços e Configurações",
      "text": "A integração CI/CD está configurada",
      "guid": "5b7bae4-4th-45e8-a79e-2e86667313c5",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/security-center/defender-for-container-registries-cicd"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Preços e Configurações",
      "text": "O 'Event Hub' de exportação contínua é ativado se usar o SIEM de terceiros",
      "guid": "05675c5e-985b-4859-a774-f7e371623b87",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Preços e Configurações",
      "text": "O 'Log Analytics Workspace' de exportação contínua é ativado se não estiver usando o Azure Sentinel",
      "guid": "5a917e1f-349f-4036-9d28-d42e8bbbc868",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Preços e Configurações",
      "text": "Conector de nuvem habilitado para AWS",
      "guid": "255abc91-64e9-4a19-ae28-c84c43b6b781",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-aws?WT.mc_id=Portal-Microsoft_Azure_Security"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Preços e Configurações",
      "text": "Conector de nuvem habilitado para GCP",
      "guid": "8ca0e6c4-2149-4d41-9a92-3c3574d11029",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-gcp"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Preços e Configurações",
      "text": "Se usar o proxy do aplicativo Azure AD, considere integrar-se ao Microsoft Defender for Cloud Apps para monitorar o acesso de aplicativos em tempo real e aplicar controles de segurança avançados.",
      "guid": "cce9bdf6-b483-45a0-85ec-c8232b230652",
      "severity": "Baixo",
      "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-integrate-with-microsoft-cloud-application-security"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Recomendações",
      "text": "Todas as recomendações remediadas ou desativadas, se não forem necessárias.",
      "guid": "df9cc234-18db-4611-9126-5f4bb47a393a",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/security-center/secure-score-security-controls"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Recomendações",
      "text": "Pontuação de segurança>70%",
      "description": "A meta mínima da Microsoft para todos os clientes é de 70%",
      "guid": "08032729-4798-4b15-98a2-19a46ceb5443",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Alertas de secuidade",
      "text": "Os alertas de segurança contêm apenas aqueles gerados nas últimas 24 horas (remediar ou desativar alertas de segurança mais antigos)",
      "guid": "50259226-4429-42bb-9285-37a55119bf8e",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/tutorial-security-incident"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Pastas",
      "text": "Se a exportação contínua estiver ativada, as pastas de trabalho padrão são publicadas no painel de segurança personalizado",
      "guid": "8f585428-7d9c-4dc1-96cd-072af9b141a8",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/security-center/custom-dashboards-azure-workbooks"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Comunidade",
      "text": "O cliente está ciente do valor da página 'Comunidade' e tem uma cadência regular configurada para revisar",
      "guid": "98a535e7-3789-47e7-8ca7-da7be9962a15",
      "severity": "Média",
      "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Pontuação segura",
      "text": "Todas as assinaturas protegidas pelo Security Center são mostradas (sem conjunto de filtros de assinatura)",
      "description": "Práticas recomendadas operacionais do cliente - Transparência",
      "guid": "93846da9-7cc3-4923-856b-22586f4a1641",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Conformidade regulatória",
      "text": "Os controles de conformidade são verdes para quaisquer requisitos de conformidade necessários",
      "guid": "bdddea8a-487c-4deb-9861-bc3bc14aea6e",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-compliance-dashboard"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Azure Defender",
      "text": "Vulnerabilidades VM de alta gravidade são zero (vazias)",
      "description": "Práticas recomendadas operacionais do cliente - verificar",
      "guid": "65e8d9a3-aec2-418e-9436-b0736db55f57",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/remediate-vulnerability-findings-vm"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Gerente de Firewall",
      "text": "Hubs são protegidos por um Firewall Azure",
      "guid": "960334b-df9c-4c23-918d-b61171265f4b",
      "severity": "Média",
      "link": "https://techcommunity.microsoft.com/t5/azure-network-security/azure-firewall-manager-is-now-integrated-with-azure-security/ba-p/2228679"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Gerente de Firewall",
      "text": "Redes virtuais são protegidas por um Firewall",
      "description": "Práticas recomendadas operacionais do cliente - verificar",
      "guid": "b47a393a-0803-4272-a479-8b1578a219a4",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/network-best-practices"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Gerente de Firewall",
      "text": "Padrão DDoS ativado",
      "guid": "6ceb5443-5025-4922-9442-92bb628537a5",
      "severity": "Média",
      "link": "https://azure.microsoft.com/blog/how-azure-security-center-detects-ddos-attack-using-cyber-threat-intelligence/"
    },
    {
      "category": "Defender para nuvem",
      "subcategory": "Cobertura",
      "text": "Verifique se todas as assinaturas estão cobertas (veja preços e configurações para modificar)",
      "guid": "5119bf8e-8f58-4542-a7d9-cdc166cd072a",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started?WT.mc_id=Portal-Microsoft_Azure_Security"
    },
    {
      "category": "Rede Azure",
      "subcategory": "IPs públicos",
      "text": "VM's com IPs públicos devem ser protegidos pelo NSG ",
      "guid": "4df585ec-dce9-4793-a7bc-db3b51eb2eb2eb0",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses"
    },
    {
      "category": "Rede Azure",
      "subcategory": "IPs públicos",
      "text": "VMs com IPs públicos são movidos atrás do Azure Firewall Premium",
      "description": "Práticas recomendadas operacionais do cliente - verifique",
      "guid": "3dda6e59-d7c8-4a2e-bb11-7d6769af669c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses"
    },
    {
      "category": "Rede Azure",
      "subcategory": "IPs públicos",
      "text": "VM's que não precisam de IPs públicos não têm IPs públicos (ou seja, somente RDP interno)",
      "description": "Práticas recomendadas operacionais do cliente - verifique",
      "guid": "a48e5a85-f222-43ec-b8bb-12308ca5017f",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access"
    },
    {
      "category": "Rede Azure",
      "subcategory": "NSG",
      "text": "O NSG RBAC é usado para restringir o acesso à equipe de segurança de rede",
      "guid": "158e3ea3-a93c-42de-9e31-65c3a87a04b7",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Rede Azure",
      "subcategory": "NSG",
      "text": "As regras de segurança de entrada do NSG não contêm um * (curinga) no campo Fonte",
      "description": "Práticas recomendadas operacionais do cliente - verifique",
      "guid": "a209939b-da47-4778-b24c-116785c2fa55",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Rede Azure",
      "subcategory": "NSG",
      "text": "As regras de segurança de saída do NSG são usadas para controlar o tráfego de endereços IP específicos para tráfego não roteado através de um Firewall",
      "description": "Práticas recomendadas operacionais do cliente - verifique",
      "guid": "b56a9480-08be-47d7-b4c4-76b6d8bdcf59",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Rede Azure",
      "subcategory": "NSG",
      "text": "O NSG não tem a Fonte como um curinga no lugar.",
      "description": "Práticas recomendadas operacionais do cliente - verifique",
      "guid": "bce65de8-a13f-4988-9946-8d66a786d60f",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Rede Azure",
      "subcategory": "NSG",
      "text": "Os diagnósticos NSG enviam o NetworkSecurityGroupEvent e o NetworkSecurityGroupRuleCounter para o Sentinel LAW",
      "guid": "a6c97be9-955d-404c-9c49-c986cb2d1215",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-nsg-manage-log"
    },
    {
      "category": "Rede Azure",
      "subcategory": "UDR",
      "text": "UDR RBAC é usado para restringir o acesso à equipe de segurança da rede",
      "guid": "aa124b6e-4df5-485e-adce-9793b7bcdb3b",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Rede Azure",
      "subcategory": "UDR",
      "text": "Se o Zero Trust, então os UDR's são usados para enviar todo o tráfego para o Azure Firewall Premium",
      "guid": "51eb2eb0-3dda-46e5-ad7c-8a2edb117d67",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Rede Azure",
      "subcategory": "UDR",
      "text": "Os UDR's que não enviam todo o tráfego para OzureFirewallPremium são conhecidos e documentados.",
      "description": "Práticas recomendadas operacionais do cliente - verifique",
      "guid": "69af669c-a48e-45a8-9f22-23ece8bb1230",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Rede Azure",
      "subcategory": "Redes Virtuais",
      "text": "O cliente está familiarizado com os padrões de rede do Azure / roteamento padrão SDN no Azure",
      "guid": "8ca5017f-158e-43ea-9a93-c2de7e3165c3",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview#default"
    },
    {
      "category": "Rede Azure",
      "subcategory": "Redes Virtuais",
      "text": "O VNet RBAC é usado para restringir o acesso à equipe de segurança da rede",
      "description": "Práticas recomendadas operacionais do cliente - verifique",
      "guid": "a87a04b7-a209-4939-ada4-7778f24c1167",
      "severity": "Média",
      "link": "https://github.com/MicrosoftDocs/azure-docs/issues/53672"
    },
    {
      "category": "Rede Azure",
      "subcategory": "Redes Virtuais",
      "text": "As recomendações de segurança do VNet são remediadas e não há VNets 'em risco' ",
      "guid": "85c2fa55-b56a-4948-808b-e7d7e4c476b6",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/policy-reference"
    },
    {
      "category": "Rede Azure",
      "subcategory": "Redes Virtuais",
      "text": "As conexões de peering do VNet são compreendidas e os fluxos de tráfego esperados são documentados",
      "guid": "d8bdcf59-bce6-45de-aa13-f98879468d66",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview"
    },
    {
      "category": "Rede Azure",
      "subcategory": "Redes Virtuais",
      "text": "Os endpoints de serviço VNet estão em uso, não existem pontos finais legados do serviço público",
      "guid": "a786d60f-a6c9-47be-a955-d04c3c49c986",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview"
    },
    {
      "category": "Rede Azure",
      "subcategory": "Redes Virtuais",
      "text": "Os Endpoints Privados VNet estão em uso para permitir o acesso de ambientes locais, não existem pontos finais públicos legados",
      "guid": "1f625659-ee55-480a-9824-9c931213dbd7",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview"
    },
    {
      "category": "Rede Azure",
      "subcategory": "Redes Virtuais",
      "text": "Monitoramento do VNet ativado",
      "guid": "fb012f70-943f-4630-9722-ea39d2b1ce63",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network"
    },
    {
      "category": "Rede Azure",
      "subcategory": "Redes Virtuais",
      "text": "Tráfego seguro entre pods usando políticas de rede no Azure Kubernetes Service (AKS)",
      "guid": "2055b29b-ade4-4th-8e8c-39ec94666731",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/kubernetes-network-policies"
    },
    {
      "category": "Rede Azure",
      "subcategory": "Redes Virtuais",
      "text": "Cliente VNet NVA (eletrodomésticos) segue padrão de arquitetura publicado",
      "guid": "3c005674-c1e9-445b-959c-373e7ed71623",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-scenario-udr-gw-nva"
    },
    {
      "category": "Rede Azure",
      "subcategory": "Redes Virtuais",
      "text": "As configurações do VNet Diagnostic estão habilitadas e enviam VMProtectionAlerts para a LEI do Azure Sentinel",
      "guid": "b375a917-ecbe-448f-ae64-dd7df2e8bbbc",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network"
    },
    {
      "category": "Rede Azure",
      "subcategory": "Conectividade",
      "text": "Use o ExpressRoute ou VPN para acessar recursos do Azure a partir de ambientes locais",
      "guid": "468155ab-c916-44e9-a09a-ed8c44cf3b2b",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure"
    },
    {
      "category": "Rede Azure",
      "subcategory": "Virtual WAN",
      "text": "VWAN RBAC é usado para restringir o acesso à equipe de segurança da rede",
      "guid": "bd8ac2aa-ebca-42a4-9da1-dbf3dd992481",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about"
    },
    {
      "category": "Rede Azure",
      "subcategory": "Virtual WAN",
      "text": "O cliente VWAN está usando o Secure Hub ou firewall externo para rotear e monitorar o tráfego.",
      "guid": "718d1dca-1f62-4565-aee5-580a38249c93",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-global-transit-network-architecture"
    },
    {
      "category": "Rede Azure",
      "subcategory": "Gateway de aplicativos",
      "text": "AppGW RBAC é usado para restringir o acesso à equipe de segurança de rede",
      "guid": "1213dbd7-fb01-42f7-8943-f6304722ea39",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/web-application-firewall/overview"
    },
    {
      "category": "Rede Azure",
      "subcategory": "Gateway de aplicativos",
      "text": "AppGW Todos os serviços web voltados externos estão afer gateways de aplicativos com WAF ativado ",
      "guid": "d2b1ce63-2055-4b29-aade-4aad1e8c39ec",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip"
    },
    {
      "category": "Rede Azure",
      "subcategory": "Gateway de aplicativos",
      "text": "AppGW Todos os serviços internos voltados para a Web estão behing Application Gateways com WAF ativado ",
      "guid": "94666731-3c00-4567-9c1e-945b459c373e",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip"
    },
    {
      "category": "Rede Azure",
      "subcategory": "Gateway de aplicativos",
      "text": "AppGW - Frente externa tem TLS/SSL ativado e redireciona todo o tráfego para 443 (sem tráfego na porta 80)",
      "guid": "7ed71623-b375-4a91-9ecb-e48fbe64dd7d",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview"
    },
    {
      "category": "Rede Azure",
      "subcategory": "FrontDoor",
      "text": "O FRONT Door RBAC é usado para restringir o acesso à equipe de segurança da rede",
      "guid": "f2e8bbbc-4681-455a-ac91-64e9909aed8c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/frontdoor/"
    },
    {
      "category": "Rede Azure",
      "subcategory": "FrontDoor",
      "text": "Porta da Frente está associada a uma política WAF",
      "guid": "44cf3b2b-3818-4baf-a2cf-2149d013a923",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/front-door-security-baseline?toc=/azure/frontdoor/TOC.json"
    },
    {
      "category": "Rede Azure",
      "subcategory": "FrontDoor",
      "text": "A política TLS/SSL da porta frontal está configurada",
      "guid": "ce574dcc-bd8a-4c2a-aebc-a2a44da1dbf3",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain-https"
    },
    {
      "category": "Rede Azure",
      "subcategory": "FrontDoor",
      "text": "Porta de redirecionamento da porta 80 para porta 443 está configurada (ouvintes)",
      "guid": "dd992481-718d-41dc-a1f6-25659ee5580a",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/frontdoor/front-door-url-redirect"
    },
    {
      "category": "Rede Azure",
      "subcategory": "FrontDoor",
      "text": "Os registros de diagnósticos da Porta frontal enviam o ApplicationGatewayAccessLog &ApplicationGateway FirewallLog para o Sentinel LAW",
      "guid": "38249c93-1213-4dbd-9fb0-12f70943f630",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/frontdoor/front-door-diagnostics"
    },
    {
      "category": "Rede Azure",
      "subcategory": "Proteção DDOS",
      "text": "Habilitado para IP's públicos do Firewall (todos os IPs públicos)",
      "guid": "4722ea39-d2b1-4ce6-9205-5b29bade4aad",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices"
    },
    {
      "category": "Identidade",
      "subcategory": "Inquilino",
      "text": "Estabeleça um único diretório empresarial para gerenciar identidades de funcionários em tempo integral e recursos corporativos.",
      "guid": "346ad56f-bdb8-44db-8bcd-0a689af63f1e",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/security/compass/identity#a-single-enterprise-directory"
    },
    {
      "category": "Identidade",
      "subcategory": "Inquilino",
      "text": "Sincronize sua identidade na nuvem com seus sistemas de identidade existentes.",
      "guid": "a46108cd-6a76-4749-ae69-b7bf61410010",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/security/compass/identity#synchronized-identity-systems"
    },
    {
      "category": "Identidade",
      "subcategory": "Inquilino",
      "text": "Use serviços de identidade na nuvem para hospedar contas não-funcionários, como fornecedores, parceiros e clientes, em vez de incluí-las em seu diretório local.",
      "guid": "a1ab96ceb-c149-4ce2-bcad-3bd375ebfc7f",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/security/compass/identity#cloud-provider-identity-source-for-third-parties"
    },
    {
      "category": "Identidade",
      "subcategory": "Inquilino",
      "text": "Desativar protocolos legados inseguros para serviços voltados à internet.",
      "guid": "343473ec-ed5c-49e1-98f4-cb09524a23cd",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/security/compass/identity#block-legacy-authentication"
    },
    {
      "category": "Identidade",
      "subcategory": "Inquilino",
      "text": "Habilitar um único login",
      "guid": "70dceb23-50c7-4d8d-bf53-8cc104c7dc44",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/identity-management-best-practices#enable-single-sign-on"
    },
    {
      "category": "Identidade",
      "subcategory": "Administração privilegiada",
      "text": "Não sincronize contas com o maior acesso privilegiado aos recursos locais à medida que você sincroniza seus sistemas de identidade corporativa com diretórios em nuvem.",
      "guid": "87791be1-1eb0-48ed-8003-ad9bcf241b99",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/security/compass/identity#no-on-premises-admin-accounts-in-cloud-identity-providers"
    },
    {
      "category": "Identidade",
      "subcategory": "Administração privilegiada",
      "text": "Limitar o número de administradores globais a menos de 5",
      "guid": "9e6efe9d-f28f-463b-9bff-b5080173e9fe",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5"
    },
    {
      "category": "Identidade",
      "subcategory": "Administração privilegiada",
      "text": "Use grupos para atribuições de papéis do Azure AD e delegue a atribuição de função",
      "guid": "e0d968d3-87f6-41fb-a4f9-d852f1673f4c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#6-use-groups-for-azure-ad-role-assignments-and-delegate-the-role-assignment"
    },
    {
      "category": "Identidade",
      "subcategory": "Administração privilegiada",
      "text": "Certifique-se de que todos os administradores de impacto críticos sejam gerenciados pelo diretório corporativo para acompanhar a aplicação da política organizacional.",
      "guid": "00350863-4df6-4050-9cf1-cbaa6d58283e",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#managed-accounts-for-admins"
    },
    {
      "category": "Identidade",
      "subcategory": "Administração privilegiada",
      "text": "Configure revisões de acesso recorrentes para revogar permissões não precisas ao longo do tempo",
      "guid": "eae64d01-0d3a-4ae1-a89d-cc1c2ad3888f",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#4-configure-recurring-access-reviews-to-revoke-unneeded-permissions-over-time"
    },
    {
      "category": "Identidade",
      "subcategory": "Administração privilegiada",
      "text": "Certifique-se de que os administradores de impacto crítico usem uma estação de trabalho com proteções de segurança elevadas e monitoramento",
      "guid": "922ac19f-916d-4697-b8ea-ded26bdd186f",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#admin-workstation-security"
    },
    {
      "category": "Identidade",
      "subcategory": "Identidades Externas",
      "text": "Provedores de identidade: Verifique se são conhecidos os provedores de identidade externos",
      "guid": "1e8c39ec-9466-4673-83c0-05674c1e945b",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/compare-with-b2c"
    },
    {
      "category": "Identidade",
      "subcategory": "Identidades Externas",
      "text": "Configurações de colaboração externa: o acesso do usuário convidado definido para 'Acesso ao usuário convidado é restrito?'",
      "guid": "459c373e-7ed7-4162-9b37-5a917ecbe48f",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "Identidade",
      "subcategory": "Identidades Externas",
      "text": "Configurações de colaboração externa: Configurações de convite de hóspedes definidas como 'Somente usuários atribuídos a funções específicas de administração'",
      "guid": "be64dd7d-f2e8-4bbb-a468-155abc9164e9",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "Identidade",
      "subcategory": "Identidades Externas",
      "text": "Configurações de colaboração externa: habilite o autoatendimento do hóspede por meio de fluxos definidos como 'Desativados' ",
      "guid": "909aed8c-44cf-43b2-a381-8bafa2cf2149",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "Identidade",
      "subcategory": "Identidades Externas",
      "text": "Configurações de colaboração externa: restrições de colaboração definidas como 'Permitir convites para os domínios especificados'",
      "guid": "d013a923-ce57-44dc-abd8-ac2aaebca2a4",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "Identidade",
      "subcategory": "Identidades Externas",
      "text": "Avaliações de acesso: Habilitadas para todos os grupos",
      "guid": "4da1dbf3-dd99-4248-8718-d1dca1f62565",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/active-directory/governance/deploy-access-reviews"
    },
    {
      "category": "Identidade",
      "subcategory": "Aplicações Corporativas",
      "text": "Consentimento & Permissões: Permitir o consentimento do usuário para aplicativos de editores verificados",
      "guid": "9ee5580a-3824-49c9-9121-3dbd7fb012f7",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent"
    },
    {
      "category": "Identidade",
      "subcategory": "Aplicações Corporativas",
      "text": "Consentimento & Permissões: Permitir o consentimento do proprietário do grupo para proprietários de grupos selecionados ",
      "guid": "0943f630-4722-4ea3-ad2b-1ce632055b29",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent-groups"
    },
    {
      "category": "Identidade",
      "subcategory": "Domínios personalizados",
      "text": "Apenas domínios validados de clientes são registrados",
      "guid": "bade4aad-1e8c-439e-a946-667313c00567",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-configure-custom-domain"
    },
    {
      "category": "Identidade",
      "subcategory": "Redefinição de senha",
      "text": "Requisito de política de redefinição de senha de autoatendimento verificado em conformidade.",
      "guid": "4c1e945b-459c-4373-b7ed-71623b375a91",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-sspr"
    },
    {
      "category": "Identidade",
      "subcategory": "Redefinição de senha",
      "text": "Definir o número de dias antes que os usuários sejam solicitados a re-confirmar informações de autenticação não está definido como zero",
      "guid": "7ecbe48f-be64-4dd7-bf2e-8bbbc468155a",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment"
    },
    {
      "category": "Identidade",
      "subcategory": "Redefinição de senha",
      "text": "Definir o número de métodos necessários para redefinir a senha são selecionados",
      "guid": "bc9164e9-909a-4ed8-a44c-f3b2b3818baf",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment"
    },
    {
      "category": "Identidade",
      "subcategory": "Configuração do usuário",
      "text": "Desativar 'Os usuários podem registrar aplicativos'",
      "guid": "a2cf2149-d013-4a92-9ce5-74dccbd8ac2a",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/delegate-app-roles"
    },
    {
      "category": "Identidade",
      "subcategory": "Configuração do usuário",
      "text": "Restringir o acesso ao portal Administrativo (portal.azure.com) apenas aos administradores",
      "guid": "aebca2a4-4da1-4dbf-9dd9-92481718d1dc",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/users-default-permissions"
    },
    {
      "category": "Identidade",
      "subcategory": "Configuração do usuário",
      "text": "Desativar a 'conexão de conta do LinkedIn'",
      "guid": "a1f62565-9ee5-4580-a382-49c931213dbd",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/enterprise-users/linkedin-integration"
    },
    {
      "category": "Identidade",
      "subcategory": "Configurações de diagnóstico",
      "text": "Ativado e enviado para o espaço de trabalho Log Analytics com o Sentinel",
      "guid": "7fb012f7-0943-4f63-8472-2ea39d2b1ce6",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-monitoring"
    },
    {
      "category": "Identidade",
      "subcategory": "PIM ativado",
      "text": "Gerenciamento de identidade privilegiado ativado",
      "guid": "21e44a19-a9dd-4399-afd7-b28dc8355562",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan"
    },
    {
      "category": "Identidade",
      "subcategory": "PIM ativado",
      "text": "Implementar o acesso 'just in time' (JIT) para reduzir ainda mais o tempo de exposição de contas privilegiadas (reduzir o acesso permanente)",
      "guid": "46f4389a-7f42-4c78-b78c-06a63a21a495",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc"
    },
    {
      "category": "Identidade",
      "subcategory": "Políticas de acesso condicional",
      "text": "Configure políticas de acesso condicional / Controles de Acesso",
      "guid": "6e6a8dc4-a20e-427b-9e29-711b1352beee",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common"
    },
    {
      "category": "Identidade",
      "subcategory": "Políticas de acesso condicional",
      "text": "Condições: Locais Restritos",
      "guid": "079b588d-efc4-4972-ac3c-d21bf77036e5",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition"
    },
    {
      "category": "Identidade",
      "subcategory": "Políticas de acesso condicional",
      "text": "Controles de acesso: MFA ativado para todos os usuários",
      "guid": "e6b4bed3-d5f3-4547-a134-7dc56028a71f",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-azure-mfa"
    },
    {
      "category": "Identidade",
      "subcategory": "Políticas de acesso condicional",
      "text": "Controles de acesso: Exigir MFA para administradores",
      "guid": "fe1bd15d-d2f0-4d5e-972d-41e3611cc57b",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa"
    },
    {
      "category": "Identidade",
      "subcategory": "Políticas de acesso condicional",
      "text": "Controles de acesso: Exigir MFA para gerenciamento do Azure ",
      "guid": "4a4b1410-d439-4589-ac22-89b3d6b57cfc",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management"
    },
    {
      "category": "Identidade",
      "subcategory": "Políticas de acesso condicional",
      "text": "Controles de acesso: bloqueie protocolos legados",
      "guid": "645461e1-a3e3-4453-a3c8-639637a552d6",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy"
    },
    {
      "category": "Identidade",
      "subcategory": "Políticas de acesso condicional",
      "text": "Controles de acesso: Exigir que os dispositivos sejam marcados como compatíveis",
      "guid": "7ae9eab4-0fd3-4290-998b-c178bdc5a06c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/require-managed-devices"
    },
    {
      "category": "Identidade",
      "subcategory": "Usuários convidados",
      "text": "Existe uma política para rastrear contas de usuários de hóspedes (ou seja, uso/exclusão/desativação)?",
      "description": "Política documentada pelo cliente",
      "guid": "a7144351-e19d-4d34-929e-b7228137a151",
      "severity": "Média",
      "link": "https://devblogs.microsoft.com/premier-developer/azure-active-directory-automating-guest-user-management/"
    },
    {
      "category": "Identidade",
      "subcategory": "Pontuação segura de identidade",
      "text": "Implementar o Score seguro de identidade com base nas melhores práticas do seu setor",
      "guid": "c5bb4e4f-1814-4287-b5ca-8c26c9b32ab5",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/identity-secure-score"
    },
    {
      "category": "Identidade",
      "subcategory": "Quebrar contas de vidro",
      "text": "Pelo menos duas contas de vidro de quebra foram criadas e a política em torno de seu uso existe",
      "guid": "bcfc6998-a135-4e33-9897-e31c67d68cb6",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Controle de acesso",
      "text": "Controle de acesso VM aproveitando a política do Azure",
      "guid": "0ac252b9-99a6-48af-a7c9-a8f821b8eb8c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Controle de acesso",
      "text": "Reduza a variabilidade na configuração e implantação de VMs aproveitando modelos",
      "guid": "0a77e26-e4d5-4aea-a8dc-4e2436bc336d",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Controle de acesso",
      "text": "Garantir acesso privilegiado para implantar VMS reduzindo quem tem acesso a Recursos através da Governança",
      "guid": "b5945bda-4333-44fd-b91c-234182b65275",
      "severity": "Média",
      "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Alta disponibilidade ",
      "text": "Use vários VMs para suas cargas de trabalho para melhor disponibilidade ",
      "guid": "269440b4-be3d-43e0-a432-76d4bdc015bc",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/architecture/checklist/resiliency-per-service"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Alta disponibilidade ",
      "text": "Implantar e testar uma solução de recuperação de desastres ",
      "guid": "f219e4a1-eb58-4879-935d-227886d30b66",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-first-look-arm"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Alta disponibilidade ",
      "text": "Conjuntos de Availabilty",
      "guid": "c57be595-1900-4838-95c5-86cb291ec16a",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Alta disponibilidade ",
      "text": "Zonas de disponibilidade",
      "guid": "1d076ef9-f141-4acd-ae57-9377bcdb3751",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/availability-zones/az-overview?context=/azure/virtual-machines/context/context"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Alta disponibilidade ",
      "text": "Tolerância a falhas regionais ",
      "guid": "ab2ac1fa-d66e-415d-9d5a-2adb2c3e2326",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/architecture/resiliency/recovery-loss-azure-region"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Proteger contra malware",
      "text": "Instalar soluções antimalware",
      "guid": "af225ca4-4e16-496f-bdde-ace4cb1deb4c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/antimalware"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Proteger contra malware",
      "text": "Integre a solução antimalware com o Security Center",
      "guid": "650c3fc1-4eeb-4b36-a382-9e3eec218368",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Gerenciar atualizações vm",
      "text": "Mantenha os VMs atualizados usando o Gerenciamento de Atualizações com automação do Azure",
      "guid": "7a0177a2-b594-45bd-a433-34fdf91c2341",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/automation/update-management/overview"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Gerenciar atualizações vm",
      "text": "Certifique-se de que as imagens do Windows para implantação tenham o nível mais recente de atualizações ",
      "guid": "c6fa96b9-6ad8-4840-af37-2734c876ba28",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/virtual-machines/automatic-vm-guest-patching"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Gerenciar atualizações vm",
      "text": "Aplique rapidamente atualizações de segurança para VMs usando o Microsoft Defender for Cloud",
      "guid": "02145901-465d-438e-9309-ccbd979266bc",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/asset-inventory"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Criptografe seus VHDs",
      "text": "Habilite a criptografia em seus VMs",
      "guid": "ca274faa-19bf-439d-a5d4-4c7c8919ca1f",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Criptografe seus VHDs",
      "text": "Adicione a chave de criptografia chave (KEK) para adicionar camada de segurança para criptografia ",
      "guid": "6d5315ae-524b-4a34-b458-5e12139bd7bb",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-machines/windows/disk-encryption-key-vault#set-up-a-key-encryption-key-kek"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Criptografe seus VHDs",
      "text": "Tire um instantâneo de discos antes da criptografia para fins de reversão",
      "guid": "012f7b95-e06e-4154-b2aa-3592828e6e20",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Restringir a conexão direta à internet ",
      "text": "Garantir que apenas o grupo central de rede tenha permissões para recursos de rede ",
      "guid": "5173676a-e466-491e-a835-ad942223e138",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Restringir a conexão direta à internet ",
      "text": "VMs expostos de identidade e correção que permitem o acesso a partir de adicionas IP de origem 'ANY'",
      "guid": "10523081-a941-4741-9833-ff7ad7c6d373",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Restringir a conexão direta à internet ",
      "text": "Restringir portas de gerenciamento (RDP, SSH) usando acesso just-in-time",
      "guid": "75a91be1-f388-4f03-a4d2-cd463cbbbc86",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-just-in-time"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Restringir a conexão direta à internet ",
      "text": "Remova o acesso à internet e implemente servidores de salto para RDP",
      "guid": "8295abc9-1a4e-4da0-bae2-cc84c47b6b78",
      "severity": "Alto",
      "link": "http://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Restringir a conexão direta à internet ",
      "text": "Remova o login direto em servidores usando RDP/SSH da internet e implemente VPN ou rota expressa",
      "guid": "1cbafe6c-4658-49d4-98a9-27c3974d1102",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-forced-tunneling"
    },
    {
      "category": "Verificações de segurança VM",
      "subcategory": "Restringir a conexão direta à internet ",
      "text": "Aproveite o Azure Bastion como seu corretor RDP/SSH para maior segurança e redução de pegada",
      "guid": "dad6aae1-1e6b-484e-b5df-47d2d92881b1",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/bastion/bastion-overview"
    },
    {
      "category": "Sentinela",
      "subcategory": "Arquitetura ",
      "text": "Todos os inquilinos contêm sentinela habilitado em pelo menos um espaço de trabalho Log Analytics",
      "guid": "cd5d1e54-a297-459e-9968-0e78289c9356",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard"
    },
    {
      "category": "Sentinela",
      "subcategory": "Arquitetura ",
      "text": "Cliente entende arquitetura Sentinela",
      "guid": "57d02bff-4564-4b0d-a34a-359836ee79d6",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/best-practices-workspace-architecture"
    },
    {
      "category": "Sentinela",
      "subcategory": "Arquitetura ",
      "text": "O cliente sabe como monitorar incidentes em várias instâncias do Sentinel",
      "guid": "e8f5c586-c7d9-4cdc-86ac-c075ef9b141a",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/sentinel/multiple-workspace-view"
    },
    {
      "category": "Sentinela",
      "subcategory": "Visão geral",
      "text": "Sem Incidentes abertos mais de 24 horas",
      "guid": "8989579e-76b8-497e-910a-7da7be9966e1",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/sentinel/manage-soc-with-incident-metrics"
    },
    {
      "category": "Sentinela",
      "subcategory": "Notícias e Guias",
      "text": "O cliente foi mostrado na guia Notícias & Guias",
      "guid": "5d3c4ada-97cb-43d1-925a-b225c6f4e068",
      "severity": "Baixo",
      "link": "https://learn.microsoft.com/azure/sentinel/whats-new"
    },
    {
      "category": "Sentinela",
      "subcategory": "UEBA ",
      "text": "Configurado pelo UEBA (Sentinel/Configurações/Configurações/Configurar UEBA)",
      "guid": "5edddea8-a4b7-4cde-a4c6-1fc3fc14eea6",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics"
    },
    {
      "category": "Sentinela",
      "subcategory": "Conectores de dados",
      "text": "Diretório Ativo do Azure em programas configurados e 'Último Log Recebido' hoje",
      "guid": "e69d8d9a-3eec-4218-b687-ab077adb49e5",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory"
    },
    {
      "category": "Sentinela",
      "subcategory": "Conectores de dados",
      "text": "A proteção de identidade do Diretório Ativo do Azure é configurada e 'Último Registro Recebido' é apresentado hoje",
      "guid": "b9603334-fdf8-4cc2-9318-db61171269f4",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-active-directory-identity-protection"
    },
    {
      "category": "Sentinela",
      "subcategory": "Conectores de dados",
      "text": "A Atividade do Azure está configurada e 'Último Registro Recebido' é apresentado hoje",
      "guid": "0b4aa3d3-e070-4327-9d4b-98b15b8a219a",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity"
    },
    {
      "category": "Sentinela",
      "subcategory": "Conectores de dados",
      "text": "Microsoft Defender for Cloud é configurado e 'Último Log Recebido' mostra hoje",
      "guid": "8e13f9cc-bd46-4826-9abc-a264f9a19bfe",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud"
    },
    {
      "category": "Sentinela",
      "subcategory": "Conectores de dados",
      "text": "O Azure Firewall está configurado e o 'Último Log Recebido' é apresentado hoje",
      "guid": "9d55d04c-3c49-419c-a1b2-d1215ae114b9",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall"
    },
    {
      "category": "Sentinela",
      "subcategory": "Conectores de dados",
      "text": "O Firewall do Windows está configurado e o 'Último Log Recebido' é apresentado hoje",
      "guid": "34df585e-cccd-49bd-9ba0-cdb3b54eb2eb",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-firewall"
    },
    {
      "category": "Sentinela",
      "subcategory": "Conectores de dados",
      "text": "Eventos de segurança são configurados com os shows ama e 'Último Log Recebido' hoje",
      "guid": "03ddaa25-9271-48d2-bdb1-0725769ef669",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama"
    },
    {
      "category": "Sentinela",
      "subcategory": "Conectores de dados",
      "text": "Eventos de Segurança - verifique se os computadores do Azure estão conectados e enviando dados para o espaço de trabalho",
      "guid": "1a4834ac-9322-423e-ae80-b123081a5417",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference"
    },
    {
      "category": "Sentinela",
      "subcategory": "Conectores de dados",
      "text": "Eventos de Segurança - verifique se computadores não-Azure estão conectados e enviando dados para o espaço de trabalho",
      "guid": "859c773e-7e26-4162-9b77-5a917e1f348e",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference"
    },
    {
      "category": "Sentinela",
      "subcategory": "Conectores de dados",
      "text": "Conector para AWS",
      "guid": "f354c27d-42e8-4bba-a868-155abb9163e9",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/connect-aws?tabs=s3"
    },
    {
      "category": "Sentinela",
      "subcategory": "Conectores de dados",
      "text": "Conector para GCP",
      "guid": "909ae28c-84c3-43b6-a780-8bafe6c42149",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference"
    },
    {
      "category": "Sentinela",
      "subcategory": "Regras de análise",
      "text": "O cliente habilitou as regras de análise e configurou incidentes ",
      "guid": "d413a923-c357-44d1-8028-ac6aae01e6a8",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/detect-threats-built-in"
    },
    {
      "category": "Sentinela",
      "subcategory": "Configurações",
      "text": "O cliente não tem um limite diário habilitado",
      "guid": "4de5df43-d299-4248-8718-d5d1e5f62565",
      "severity": "Média",
      "link": "https://azure.microsoft.com/updates/controlling-data-volume-and-retention-in-log-analytics-2/"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Configuração",
      "text": "Azure Firewall Premium implantado",
      "guid": "9e3558fd-7724-49c9-9111-2d027fe412f7",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall/premium-features"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Configuração",
      "text": "Tunning quad zero/force ativado através do Firewall Azure",
      "guid": "4dc74a74-8b66-433a-b2a0-916a764980ad",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal#create-a-default-route"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Controle de acesso",
      "text": "RBAC definido para habilitar apenas usuários autorizados",
      "guid": "0e278ee2-93c1-4bc3-92ba-aab7571849ab",
      "severity": "Média",
      "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Configurações de diagnóstico",
      "text": "Diagnósticos ativados e envio de métricas para um espaço de trabalho do Log Analytics ",
      "guid": "8093dc9f-c9d1-4bb7-9b36-a5a67fbb9ed5",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Gerente de Firewall",
      "text": "Hubs e redes virtuais são protegidos ou conectados através do Firewall Premium",
      "guid": "b35478c3-4798-416b-8863-cffe1cac599e",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Gerente de Firewall",
      "text": "Política: Os controles de acesso são configurados (RBAC)",
      "guid": "f0d5a73d-d4de-436c-8c81-770afbc4c0e4",
      "severity": "Alto",
      "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Gerente de Firewall",
      "text": "Política: A política dos pais está configurada ",
      "guid": "5c3a87af-4a79-41f8-a39b-da47768e14c1",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Gerente de Firewall",
      "text": "Política: As coleções de regras são definidas",
      "guid": "15675c1e-a55b-446a-a48f-f8ae7d7e4b47",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Gerente de Firewall",
      "text": "Política: As políticas de DNAT são definidas",
      "guid": "5b6c8bcb-f59b-4ce6-9de8-a03f97879468",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Gerente de Firewall",
      "text": "Política: As regras da rede são definidas",
      "guid": "d66a786d-60e9-46c9-9ad8-855d04c2b39c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Gerente de Firewall",
      "text": "Política: As regras de aplicação são definidas",
      "guid": "986bb2c1-2149-4a11-9b5e-3df574ecccd9",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall/features"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Gerente de Firewall",
      "text": "DNS: Recurso compreendido e aplicado ou não aplicado",
      "guid": "793a6bcd-a3b5-40eb-8eb0-3dd95d58d7c8",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/firewall/dns-details"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Gerente de Firewall",
      "text": "Inteligência de Ameaças: Definir para Alertar e Negar",
      "guid": "d622f54b-29ba-4de3-aad1-e8c28ec93666",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Gerente de Firewall",
      "text": "Inteligência de Ameaças: Lista permitida (justificar se eles estão sendo usados - ou seja, desempenho)",
      "guid": "7313b005-674b-41e9-94a4-59c373e7ed61",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings#allowlist-addresses"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Gerente de Firewall",
      "text": "TLS ativado",
      "guid": "623b365a-917e-4cbe-98eb-d54cd7df2e8b",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall/premium-certificates"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Gerente de Firewall",
      "text": "IDPS ativado",
      "guid": "bac35715-59ab-4915-9e99-08aed8c44ce3",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Gerente de Firewall",
      "text": "SNAT: Configurado ",
      "guid": "b2b3808b-9fa1-4cf1-849d-003a923ce474",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall/snat-private-range"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Proteção DDOS",
      "text": "Habilitado para IP's públicos do Firewall",
      "guid": "dbcbd8ac-2aae-4bca-8a43-da1dae2cc992",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices"
    }
  ],
  "severities": [
    {
      "name": "Alto"
    },
    {
      "name": "Média"
    },
    {
      "name": "Baixo"
    }
  ],
  "status": [
    {
      "name": "Não verificado",
      "description": "Este cheque ainda não foi examinado."
    },
    {
      "name": "Abrir",
      "description": "Há um item de ação associado a este cheque"
    },
    {
      "name": "Cumprido",
      "description": "Esta verificação foi verificada, e não há mais itens de ação associados a ele"
    },
    {
      "name": "Não é necessário",
      "description": "Recomendação compreendida, mas não necessária pelos requisitos atuais"
    },
    {
      "name": "N/A",
      "description": "Não é aplicável para o design atual"
    }
  ],
  "categories": [
    {
      "name": "Defender para nuvem"
    },
    {
      "name": "Rede Azure"
    },
    {
      "name": "Identidade"
    },
    {
      "name": "Verificações de segurança VM"
    },
    {
      "name": "Sentinela"
    },
    {
      "name": "Azure Firewall"
    }
  ]
}

checklists/security_checklist.ko.json METASEP
{
  "metadata": {
    "name": "Azure 보안 검토 검사 목록"
  },
  "items": [
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "가격 및 설정",
      "text": "모든 구독에서 보안 센터/수비수 사용",
      "guid": "54174158-33fb-43ae-9c2d-e743165c3acb",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "가격 및 설정",
      "text": "모든 로그 분석 작업 영역에서 보안 센터/수비수 사용",
      "guid": "349f0364-d28d-442e-abbb-c868255abc91",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "가격 및 설정",
      "text": "데이터 수집이 '공통'으로 설정됨",
      "guid": "64e9a19a-e28c-484c-93b6-b7818ca0e6c4",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-data-collection?tabs=autoprovision-feature#what-event-types-are-stored-for-common-and-minimal"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "가격 및 설정",
      "text": "Defender for Cloud 강화 보안 기능이 모두 활성화되었습니다.",
      "guid": "2149d414-a923-4c35-94d1-1029bd6aaf11",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "가격 및 설정",
      "text": "회사 정책에 따라 자동 프로비저닝 사용(정책이 있어야 함)",
      "guid": "e6b84ee5-ef43-4d29-a248-1718d5d1f5f7",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-enable-data-collection"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "가격 및 설정",
      "text": "회사 정책에 따라 사용하도록 설정된 전자 메일 알림(정책이 있어야 함)",
      "guid": "25759e35-680e-4782-9ac9-32213d027ff4",
      "severity": "낮다",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-provide-security-contact-details"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "가격 및 설정",
      "text": "통합 사용 옵션이 선택되었습니다. ",
      "guid": "12f70993-0631-4583-9ee7-9d6c6d363206",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-wdatp?WT.mc_id=Portal-Microsoft_Azure_Security_CloudNativeCompute&tabs=windows"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "가격 및 설정",
      "text": "CI/CD 통합이 구성됨",
      "guid": "5b7bae4-4위-45e8-a79e-2e86667313c5",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/security-center/defender-for-container-registries-cicd"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "가격 및 설정",
      "text": "제3자 SIEM을 사용하는 경우 '이벤트 허브' 연속 내보내기가 활성화됩니다.",
      "guid": "05675c5e-985b-4859-a774-f7e371623b87",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "가격 및 설정",
      "text": "Azure 센티넬을 사용하지 않는 경우 '로그 분석 작업 영역'을 계속 내보낼 수 있습니다.",
      "guid": "5a917e1f-349f-4036-9d28-d42e8bbbc868",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "가격 및 설정",
      "text": "AWS에 클라우드 커넥터 지원",
      "guid": "255abc91-64e9-4a19-ae28-c84c43b6b781",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-aws?WT.mc_id=Portal-Microsoft_Azure_Security"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "가격 및 설정",
      "text": "GCP에 사용할 수 있는 클라우드 커넥터",
      "guid": "8ca0e6c4-2149-4d41-9a92-3c3574d11029",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-gcp"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "가격 및 설정",
      "text": "Azure AD 응용 프로그램 프록시를 사용하는 경우 클라우드 앱용 Microsoft Defender와 통합하여 응용 프로그램 액세스를 실시간으로 모니터링하고 고급 보안 제어를 적용하는 것이 좋습니다.",
      "guid": "cce9bdf6-b483-45a0-85ec-c8232b230652",
      "severity": "낮다",
      "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-integrate-with-microsoft-cloud-application-security"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "권장 사항",
      "text": "필요하지 않은 경우 모든 권장 사항이 수정되거나 비활성화됩니다.",
      "guid": "df9cc234-18db-4611-9126-5f4bb47a393a",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/security-center/secure-score-security-controls"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "권장 사항",
      "text": "보안 점수 > 70 %",
      "description": "모든 고객에 대한 Microsoft 최소 목표는 70%입니다.",
      "guid": "08032729-4798-4b15-98a2-19a46ceb5443",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "보안 경고",
      "text": "보안 경고에는 지난 24시간 동안 생성된 경고만 포함됩니다(이전 보안 경고 수정 또는 비활성화).",
      "guid": "50259226-4429-42bb-9285-37a55119bf8e",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/tutorial-security-incident"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "통합 문서",
      "text": "연속 내보내기를 사용하도록 설정한 경우 기본 통합 문서가 사용자 지정 보안 대시보드에 게시됨",
      "guid": "8f585428-7d9c-4dc1-96cd-072af9b141a8",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/security-center/custom-dashboards-azure-workbooks"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "커뮤니티",
      "text": "고객은 '커뮤니티'페이지의 가치를 알고 있으며 검토를 위해 정기적으로 케이던스를 설정했습니다.",
      "guid": "98a535e7-3789-47e7-8ca7-da7be9962a15",
      "severity": "보통",
      "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "보안 점수",
      "text": "Security Center에서 보호하는 모든 구독이 표시됩니다(구독 필터가 설정되지 않음).",
      "description": "고객 운영 모범 사례 - 투명성",
      "guid": "93846da9-7cc3-4923-856b-22586f4a1641",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "규정 준수",
      "text": "규정 준수 제어는 필요한 규정 준수 요구 사항에 대해 친환경적입니다.",
      "guid": "bdddea8a-487c-4deb-9861-bc3bc14aea6e",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-compliance-dashboard"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "Azure Defender",
      "text": "심각도가 높은 VM 취약성이 제로(비어 있음)입니다.",
      "description": "고객 운영 모범 사례 - 확인",
      "guid": "65e8d9a3-aec2-418e-9436-b0736db55f57",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/remediate-vulnerability-findings-vm"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "방화벽 관리자",
      "text": "허브는 Azure 방화벽에 의해 보호됩니다.",
      "guid": "9603334b-df9c-4c23-918d-b61171265f4b",
      "severity": "보통",
      "link": "https://techcommunity.microsoft.com/t5/azure-network-security/azure-firewall-manager-is-now-integrated-with-azure-security/ba-p/2228679"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "방화벽 관리자",
      "text": "가상 네트워크는 방화벽에 의해 보호됩니다.",
      "description": "고객 운영 모범 사례 - 확인",
      "guid": "b47a393a-0803-4272-a479-8b1578a219a4",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/network-best-practices"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "방화벽 관리자",
      "text": "DDoS 표준 사용 가능",
      "guid": "6ceb5443-5025-4922-9442-92bb628537a5",
      "severity": "보통",
      "link": "https://azure.microsoft.com/blog/how-azure-security-center-detects-ddos-attack-using-cyber-threat-intelligence/"
    },
    {
      "category": "클라우드를 위한 수비수",
      "subcategory": "보도",
      "text": "모든 구독이 적용되는지 확인(가격 및 수정할 설정 참조)",
      "guid": "5119bf8e-8f58-4542-a7d9-cdc166cd072a",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started?WT.mc_id=Portal-Microsoft_Azure_Security"
    },
    {
      "category": "Azure Networking",
      "subcategory": "공용 IP",
      "text": "공용 IP가 있는 VM은 NSG로 보호해야 합니다. ",
      "guid": "4df585ec-dce9-4793-a7bc-db3b51eb2eb0",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses"
    },
    {
      "category": "Azure Networking",
      "subcategory": "공용 IP",
      "text": "공용 IP가 있는 VM은 Azure 방화벽 프리미엄 뒤로 이동됩니다.",
      "description": "고객 운영 모범 사례 - 확인",
      "guid": "3dda6e59-d7c8-4a2e-bb11-7d6769af669c",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses"
    },
    {
      "category": "Azure Networking",
      "subcategory": "공용 IP",
      "text": "공용 IP가 필요하지 않은 VM에는 공용 IP가 없습니다(예: 내부 RDP에만 해당).",
      "description": "고객 운영 모범 사례 - 확인",
      "guid": "a48e5a85-f222-43ec-b8bb-12308ca5017f",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access"
    },
    {
      "category": "Azure Networking",
      "subcategory": "증권 시세 표시기",
      "text": "NSG RBAC는 네트워크 보안 팀에 대한 액세스를 제한하는 데 사용됩니다.",
      "guid": "158e3ea3-a93c-42de-9e31-65c3a87a04b7",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "증권 시세 표시기",
      "text": "NSG 인바운드 보안 규칙에는 원본 필드에 *(와일드카드)가 포함되어 있지 않습니다.",
      "description": "고객 운영 모범 사례 - 확인",
      "guid": "a209939b-da47-4778-b24c-116785c2fa55",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "증권 시세 표시기",
      "text": "NSG 아웃바운드 보안 규칙은 방화벽을 통해 라우팅되지 않은 트래픽에 대해 특정 IP 주소에 대한 트래픽을 제어하는 데 사용됩니다.",
      "description": "고객 운영 모범 사례 - 확인",
      "guid": "b56a9480-08be-47d7-b4c4-76b6d8bdcf59",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "증권 시세 표시기",
      "text": "NSG에는 소스가 *(와일드카드)로 설정되어 있지 않습니다.",
      "description": "고객 운영 모범 사례 - 확인",
      "guid": "bce65de8-a13f-4988-9946-8d66a786d60f",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "증권 시세 표시기",
      "text": "NSG 진단은 NetworkSecurityGroupEvent 및 NetworkSecurityGroupRuleCounter 트래픽을 Sentinel LAW로 보냅니다.",
      "guid": "a6c97be9-955d-404c-9c49-c986cb2d1215",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-nsg-manage-log"
    },
    {
      "category": "Azure Networking",
      "subcategory": "UDR",
      "text": "UDR RBAC는 네트워크 보안 팀에 대한 액세스를 제한하는 데 사용됩니다.",
      "guid": "aa124b6e-4df5-485e-adce-9793b7bcdb3b",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "UDR",
      "text": "제로 트러스트인 경우 UDR은 모든 트래픽을 Azure 방화벽 프리미엄으로 보내는 데 사용됩니다.",
      "guid": "51eb2eb0-3dda-46e5-ad7c-8a2edb117d67",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "UDR",
      "text": "AzureFirewallPremium으로 모든 트래픽을 보내지 않는 UDR은 알려져 있고 문서화되어 있습니다.",
      "description": "고객 운영 모범 사례 - 확인",
      "guid": "69af669c-a48e-45a8-9f22-23ece8bb1230",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "가상 네트워크",
      "text": "고객은 Azure의 Azure 네트워킹 기본값/SDN 기본 라우팅에 익숙합니다.",
      "guid": "8ca5017f-158e-43ea-9a93-c2de7e3165c3",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview#default"
    },
    {
      "category": "Azure Networking",
      "subcategory": "가상 네트워크",
      "text": "VNet RBAC는 네트워크 보안 팀에 대한 액세스를 제한하는 데 사용됩니다.",
      "description": "고객 운영 모범 사례 - 확인",
      "guid": "a87a04b7-a209-4939-ada4-7778f24c1167",
      "severity": "보통",
      "link": "https://github.com/MicrosoftDocs/azure-docs/issues/53672"
    },
    {
      "category": "Azure Networking",
      "subcategory": "가상 네트워크",
      "text": "VNet 보안 권장 사항이 수정되고 '위험' VNet이 없습니다. ",
      "guid": "85c2fa55-b56a-4948-808b-e7d7e4c476b6",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/virtual-network/policy-reference"
    },
    {
      "category": "Azure Networking",
      "subcategory": "가상 네트워크",
      "text": "VNet 피어링 연결을 이해하고 예상되는 트래픽 흐름이 문서화됩니다.",
      "guid": "d8bdcf59-bce6-45de-aa13-f98879468d66",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "가상 네트워크",
      "text": "VNet 서비스 끝점이 사용 중이며 레거시 공용 서비스 끝점이 없습니다.",
      "guid": "a786d60f-a6c9-47be-a955-d04c3c49c986",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "가상 네트워크",
      "text": "VNet 개인 끝점이 온-프레미스 환경에서 액세스를 허용하는 데 사용 중이며 레거시 공용 끝점이 없습니다.",
      "guid": "1f625659-ee55-480a-9824-9c931213dbd7",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "가상 네트워크",
      "text": "VNet 모니터링 사용",
      "guid": "fb012f70-943f-4630-9722-ea39d2b1ce63",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network"
    },
    {
      "category": "Azure Networking",
      "subcategory": "가상 네트워크",
      "text": "AKS(Azure Kubernetes Service)의 네트워크 정책을 사용하여 포드 간의 트래픽 보안",
      "guid": "2055b29b-ade4-4위-8e8c-39ec94666731",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/virtual-network/kubernetes-network-policies"
    },
    {
      "category": "Azure Networking",
      "subcategory": "가상 네트워크",
      "text": "VNet NVA(어플라이언스) 고객이 게시된 아키텍처 패턴을 따릅니다.",
      "guid": "3c005674-c1e9-445b-959c-373e7ed71623",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-scenario-udr-gw-nva"
    },
    {
      "category": "Azure Networking",
      "subcategory": "가상 네트워크",
      "text": "VNet 진단 설정이 사용하도록 설정되고 VMProtectionAlerts를 Azure Sentinel LAW로 보냅니다.",
      "guid": "b375a917-ecbe-448f-ae64-dd7df2e8bbbc",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network"
    },
    {
      "category": "Azure Networking",
      "subcategory": "인터넷",
      "text": "ExpressRoute 또는 VPN을 사용하여 온-프레미스 환경에서 Azure 리소스에 액세스",
      "guid": "468155ab-c916-44e9-a09a-ed8c44cf3b2b",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure"
    },
    {
      "category": "Azure Networking",
      "subcategory": "가상 WAN",
      "text": "VWAN RBAC는 네트워크 보안 팀에 대한 액세스를 제한하는 데 사용됩니다.",
      "guid": "bd8ac2aa-ebca-42a4-9da1-dbf3dd992481",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about"
    },
    {
      "category": "Azure Networking",
      "subcategory": "가상 WAN",
      "text": "VWAN 고객은 보안 허브 또는 외부 방화벽을 사용하여 트래픽을 라우팅하고 모니터링합니다.",
      "guid": "718d1dca-1f62-4565-aee5-580a38249c93",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-global-transit-network-architecture"
    },
    {
      "category": "Azure Networking",
      "subcategory": "응용 프로그램 게이트웨이",
      "text": "AppGW RBAC는 네트워크 보안 팀에 대한 액세스를 제한하는 데 사용됩니다.",
      "guid": "1213dbd7-fb01-42f7-8943-f6304722ea39",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/web-application-firewall/overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "응용 프로그램 게이트웨이",
      "text": "AppGW 모든 외부 연결 웹 서비스는 WAF가 활성화 된 응용 프로그램 게이트웨이를 호출합니다. ",
      "guid": "d2b1ce63-2055-4b29-aade-4aad1e8c39ec",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip"
    },
    {
      "category": "Azure Networking",
      "subcategory": "응용 프로그램 게이트웨이",
      "text": "AppGW 모든 내부 연결 웹 서비스는 WAF가 활성화 된 응용 프로그램 게이트웨이를 호출합니다. ",
      "guid": "94666731-3c00-4567-9c1e-945b459c373e",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip"
    },
    {
      "category": "Azure Networking",
      "subcategory": "응용 프로그램 게이트웨이",
      "text": "AppGW - 외부 직면이 TLS/SSL을 사용하도록 설정되어 있으며 모든 트래픽을 443(포트 80 트래픽 없음)으로 리디렉션합니다.",
      "guid": "7ed71623-b375-4a91-9ecb-e48fbe64dd7d",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "프론트도어",
      "text": "Front Door RBAC는 네트워크 보안 팀에 대한 액세스를 제한하는 데 사용됩니다.",
      "guid": "f2e8bbbc-4681-455a-ac91-64e9909aed8c",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/frontdoor/"
    },
    {
      "category": "Azure Networking",
      "subcategory": "프론트도어",
      "text": "정문은 WAF 정책과 연결되어 있습니다.",
      "guid": "44cf3b2b-3818-4baf-a2cf-2149d013a923",
      "severity": "높다",
      "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/front-door-security-baseline?toc=/azure/frontdoor/TOC.json"
    },
    {
      "category": "Azure Networking",
      "subcategory": "프론트도어",
      "text": "프런트 도어 TLS/SSL 정책이 구성됨",
      "guid": "ce574dcc-bd8a-4c2a-aebc-a2a44da1dbf3",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain-https"
    },
    {
      "category": "Azure Networking",
      "subcategory": "프론트도어",
      "text": "전면 도어 리디렉션 포트 80에서 포트 443으로 구성됨(수신기)",
      "guid": "dd992481-718d-41dc-a1f6-25659ee5580a",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/frontdoor/front-door-url-redirect"
    },
    {
      "category": "Azure Networking",
      "subcategory": "프론트도어",
      "text": "정문 진단 로그는 ApplicationGatewayAccessLog &ApplicationGateway FirewallLog를 Sentinel LAW로 보냅니다.",
      "guid": "38249c93-1213-4dbd-9fb0-12f70943f630",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/frontdoor/front-door-diagnostics"
    },
    {
      "category": "Azure Networking",
      "subcategory": "DDOS 보호",
      "text": "방화벽 공용 IP(모든 공용 IP)에 대해 사용",
      "guid": "4722ea39-d2b1-4ce6-9205-5b29bade4aad",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices"
    },
    {
      "category": "신원",
      "subcategory": "테 넌 트",
      "text": "풀 타임 직원 및 엔터프라이즈 리소스의 ID를 관리하기 위한 단일 엔터프라이즈 디렉터리를 설정합니다.",
      "guid": "346ad56f-bdb8-44db-8bcd-0a689af63f1e",
      "severity": "높다",
      "link": "https://learn.microsoft.com/security/compass/identity#a-single-enterprise-directory"
    },
    {
      "category": "신원",
      "subcategory": "테 넌 트",
      "text": "클라우드 ID를 기존 ID 시스템과 동기화합니다.",
      "guid": "a46108cd-6a76-4749-ae69-b7bf61410010",
      "severity": "높다",
      "link": "https://learn.microsoft.com/security/compass/identity#synchronized-identity-systems"
    },
    {
      "category": "신원",
      "subcategory": "테 넌 트",
      "text": "클라우드 ID 서비스를 사용하여 온-프레미스 디렉터리에 포함시키지 않고 공급업체, 파트너 및 고객과 같은 직원이 아닌 계정을 호스팅합니다.",
      "guid": "a1ab96ceb-c149-4ce2-bcad-3bd375ebfc7f",
      "severity": "높다",
      "link": "https://learn.microsoft.com/security/compass/identity#cloud-provider-identity-source-for-third-parties"
    },
    {
      "category": "신원",
      "subcategory": "테 넌 트",
      "text": "인터넷 연결 서비스에 대해 안전하지 않은 레거시 프로토콜을 사용하지 않도록 설정합니다.",
      "guid": "343473ec-ed5c-49e1-98f4-cb09524a23cd",
      "severity": "높다",
      "link": "https://learn.microsoft.com/security/compass/identity#block-legacy-authentication"
    },
    {
      "category": "신원",
      "subcategory": "테 넌 트",
      "text": "싱글 사인온 사용",
      "guid": "70dceb23-50c7-4d8d-bf53-8cc104c7dc44",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/identity-management-best-practices#enable-single-sign-on"
    },
    {
      "category": "신원",
      "subcategory": "권한 있는 관리",
      "text": "엔터프라이즈 ID 시스템을 클라우드 디렉터리와 동기화할 때 온-프레미스 리소스에 대한 가장 높은 권한 액세스 권한으로 계정을 동기화하지 마세요.",
      "guid": "87791be1-1eb0-48ed-8003-ad9bcf241b99",
      "severity": "높다",
      "link": "https://learn.microsoft.com/security/compass/identity#no-on-premises-admin-accounts-in-cloud-identity-providers"
    },
    {
      "category": "신원",
      "subcategory": "권한 있는 관리",
      "text": "전역 관리자 수를 5명 미만으로 제한합니다.",
      "guid": "9e6efe9d-f28f-463b-9bff-b5080173e9fe",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5"
    },
    {
      "category": "신원",
      "subcategory": "권한 있는 관리",
      "text": "Azure AD 역할 할당에 그룹을 사용하고 역할 할당을 위임합니다.",
      "guid": "e0d968d3-87f6-41fb-a4f9-d852f1673f4c",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#6-use-groups-for-azure-ad-role-assignments-and-delegate-the-role-assignment"
    },
    {
      "category": "신원",
      "subcategory": "권한 있는 관리",
      "text": "모든 중요 영향 관리자가 엔터프라이즈 디렉터리에서 관리되어 조직 정책 적용을 따르도록 합니다.",
      "guid": "00350863-4df6-4050-9cf1-cbaa6d58283e",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#managed-accounts-for-admins"
    },
    {
      "category": "신원",
      "subcategory": "권한 있는 관리",
      "text": "시간이 지남에 따라 불필요한 권한을 해지하도록 반복 액세스 검토 구성",
      "guid": "eae64d01-0d3a-4ae1-a89d-cc1c2ad3888f",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#4-configure-recurring-access-reviews-to-revoke-unneeded-permissions-over-time"
    },
    {
      "category": "신원",
      "subcategory": "권한 있는 관리",
      "text": "중대한 영향 관리자가 보안 보호 및 모니터링이 강화된 워크스테이션을 사용하는지 확인",
      "guid": "922ac19f-916d-4697-b8ea-ded26bdd186f",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#admin-workstation-security"
    },
    {
      "category": "신원",
      "subcategory": "외부 신원",
      "text": "ID 공급자: 외부 ID 공급자가 알려져 있는지 확인",
      "guid": "1e8c39ec-9466-4673-83c0-05674c1e945b",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/compare-with-b2c"
    },
    {
      "category": "신원",
      "subcategory": "외부 신원",
      "text": "외부 공동 작업 설정: 게스트 사용자 액세스가 '게스트 사용자 액세스가 제한됩니까?'로 설정됩니다.",
      "guid": "459c373e-7ed7-4162-9b37-5a917ecbe48f",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "신원",
      "subcategory": "외부 신원",
      "text": "외부 공동 작업 설정: 게스트 초대 설정이 '특정 관리자 역할에 할당된 사용자만'으로 설정됨",
      "guid": "be64dd7d-f2e8-4bbb-a468-155abc9164e9",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "신원",
      "subcategory": "외부 신원",
      "text": "외부 공동 작업 설정: '사용 안 함'으로 설정된 흐름을 통해 게스트 셀프 서비스 가입 사용 ",
      "guid": "909aed8c-44cf-43b2-a381-8bafa2cf2149",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "신원",
      "subcategory": "외부 신원",
      "text": "외부 공동 작업 설정: 공동 작업 제한이 '지정된 도메인에 대한 초대 허용'으로 설정됨",
      "guid": "d013a923-ce57-44dc-abd8-ac2aaebca2a4",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "신원",
      "subcategory": "외부 신원",
      "text": "액세스 검토: 모든 그룹에 대해 사용 가능",
      "guid": "4da1dbf3-dd99-4248-8718-d1dca1f62565",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/active-directory/governance/deploy-access-reviews"
    },
    {
      "category": "신원",
      "subcategory": "엔터프라이즈 응용 프로그램",
      "text": "동의 및 권한: 확인된 게시자의 앱에 대한 사용자 동의 허용",
      "guid": "9ee5580a-3824-49c9-9121-3dbd7fb012f7",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent"
    },
    {
      "category": "신원",
      "subcategory": "엔터프라이즈 응용 프로그램",
      "text": "동의 및 권한: 선택한 그룹 소유자에 대해 그룹 소유자 동의 허용 ",
      "guid": "0943f630-4722-4ea3-ad2b-1ce632055b29",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent-groups"
    },
    {
      "category": "신원",
      "subcategory": "사용자 지정 도메인",
      "text": "검증된 고객 도메인만 등록됩니다.",
      "guid": "bade4aad-1e8c-439e-a946-667313c00567",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-configure-custom-domain"
    },
    {
      "category": "신원",
      "subcategory": "암호 재설정",
      "text": "셀프 서비스 암호 재설정 정책 요구 사항을 준수하는지 확인했습니다.",
      "guid": "4c1e945b-459c-4373-b7ed-71623b375a91",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-sspr"
    },
    {
      "category": "신원",
      "subcategory": "암호 재설정",
      "text": "사용자에게 인증 정보를 다시 확인하라는 메시지가 표시되기까지의 일수를 0으로 설정하지 않음",
      "guid": "7ecbe48f-be64-4dd7-bf2e-8bbbc468155a",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment"
    },
    {
      "category": "신원",
      "subcategory": "암호 재설정",
      "text": "암호 재설정에 필요한 설정 횟수가 선택되었습니다.",
      "guid": "bc9164e9-909a-4ed8-a44c-f3b2b3818baf",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment"
    },
    {
      "category": "신원",
      "subcategory": "사용자 설정",
      "text": "'사용자가 응용 프로그램을 등록 할 수 있습니다'를 비활성화하십시오.",
      "guid": "a2cf2149-d013-4a92-9ce5-74dccbd8ac2a",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/delegate-app-roles"
    },
    {
      "category": "신원",
      "subcategory": "사용자 설정",
      "text": "portal.azure.com(관리 포털)에 대한 액세스를 관리자로만 제한",
      "guid": "aebca2a4-4da1-4dbf-9dd9-92481718d1dc",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/users-default-permissions"
    },
    {
      "category": "신원",
      "subcategory": "사용자 설정",
      "text": "'LinkedIn 계정 연결' 비활성화",
      "guid": "a1f62565-9ee5-4580-a382-49c931213dbd",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/enterprise-users/linkedin-integration"
    },
    {
      "category": "신원",
      "subcategory": "진단 설정",
      "text": "사용 및 센티넬을 사용하여 로그 분석 작업 영역으로 보내기",
      "guid": "7fb012f7-0943-4f63-8472-2ea39d2b1ce6",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-monitoring"
    },
    {
      "category": "신원",
      "subcategory": "PIM 사용 가능",
      "text": "권한 있는 ID 관리 사용",
      "guid": "21e44a19-a9dd-4399-afd7-b28dc8355562",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan"
    },
    {
      "category": "신원",
      "subcategory": "PIM 사용 가능",
      "text": "'JIT(Just in Time)' 액세스를 구현하여 권한 있는 계정의 노출 시간을 더욱 단축(스탠딩 액세스 감소)",
      "guid": "46f4389a-7f42-4c78-b78c-06a63a21a495",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc"
    },
    {
      "category": "신원",
      "subcategory": "조건부 액세스 정책",
      "text": "조건부 액세스 정책 구성 / 액세스 제어",
      "guid": "6e6a8dc4-a20e-427b-9e29-711b1352beee",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common"
    },
    {
      "category": "신원",
      "subcategory": "조건부 액세스 정책",
      "text": "조건: 제한된 위치",
      "guid": "079b588d-efc4-4972-ac3c-d21bf77036e5",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition"
    },
    {
      "category": "신원",
      "subcategory": "조건부 액세스 정책",
      "text": "액세스 제어: 모든 사용자에 대해 MFA 사용",
      "guid": "e6b4bed3-d5f3-4547-a134-7dc56028a71f",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-azure-mfa"
    },
    {
      "category": "신원",
      "subcategory": "조건부 액세스 정책",
      "text": "액세스 제어: 관리자에 대해 MFA 필요",
      "guid": "fe1bd15d-d2f0-4d5e-972d-41e3611cc57b",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa"
    },
    {
      "category": "신원",
      "subcategory": "조건부 액세스 정책",
      "text": "액세스 제어: Azure 관리에 MFA 필요 ",
      "guid": "4a4b1410-d439-4589-ac22-89b3d6b57cfc",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management"
    },
    {
      "category": "신원",
      "subcategory": "조건부 액세스 정책",
      "text": "액세스 제어: 레거시 프로토콜 차단",
      "guid": "645461e1-a3e3-4453-a3c8-639637a552d6",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy"
    },
    {
      "category": "신원",
      "subcategory": "조건부 액세스 정책",
      "text": "액세스 제어: 장치를 규격으로 표시해야 합니다.",
      "guid": "7ae9eab4-0fd3-4290-998b-c178bdc5a06c",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/require-managed-devices"
    },
    {
      "category": "신원",
      "subcategory": "게스트 사용자",
      "text": "게스트 사용자 계정을 추적하는 정책(예: 사용/삭제/사용 안 함)이 있습니까?",
      "description": "고객 문서화 정책",
      "guid": "a7144351-e19d-4d34-929e-b7228137a151",
      "severity": "보통",
      "link": "https://devblogs.microsoft.com/premier-developer/azure-active-directory-automating-guest-user-management/"
    },
    {
      "category": "신원",
      "subcategory": "ID 보안 점수",
      "text": "업계 모범 사례를 기반으로 ID 보안 점수 구현",
      "guid": "c5bb4e4f-1814-4287-b5ca-8c26c9b32ab5",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/identity-secure-score"
    },
    {
      "category": "신원",
      "subcategory": "브레이크 글래스 계정",
      "text": "적어도 두 개의 브레이크 글라스 계정이 만들어졌으며 사용에 관한 정책이 존재합니다.",
      "guid": "bcfc6998-a135-4e33-9897-e31c67d68cb6",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "액세스 제어",
      "text": "Azure 정책을 활용한 VM 액세스 제어",
      "guid": "0ac252b9-99a6-48af-a7c9-a8f821b8eb8c",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "액세스 제어",
      "text": "템플릿을 활용하여 VM 설정 및 배포의 변동성을 줄입니다.",
      "guid": "0aa77e26-e4d5-4aea-a8dc-4e2436bc336d",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "액세스 제어",
      "text": "거버넌스를 통해 리소스에 액세스할 수 있는 사용자를 줄임으로써 VMS를 배포하기 위한 권한 있는 액세스 보안",
      "guid": "b5945bda-4333-44fd-b91c-234182b65275",
      "severity": "보통",
      "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "고가용성 ",
      "text": "더 나은 가용성을 위해 워크로드에 여러 VM 사용 ",
      "guid": "269440b4-be3d-43e0-a432-76d4bdc015bc",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/architecture/checklist/resiliency-per-service"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "고가용성 ",
      "text": "재해 복구 솔루션 배포 및 테스트 ",
      "guid": "f219e4a1-eb58-4879-935d-227886d30b66",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-first-look-arm"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "고가용성 ",
      "text": "가용성 세트",
      "guid": "c57be595-1900-4838-95c5-86cb291ec16a",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "고가용성 ",
      "text": "가용 영역",
      "guid": "1d076ef9-f141-4acd-ae57-9377bcdb3751",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/availability-zones/az-overview?context=/azure/virtual-machines/context/context"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "고가용성 ",
      "text": "지역 내결함성 ",
      "guid": "ab2ac1fa-d66e-415d-9d5a-2adb2c3e2326",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/architecture/resiliency/recovery-loss-azure-region"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "맬웨어로부터 보호",
      "text": "맬웨어 방지 솔루션 설치",
      "guid": "af225ca4-4e16-496f-bdde-ace4cb1deb4c",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/antimalware"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "맬웨어로부터 보호",
      "text": "맬웨어 방지 솔루션을 보안 센터와 통합",
      "guid": "650c3fc1-4eeb-4b36-a382-9e3eec218368",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "VM 업데이트 관리",
      "text": "Azure 자동화를 사용한 업데이트 관리를 사용하여 VM을 최신 상태로 유지",
      "guid": "7a0177a2-b594-45bd-a433-34fdf91c2341",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/automation/update-management/overview"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "VM 업데이트 관리",
      "text": "배포용 Windows 이미지에 최신 수준의 업데이트가 있는지 확인 ",
      "guid": "c6fa96b9-6ad8-4840-af37-2734c876ba28",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/virtual-machines/automatic-vm-guest-patching"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "VM 업데이트 관리",
      "text": "클라우드용 Microsoft Defender를 사용하여 VM에 보안 업데이트를 신속하게 적용",
      "guid": "02145901-465d-438e-9309-ccbd979266bc",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/security-center/asset-inventory"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "VHD 암호화",
      "text": "VM에서 암호화 사용",
      "guid": "ca274faa-19bf-439d-a5d4-4c7c8919ca1f",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "VHD 암호화",
      "text": "암호화를 위한 보안 계층을 추가하기 위해 KEK(키 암호화 키) 추가 ",
      "guid": "6d5315ae-524b-4a34-b458-5e12139bd7bb",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/virtual-machines/windows/disk-encryption-key-vault#set-up-a-key-encryption-key-kek"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "VHD 암호화",
      "text": "롤백 목적으로 암호화하기 전에 디스크의 스냅숏 만들기",
      "guid": "012f7b95-e06e-4154-b2aa-3592828e6e20",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "직접 인터넷 연결 제한 ",
      "text": "중앙 네트워킹 그룹에만 네트워킹 리소스에 대한 사용 권한이 있는지 확인 ",
      "guid": "5173676a-e466-491e-a835-ad942223E138",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "직접 인터넷 연결 제한 ",
      "text": "'ANY' 원본 IP 추가 기능으로부터의 액세스를 허용하는 노출된 VM을 ID 및 수정합니다.",
      "guid": "10523081-a941-4741-9833-ff7ad7c6d373",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "직접 인터넷 연결 제한 ",
      "text": "적시 액세스를 사용하여 관리 포트(RDP, SSH) 제한",
      "guid": "75a91be1-f388-4f03-a4d2-cd463cbbbc86",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-just-in-time"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "직접 인터넷 연결 제한 ",
      "text": "인터넷 액세스를 제거하고 RDP용 점프 서버를 구현합니다.",
      "guid": "8295abc9-1a4e-4da0-bae2-cc84c47b6b78",
      "severity": "높다",
      "link": "http://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "직접 인터넷 연결 제한 ",
      "text": "인터넷에서 RDP / SSH를 사용하여 서버에 직접 로그인을 제거하고 VPN 또는 고속 경로를 구현하십시오.",
      "guid": "1cbafe6c-4658-49d4-98a9-27c3974d1102",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-forced-tunneling"
    },
    {
      "category": "VM 보안 검사",
      "subcategory": "직접 인터넷 연결 제한 ",
      "text": "Azure 요새를 RDP/SSH 브로커로 활용하여 보안을 강화하고 설치 공간을 줄입니다.",
      "guid": "dad6aae1-1e6b-484e-b5df-47d2d92881b1",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/bastion/bastion-overview"
    },
    {
      "category": "센 티 넬",
      "subcategory": "건축학 ",
      "text": "포함된 모든 테넌트에는 하나 이상의 로그 분석 작업 영역에서 센티넬이 활성화되어 있습니다.",
      "guid": "cd5d1e54-a297-459e-9968-0e78289c9356",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard"
    },
    {
      "category": "센 티 넬",
      "subcategory": "건축학 ",
      "text": "고객이 센티넬 아키텍처를 이해합니다.",
      "guid": "57d02bff-4564-4b0d-a34a-359836ee79d6",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/sentinel/best-practices-workspace-architecture"
    },
    {
      "category": "센 티 넬",
      "subcategory": "건축학 ",
      "text": "고객은 여러 센티넬 인스턴스에서 인시던트를 모니터링하는 방법을 알고 있습니다.",
      "guid": "e8f5c586-c7d9-4cdc-86ac-c075ef9b141a",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/sentinel/multiple-workspace-view"
    },
    {
      "category": "센 티 넬",
      "subcategory": "개요",
      "text": "24시간 이상 열리는 인시던트 없음",
      "guid": "8989579e-76b8-497e-910A-7Da7be9966E1",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/sentinel/manage-soc-with-incident-metrics"
    },
    {
      "category": "센 티 넬",
      "subcategory": "뉴스 및 가이드",
      "text": "고객에게 뉴스 및 가이드 탭이 표시됨",
      "guid": "5d3c4ada-97cb-43d1-925a-b225c6f4e068",
      "severity": "낮다",
      "link": "https://learn.microsoft.com/azure/sentinel/whats-new"
    },
    {
      "category": "센 티 넬",
      "subcategory": "UEBA ",
      "text": "UEBA 구성됨(센티넬/설정/설정/UEBA 구성)",
      "guid": "5edddea8-a4b7-4cde-a4c6-1fc3fc14eea6",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics"
    },
    {
      "category": "센 티 넬",
      "subcategory": "데이터 커넥터",
      "text": "구성된 Azure Active Directory 및 '마지막으로 받은 로그'가 오늘 표시됩니다.",
      "guid": "e69d8d9a-3eec-4218-b687-ab077adb49e5",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory"
    },
    {
      "category": "센 티 넬",
      "subcategory": "데이터 커넥터",
      "text": "Azure Active Directory ID 보호가 구성되고 '마지막으로 받은 로그'가 오늘 표시됩니다.",
      "guid": "b9603334-fdf8-4cc2-9318-db61171269f4",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-active-directory-identity-protection"
    },
    {
      "category": "센 티 넬",
      "subcategory": "데이터 커넥터",
      "text": "Azure 활동이 구성되고 '마지막으로 받은 로그'가 오늘 표시됩니다.",
      "guid": "0b4aa3d3-e070-4327-9d4b-98b15b8a219a",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity"
    },
    {
      "category": "센 티 넬",
      "subcategory": "데이터 커넥터",
      "text": "클라우드용 Microsoft Defender가 구성되었으며 '마지막으로 받은 로그'가 오늘 표시됩니다.",
      "guid": "8e13f9cc-bd46-4826-9abc-a264f9a19bfe",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud"
    },
    {
      "category": "센 티 넬",
      "subcategory": "데이터 커넥터",
      "text": "Azure 방화벽이 구성되고 '마지막으로 받은 로그'가 오늘 표시됩니다.",
      "guid": "9d55d04c-3c49-419c-a1b2-d1215ae114b9",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall"
    },
    {
      "category": "센 티 넬",
      "subcategory": "데이터 커넥터",
      "text": "Windows 방화벽이 구성되고 '마지막으로 받은 로그'가 오늘 표시됩니다.",
      "guid": "34df585e-cccd-49bd-9ba0-cdb3b54eb2eb",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-firewall"
    },
    {
      "category": "센 티 넬",
      "subcategory": "데이터 커넥터",
      "text": "보안 이벤트는 AMA로 구성되며 '마지막으로 받은 로그'가 오늘 표시됩니다.",
      "guid": "03ddaa25-9271-48d2-bdb1-0725769ef669",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama"
    },
    {
      "category": "센 티 넬",
      "subcategory": "데이터 커넥터",
      "text": "보안 이벤트 - Azure 컴퓨터가 연결되어 있고 작업 영역으로 데이터를 보내는지 확인",
      "guid": "1a4834ac-9322-423e-ae80-b123081a5417",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference"
    },
    {
      "category": "센 티 넬",
      "subcategory": "데이터 커넥터",
      "text": "보안 이벤트 - Azure 이외의 컴퓨터가 연결되어 있고 작업 영역으로 데이터를 보내는지 확인",
      "guid": "859c773e-7e26-4162-9b77-5a917e1f348e",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference"
    },
    {
      "category": "센 티 넬",
      "subcategory": "데이터 커넥터",
      "text": "AWS용 커넥터",
      "guid": "f354c27d-42e8-4bba-a868-155abb9163e9",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/sentinel/connect-aws?tabs=s3"
    },
    {
      "category": "센 티 넬",
      "subcategory": "데이터 커넥터",
      "text": "GCP용 커넥터",
      "guid": "909ae28c-84c3-43b6-a780-8bafe6c42149",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference"
    },
    {
      "category": "센 티 넬",
      "subcategory": "분석 규칙",
      "text": "고객이 분석 규칙을 사용하도록 설정하고 인시던트를 구성했습니다. ",
      "guid": "d413a923-c357-44d1-8028-ac6aae01e6a8",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/sentinel/detect-threats-built-in"
    },
    {
      "category": "센 티 넬",
      "subcategory": "설정",
      "text": "일일 한도가 활성화되어 있지 않은 경우",
      "guid": "4de5df43-d299-4248-8718-d5d1e5f62565",
      "severity": "보통",
      "link": "https://azure.microsoft.com/updates/controlling-data-volume-and-retention-in-log-analytics-2/"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "구성",
      "text": "Azure 방화벽 프리미엄 배포됨",
      "guid": "9e3558fd-7724-49c9-9111-2d027fe412f7",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/firewall/premium-features"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "구성",
      "text": "쿼드 제로/강제 튜닝은 Azure 방화벽을 통해 사용하도록 설정됨",
      "guid": "4dc74a74-8b66-433a-b2a0-916a764980ad",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal#create-a-default-route"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "액세스 제어",
      "text": "권한이 있는 사용자만 사용하도록 설정된 RBAC",
      "guid": "0e278ee2-93c1-4bc3-92ba-aab7571849ab",
      "severity": "보통",
      "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "진단 설정",
      "text": "진단을 사용하도록 설정하고 로그 분석 작업 영역에 메트릭을 보냅니다. ",
      "guid": "8093dc9f-c9d1-4bb7-9b36-a5a67fbb9ed5",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "방화벽 관리자",
      "text": "허브와 가상 네트워크는 방화벽 프리미엄을 통해 보호되거나 연결됩니다.",
      "guid": "b35478c3-4798-416b-8863-cffe1cac599e",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "방화벽 관리자",
      "text": "정책: 액세스 제어 구성됨(RBAC)",
      "guid": "f0d5a73d-d4de-436c-8c81-770afbc4c0e4",
      "severity": "높다",
      "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "방화벽 관리자",
      "text": "정책: 상위 정책이 구성됨 ",
      "guid": "5c3a87af-4a79-41f8-a39b-da47768e14c1",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "방화벽 관리자",
      "text": "정책: 규칙 컬렉션이 정의됩니다.",
      "guid": "15675c1e-a55b-446a-a48f-f8ae7d7e4b47",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "방화벽 관리자",
      "text": "정책: DNAT 정책이 정의되어 있습니다.",
      "guid": "5b6c8bcb-f59b-4ce6-9de8-a03f97879468",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "방화벽 관리자",
      "text": "정책: 네트워크 규칙이 정의됩니다.",
      "guid": "d66a786d-60e9-46c9-9ad8-855d04c2b39c",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "방화벽 관리자",
      "text": "정책: 응용 프로그램 규칙이 정의됩니다.",
      "guid": "986bb2c1-2149-4a11-9b5e-3df574ecccd9",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/firewall/features"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "방화벽 관리자",
      "text": "DNS: 이해되고 적용되거나 적용되지 않는 기능",
      "guid": "793a6bcd-a3b5-40eb-8eb0-3dd95d58d7c8",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/firewall/dns-details"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "방화벽 관리자",
      "text": "위협 인텔리전스: 경고 및 거부로 설정",
      "guid": "d622f54b-29ba-4de3-aad1-e8c28ec93666",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "방화벽 관리자",
      "text": "위협 인텔리전스: 허용된 목록(사용 중인 경우 정당화 - 즉, 성능)",
      "guid": "7313b005-674b-41e9-94a4-59c373e7ed61",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings#allowlist-addresses"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "방화벽 관리자",
      "text": "TLS 사용",
      "guid": "623b365a-917e-4cbe-98eb-d54cd7df2e8b",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/firewall/premium-certificates"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "방화벽 관리자",
      "text": "IDPS 사용 가능",
      "guid": "bac35715-59ab-4915-9e99-08aed8c44ce3",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "방화벽 관리자",
      "text": "SNAT: 구성됨 ",
      "guid": "b2b3808b-9fa1-4cf1-849d-003a923ce474",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/firewall/snat-private-range"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "DDOS 보호",
      "text": "방화벽 공용 IP에 대해 사용",
      "guid": "dbcbd8ac-2aae-4bca-8a43-da1dae2cc992",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices"
    }
  ],
  "severities": [
    {
      "name": "높다"
    },
    {
      "name": "보통"
    },
    {
      "name": "낮다"
    }
  ],
  "status": [
    {
      "name": "확인되지 않음",
      "description": "이 검사는 아직 검토되지 않았습니다."
    },
    {
      "name": "열다",
      "description": "이 검사와 연관된 작업 항목이 있습니다."
    },
    {
      "name": "성취",
      "description": "이 검사가 확인되었으며 연관된 추가 작업 항목이 없습니다."
    },
    {
      "name": "필요하지 않음",
      "description": "권장 사항은 이해되었지만 현재 요구 사항에는 필요하지 않습니다."
    },
    {
      "name": "해당 없음",
      "description": "현재 설계에는 적용되지 않음"
    }
  ],
  "categories": [
    {
      "name": "클라우드를 위한 수비수"
    },
    {
      "name": "Azure Networking"
    },
    {
      "name": "신원"
    },
    {
      "name": "VM 보안 검사"
    },
    {
      "name": "센 티 넬"
    },
    {
      "name": "Azure Firewall"
    }
  ]
}

checklists/security_checklist.ja.json METASEP
{
  "metadata": {
    "name": "Azure セキュリティ レビュー チェックリスト"
  },
  "items": [
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "価格と設定",
      "text": "セキュリティ センター/ディフェンダーは、すべてのサブスクリプションで有効にします。",
      "guid": "54174158-33fb-43ae-9c2d-e743165c3acb",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "価格と設定",
      "text": "セキュリティ センター/ディフェンダーがすべてのログ分析ワークスペースで有効",
      "guid": "349f0364-d28d-442e-abbb-c868255abc91",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "価格と設定",
      "text": "データ収集は「共通」に設定",
      "guid": "64e9a19a-e28c-484c-93b6-b7818ca0e6c4",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-data-collection?tabs=autoprovision-feature#what-event-types-are-stored-for-common-and-minimal"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "価格と設定",
      "text": "Defender for Cloud の強化されたセキュリティ機能はすべて有効になっています",
      "guid": "2149d414-a923-4c35-94d1-1029bd6aaf11",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "価格と設定",
      "text": "会社のポリシーに従って自動プロビジョニングを有効にする (ポリシーが存在する必要があります)",
      "guid": "e6b84ee5-ef43-4d29-a248-1718d5d1f5f7",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-enable-data-collection"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "価格と設定",
      "text": "会社のポリシーに従って有効な電子メール通知 (ポリシーが存在する必要があります)",
      "guid": "25759e35-680e-4782-9ac9-32213d027ff4",
      "severity": "低い",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-provide-security-contact-details"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "価格と設定",
      "text": "統合を有効にするオプションが選択されている",
      "guid": "12f70993-0631-4583-9ee7-9d6c6d363206",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-wdatp?WT.mc_id=Portal-Microsoft_Azure_Security_CloudNativeCompute&tabs=windows"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "価格と設定",
      "text": "CI/CD 統合が構成されている",
      "guid": "5b7bae4-4th-45e8-a79e-2e86667313c5",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/security-center/defender-for-container-registries-cicd"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "価格と設定",
      "text": "連続エクスポート「イベントハブ」は、サードパーティのSIEMを使用している場合に有効になります",
      "guid": "05675c5e-985b-4859-a774-f7e371623b87",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "価格と設定",
      "text": "継続的なエクスポート 'Log Analytics Workspace' は、Azure Sentinel を使用していない場合に有効になります。",
      "guid": "5a917e1f-349f-4036-9d28-d42e8bbbc868",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "価格と設定",
      "text": "AWS で有効になっているクラウドコネクタ",
      "guid": "255abc91-64e9-4a19-ae28-c84c43b6b781",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-aws?WT.mc_id=Portal-Microsoft_Azure_Security"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "価格と設定",
      "text": "GCP で有効なクラウドコネクタ",
      "guid": "8ca0e6c4-2149-4d41-9a92-3c3574d11029",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-gcp"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "価格と設定",
      "text": "Azure AD アプリケーション プロキシを使用する場合は、Microsoft Defender for Cloud Apps との統合を検討して、アプリケーションのアクセスをリアルタイムで監視し、高度なセキュリティ制御を適用することを検討してください。",
      "guid": "cce9bdf6-b483-45a0-85ec-c8232b230652",
      "severity": "低い",
      "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-integrate-with-microsoft-cloud-application-security"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "推奨 事項",
      "text": "すべての推奨事項は、必要でない場合は修復または無効にされました。",
      "guid": "df9cc234-18db-4611-9126-5f4bb47a393a",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/security-center/secure-score-security-controls"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "推奨 事項",
      "text": "セキュリティスコア>70%",
      "description": "マイクロソフトのすべてのお客様の最小目標は 70% です。",
      "guid": "08032729-4798-4b15-98a2-19a46ceb5443",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "セキュリティアラート",
      "text": "セキュリティ警告には、過去 24 時間以内に生成されたもののみが含まれます (古いセキュリティ警告を修復または無効にする)",
      "guid": "50259226-4429-42bb-9285-37a55119bf8e",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/tutorial-security-incident"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "ブック",
      "text": "継続的エクスポートが有効になっている場合、カスタム セキュリティ ダッシュボードにパブリッシュされた既定のブック",
      "guid": "8f585428-7d9c-4dc1-96cd-072af9b141a8",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/security-center/custom-dashboards-azure-workbooks"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "コミュニティ",
      "text": "お客様は「コミュニティ」ページの価値を認識しており、レビュー用に定期的なリズムを設定しています。",
      "guid": "98a535e7-3789-47e7-8ca7-da7be9962a15",
      "severity": "中程度",
      "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "セキュアスコア",
      "text": "Security Center によって保護されているすべてのサブスクリプションが表示されます (サブスクリプション フィルター セットなし)",
      "description": "お客様の運用のベストプラクティス - 透明性",
      "guid": "93846da9-7cc3-4923-856b-22586f4a1641",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "法規制の遵守",
      "text": "コンプライアンスコントロールは、必要なコンプライアンス要件に対して緑色です",
      "guid": "bdddea8a-487c-4deb-9861-bc3bc14aea6e",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-compliance-dashboard"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "Azure Defender",
      "text": "重大度の高い VM の脆弱性はゼロ (空) です。",
      "description": "お客様の運用上のベスト・プラクティス - 検証",
      "guid": "65e8d9a3-aec2-418e-9436-b0736db55f57",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/remediate-vulnerability-findings-vm"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "ファイアウォールマネージャ",
      "text": "ハブは Azure ファイアウォールによって保護されています。",
      "guid": "9603334b-df9c-4c23-918d-b61171265f4b",
      "severity": "中程度",
      "link": "https://techcommunity.microsoft.com/t5/azure-network-security/azure-firewall-manager-is-now-integrated-with-azure-security/ba-p/2228679"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "ファイアウォールマネージャ",
      "text": "仮想ネットワークはファイアウォールで保護されています",
      "description": "お客様の運用上のベスト・プラクティス - 検証",
      "guid": "b47a393a-0803-4272-a479-8b1578a219a4",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/network-best-practices"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "ファイアウォールマネージャ",
      "text": "DDoS 標準が有効",
      "guid": "6ceb5443-5025-4922-9442-92bb628537a5",
      "severity": "中程度",
      "link": "https://azure.microsoft.com/blog/how-azure-security-center-detects-ddos-attack-using-cyber-threat-intelligence/"
    },
    {
      "category": "クラウド用ディフェンダー",
      "subcategory": "カバレッジ",
      "text": "すべてのサブスクリプションがカバーされていることを確認します (変更する価格と設定を参照)。",
      "guid": "5119bf8e-8f58-4542-a7d9-cdc166cd072a",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started?WT.mc_id=Portal-Microsoft_Azure_Security"
    },
    {
      "category": "Azure Networking",
      "subcategory": "パブリック IP アドレス",
      "text": "パブリック IP を持つ VM は NSG によって保護される必要があります。",
      "guid": "4df585ec-dce9-4793-a7bc-db3b51eb2eb0",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses"
    },
    {
      "category": "Azure Networking",
      "subcategory": "パブリック IP アドレス",
      "text": "パブリック IP を持つ VM は、Azure Firewall Premium の背後に移動されます。",
      "description": "お客様の運用上のベスト・プラクティス - 検証",
      "guid": "3dda6e59-d7c8-4a2e-bb11-7d6769af669c",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses"
    },
    {
      "category": "Azure Networking",
      "subcategory": "パブリック IP アドレス",
      "text": "パブリックIPを必要としないVMにはパブリックIPがありません(つまり、内部RDPのみ)",
      "description": "お客様の運用上のベスト・プラクティス - 検証",
      "guid": "a48e5a85-f222-43ec-b8bb-12308ca5017f",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access"
    },
    {
      "category": "Azure Networking",
      "subcategory": "ティッカー",
      "text": "NSG RBAC は、ネットワーク セキュリティ チームへのアクセスを制限するために使用されます。",
      "guid": "158e3ea3-a93c-42de-9e31-65c3a87a04b7",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "ティッカー",
      "text": "NSG インバウンド セキュリティ規則に [ソース] フィールドに * (ワイルドカード) が含まれていません",
      "description": "お客様の運用上のベスト・プラクティス - 検証",
      "guid": "a209939b-da47-4778-b24c-116785c2fa55",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "ティッカー",
      "text": "NSG アウトバウンド セキュリティ ルールは、ファイアウォール経由でルーティングされないトラフィックの特定の IP アドレスへのトラフィックを制御するために使用されます。",
      "description": "お客様の運用上のベスト・プラクティス - 検証",
      "guid": "b56a9480-08be-47d7-b4c4-76b6d8bdcf59",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "ティッカー",
      "text": "NSG には、ソースを * (ワイルドカード) として配置していません。",
      "description": "お客様の運用上のベスト・プラクティス - 検証",
      "guid": "bce65de8-a13f-4988-9946-8d66a786d60f",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "ティッカー",
      "text": "NSG Diagnostics が NetworkSecurityGroupEvent および NetworkSecurityGroupRuleCounter トラフィックを Sentinel LAW に送信する",
      "guid": "a6c97be9-955d-404c-9c49-c986cb2d1215",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-nsg-manage-log"
    },
    {
      "category": "Azure Networking",
      "subcategory": "ティッカー",
      "text": "UDR RBAC は、ネットワーク セキュリティ チームへのアクセスを制限するために使用されます。",
      "guid": "aa124b6e-4df5-485e-adce-9793b7bcdb3b",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "ティッカー",
      "text": "ゼロ トラストの場合、UDR を使用してすべてのトラフィックが Azure Firewall Premium に送信されます。",
      "guid": "51eb2eb0-3dda-46e5-ad7c-8a2edb117d67",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "ティッカー",
      "text": "すべてのトラフィックを AzureFirewallPremium に送信しない UDR は既知であり、文書化されています。",
      "description": "お客様の運用上のベスト・プラクティス - 検証",
      "guid": "69af669c-a48e-45a8-9f22-23ece8bb1230",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "仮想ネットワーク",
      "text": "お客様は、Azure ネットワークの既定値 / Azure での SDN の既定のルーティングに精通している",
      "guid": "8ca5017f-158e-43ea-9a93-c2de7e3165c3",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview#default"
    },
    {
      "category": "Azure Networking",
      "subcategory": "仮想ネットワーク",
      "text": "VNet RBAC は、ネットワーク セキュリティ チームへのアクセスを制限するために使用されます。",
      "description": "お客様の運用上のベスト・プラクティス - 検証",
      "guid": "a87a04b7-a209-4939-ada4-7778f24c1167",
      "severity": "中程度",
      "link": "https://github.com/MicrosoftDocs/azure-docs/issues/53672"
    },
    {
      "category": "Azure Networking",
      "subcategory": "仮想ネットワーク",
      "text": "VNet セキュリティの推奨事項は修復され、「危険にさらされている」VNet はありません。",
      "guid": "85c2fa55-b56a-4948-808b-e7d7e4c476b6",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/virtual-network/policy-reference"
    },
    {
      "category": "Azure Networking",
      "subcategory": "仮想ネットワーク",
      "text": "VNet ピアリング接続が理解され、予想されるトラフィック フローが文書化されている",
      "guid": "d8bdcf59-bce6-45de-aa13-f98879468d66",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "仮想ネットワーク",
      "text": "VNet サービス エンドポイントが使用中であり、従来のパブリック サービス エンドポイントは存在しません",
      "guid": "a786d60f-a6c9-47be-a955-d04c3c49c986",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "仮想ネットワーク",
      "text": "VNet プライベート エンドポイントはオンプレミス環境からのアクセスを許可するために使用されており、従来のパブリック エンドポイントは存在しません",
      "guid": "1f625659-ee55-480a-9824-9c931213dbd7",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "仮想ネットワーク",
      "text": "VNet 監視が有効になりました",
      "guid": "fb012f70-943f-4630-9722-ea39d2b1ce63",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network"
    },
    {
      "category": "Azure Networking",
      "subcategory": "仮想ネットワーク",
      "text": "Azure Kubernetes Service (AKS) のネットワーク ポリシーを使用したポッド間のトラフィックのセキュリティ保護",
      "guid": "2055b29b-ade4-4th-8e8c-39ec94666731",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/virtual-network/kubernetes-network-policies"
    },
    {
      "category": "Azure Networking",
      "subcategory": "仮想ネットワーク",
      "text": "VNet NVA(アプライアンス)のお客様は、公開されたアーキテクチャ パターンに従っています",
      "guid": "3c005674-c1e9-445b-959c-373e7ed71623",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-scenario-udr-gw-nva"
    },
    {
      "category": "Azure Networking",
      "subcategory": "仮想ネットワーク",
      "text": "VNet 診断設定が有効で、VMProtectionAlert を Azure Sentinel LAW に送信している",
      "guid": "b375a917-ecbe-448f-ae64-dd7df2e8bbbc",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network"
    },
    {
      "category": "Azure Networking",
      "subcategory": "接続",
      "text": "ExpressRoute または VPN を使用してオンプレミス環境から Azure リソースにアクセスする",
      "guid": "468155ab-c916-44e9-a09a-ed8c44cf3b2b",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure"
    },
    {
      "category": "Azure Networking",
      "subcategory": "仮想WAN",
      "text": "VWAN RBAC は、ネットワーク セキュリティ チームへのアクセスを制限するために使用されます。",
      "guid": "bd8ac2aa-ebca-42a4-9da1-dbf3dd992481",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about"
    },
    {
      "category": "Azure Networking",
      "subcategory": "仮想WAN",
      "text": "VWAN のお客様は、セキュアハブまたは外部ファイアウォールを使用してトラフィックをルーティングおよび監視しています。",
      "guid": "718d1dca-1f62-4565-aee5-580a38249c93",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-global-transit-network-architecture"
    },
    {
      "category": "Azure Networking",
      "subcategory": "アプリケーションゲートウェイ",
      "text": "AppGW RBAC は、ネットワーク セキュリティ チームへのアクセスを制限するために使用されます。",
      "guid": "1213dbd7-fb01-42f7-8943-f6304722ea39",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/web-application-firewall/overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "アプリケーションゲートウェイ",
      "text": "AppGW すべての外部向け Web サービスが、WAF が有効になっているアプリケーション ゲートウェイに依存しています。",
      "guid": "d2b1ce63-2055-4b29-aade-4aad1e8c39ec",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip"
    },
    {
      "category": "Azure Networking",
      "subcategory": "アプリケーションゲートウェイ",
      "text": "AppGW すべての内部向け Web サービスが、WAF が有効になっているアプリケーション ゲートウェイに依存しています。",
      "guid": "94666731-3c00-4567-9c1e-945b459c373e",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip"
    },
    {
      "category": "Azure Networking",
      "subcategory": "アプリケーションゲートウェイ",
      "text": "AppGW - 外部フェーシングでは TLS/SSL が有効になっており、すべてのトラフィックを 443 にリダイレクトします (ポート 80 トラフィックなし)",
      "guid": "7ed71623-b375-4a91-9ecb-e48fbe64dd7d",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "フロントドア",
      "text": "フロントドアRBACは、ネットワークセキュリティチームへのアクセスを制限するために使用されます",
      "guid": "f2e8bbbc-4681-455a-ac91-64e9909aed8c",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/frontdoor/"
    },
    {
      "category": "Azure Networking",
      "subcategory": "フロントドア",
      "text": "フロント ドアは WAF ポリシーに関連付けられています。",
      "guid": "44cf3b2b-3818-4baf-a2cf-2149d013a923",
      "severity": "高い",
      "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/front-door-security-baseline?toc=/azure/frontdoor/TOC.json"
    },
    {
      "category": "Azure Networking",
      "subcategory": "フロントドア",
      "text": "フロント ドア TLS/SSL ポリシーが構成されている",
      "guid": "ce574dcc-bd8a-4c2a-aebc-a2a44da1dbf3",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain-https"
    },
    {
      "category": "Azure Networking",
      "subcategory": "フロントドア",
      "text": "Front Door リダイレクト ポート 80 からポート 443 が設定されています (リスナー)",
      "guid": "dd992481-718d-41dc-a1f6-25659ee5580a",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/frontdoor/front-door-url-redirect"
    },
    {
      "category": "Azure Networking",
      "subcategory": "フロントドア",
      "text": "Front Door diagnostics logs send ApplicationGatewayAccessLog &ApplicationGateway FirewallLog to Sentinel LAW",
      "guid": "38249c93-1213-4dbd-9fb0-12f70943f630",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/frontdoor/front-door-diagnostics"
    },
    {
      "category": "Azure Networking",
      "subcategory": "DDOS保護",
      "text": "ファイアウォールのパブリック IP (すべてのパブリック IP) に対して有効",
      "guid": "4722ea39-d2b1-4ce6-9205-5b29bade4aad",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices"
    },
    {
      "category": "同一性",
      "subcategory": "テナント",
      "text": "フルタイムの従業員とエンタープライズ リソースの ID を管理するための単一のエンタープライズ ディレクトリを確立します。",
      "guid": "346ad56f-bdb8-44db-8bcd-0a689af63f1e",
      "severity": "高い",
      "link": "https://learn.microsoft.com/security/compass/identity#a-single-enterprise-directory"
    },
    {
      "category": "同一性",
      "subcategory": "テナント",
      "text": "クラウド ID を既存の ID システムと同期します。",
      "guid": "a46108cd-6a76-4749-ae69-b7bf61410010",
      "severity": "高い",
      "link": "https://learn.microsoft.com/security/compass/identity#synchronized-identity-systems"
    },
    {
      "category": "同一性",
      "subcategory": "テナント",
      "text": "クラウド ID サービスを使用して、ベンダー、パートナー、顧客などの従業員以外のアカウントを、オンプレミスのディレクトリに含めるのではなく、ホストします。",
      "guid": "a1ab96ceb-c149-4ce2-bcad-3bd375ebfc7f",
      "severity": "高い",
      "link": "https://learn.microsoft.com/security/compass/identity#cloud-provider-identity-source-for-third-parties"
    },
    {
      "category": "同一性",
      "subcategory": "テナント",
      "text": "インターネットに接続するサービスの安全でないレガシ プロトコルを無効にします。",
      "guid": "343473ec-ed5c-49e1-98f4-cb09524a23cd",
      "severity": "高い",
      "link": "https://learn.microsoft.com/security/compass/identity#block-legacy-authentication"
    },
    {
      "category": "同一性",
      "subcategory": "テナント",
      "text": "シングルサインオンの有効化",
      "guid": "70dceb23-50c7-4d8d-bf53-8cc104c7dc44",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/identity-management-best-practices#enable-single-sign-on"
    },
    {
      "category": "同一性",
      "subcategory": "特権管理",
      "text": "エンタープライズ ID システムをクラウド ディレクトリと同期するときに、オンプレミスのリソースへの最高の特権アクセスを持つアカウントを同期しないでください。",
      "guid": "87791be1-1eb0-48ed-8003-ad9bcf241b99",
      "severity": "高い",
      "link": "https://learn.microsoft.com/security/compass/identity#no-on-premises-admin-accounts-in-cloud-identity-providers"
    },
    {
      "category": "同一性",
      "subcategory": "特権管理",
      "text": "グローバル管理者の数を 5 人未満に制限する",
      "guid": "9e6efe9d-f28f-463b-9bff-b5080173e9fe",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5"
    },
    {
      "category": "同一性",
      "subcategory": "特権管理",
      "text": "Azure AD ロールの割り当てにグループを使用し、ロールの割り当てを委任する",
      "guid": "e0d968d3-87f6-41fb-a4f9-d852f1673f4c",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#6-use-groups-for-azure-ad-role-assignments-and-delegate-the-role-assignment"
    },
    {
      "category": "同一性",
      "subcategory": "特権管理",
      "text": "すべての重大な影響の管理者がエンタープライズディレクトリによって管理され、組織のポリシーの適用に従うようにします。",
      "guid": "00350863-4df6-4050-9cf1-cbaa6d58283e",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#managed-accounts-for-admins"
    },
    {
      "category": "同一性",
      "subcategory": "特権管理",
      "text": "定期的なアクセス レビューを構成して、不要なアクセス許可を時間の経過と共に取り消す",
      "guid": "eae64d01-0d3a-4ae1-a89d-cc1c2ad3888f",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#4-configure-recurring-access-reviews-to-revoke-unneeded-permissions-over-time"
    },
    {
      "category": "同一性",
      "subcategory": "特権管理",
      "text": "重大な影響を被る管理者が、セキュリティ保護と監視を強化したワークステーションを使用するようにする",
      "guid": "922ac19f-916d-4697-b8ea-ded26bdd186f",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#admin-workstation-security"
    },
    {
      "category": "同一性",
      "subcategory": "外部アイデンティティ",
      "text": "ID プロバイダー: 外部 ID プロバイダーが既知であることを確認する",
      "guid": "1e8c39ec-9466-4673-83c0-05674c1e945b",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/compare-with-b2c"
    },
    {
      "category": "同一性",
      "subcategory": "外部アイデンティティ",
      "text": "外部コラボレーション設定: ゲスト ユーザー アクセスが [ゲスト ユーザー アクセスが制限されています?] に設定されています。",
      "guid": "459c373e-7ed7-4162-9b37-5a917ecbe48f",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "同一性",
      "subcategory": "外部アイデンティティ",
      "text": "外部コラボレーション設定: ゲスト招待の設定が [特定の管理者ロールに割り当てられているユーザーのみ] に設定されています。",
      "guid": "be64dd7d-f2e8-4bbb-a468-155abc9164e9",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "同一性",
      "subcategory": "外部アイデンティティ",
      "text": "外部コラボレーション設定: [無効] に設定されたフロー経由のゲストセルフサービス サインアップを有効にする",
      "guid": "909aed8c-44cf-43b2-a381-8bafa2cf2149",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "同一性",
      "subcategory": "外部アイデンティティ",
      "text": "外部コラボレーション設定: コラボレーションの制限が [指定したドメインへの招待を許可する] に設定されています。",
      "guid": "d013a923-ce57-44dc-abd8-ac2aaebca2a4",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "同一性",
      "subcategory": "外部アイデンティティ",
      "text": "アクセスレビュー: すべてのグループで有効",
      "guid": "4da1dbf3-dd99-4248-8718-d1dca1f62565",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/active-directory/governance/deploy-access-reviews"
    },
    {
      "category": "同一性",
      "subcategory": "エンタープライズアプリケーション",
      "text": "同意とアクセス許可: 確認済みの発行元からのアプリのユーザーの同意を許可する",
      "guid": "9ee5580a-3824-49c9-9121-3dbd7fb012f7",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent"
    },
    {
      "category": "同一性",
      "subcategory": "エンタープライズアプリケーション",
      "text": "同意と権限: 選択したグループ所有者にグループ所有者の同意を許可する",
      "guid": "0943f630-4722-4ea3-ad2b-1ce632055b29",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent-groups"
    },
    {
      "category": "同一性",
      "subcategory": "カスタムドメイン",
      "text": "検証済みの顧客ドメインのみが登録されます。",
      "guid": "bade4aad-1e8c-439e-a946-667313c00567",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-configure-custom-domain"
    },
    {
      "category": "同一性",
      "subcategory": "パスワードのリセット",
      "text": "セルフサービスのパスワードリセットポリシー要件に準拠していることが確認されました。",
      "guid": "4c1e945b-459c-4373-b7ed-71623b375a91",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-sspr"
    },
    {
      "category": "同一性",
      "subcategory": "パスワードのリセット",
      "text": "ユーザーに認証情報の再確認を求めるまでの日数の設定がゼロに設定されていない",
      "guid": "7ecbe48f-be64-4dd7-bf2e-8bbbc468155a",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment"
    },
    {
      "category": "同一性",
      "subcategory": "パスワードのリセット",
      "text": "パスワードのリセットに必要なメソッドの設定数が選択されている",
      "guid": "bc9164e9-909a-4ed8-a44c-f3b2b3818baf",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment"
    },
    {
      "category": "同一性",
      "subcategory": "ユーザー設定",
      "text": "「ユーザーがアプリケーションを登録できる」を無効にする",
      "guid": "a2cf2149-d013-4a92-9ce5-74dccbd8ac2a",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/delegate-app-roles"
    },
    {
      "category": "同一性",
      "subcategory": "ユーザー設定",
      "text": "管理ポータル (portal.azure.com) へのアクセスを管理者のみに制限する",
      "guid": "aebca2a4-4da1-4dbf-9dd9-92481718d1dc",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/users-default-permissions"
    },
    {
      "category": "同一性",
      "subcategory": "ユーザー設定",
      "text": "「LinkedInアカウント接続」を無効にする",
      "guid": "a1f62565-9ee5-4580-a382-49c931213dbd",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/enterprise-users/linkedin-integration"
    },
    {
      "category": "同一性",
      "subcategory": "診断設定",
      "text": "有効にし、Sentinelでログ分析ワークスペースに送信する",
      "guid": "7fb012f7-0943-4f63-8472-2ea39d2b1ce6",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-monitoring"
    },
    {
      "category": "同一性",
      "subcategory": "PIM が有効",
      "text": "特権 ID 管理が有効",
      "guid": "21e44a19-a9dd-4399-afd7-b28dc8355562",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan"
    },
    {
      "category": "同一性",
      "subcategory": "PIM が有効",
      "text": "「ジャストインタイム」(JIT)アクセスを実装して、特権アカウントの公開時間をさらに短縮(常設アクセスの削減)",
      "guid": "46f4389a-7f42-4c78-b78c-06a63a21a495",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc"
    },
    {
      "category": "同一性",
      "subcategory": "条件付きアクセス ポリシー",
      "text": "条件付きアクセスポリシー/アクセス制御の構成",
      "guid": "6e6a8dc4-a20e-427b-9e29-711b1352beee",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common"
    },
    {
      "category": "同一性",
      "subcategory": "条件付きアクセス ポリシー",
      "text": "条件: 制限された場所",
      "guid": "079b588d-efc4-4972-ac3c-d21bf77036e5",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition"
    },
    {
      "category": "同一性",
      "subcategory": "条件付きアクセス ポリシー",
      "text": "アクセス制御: すべてのユーザーに対して MFA が有効",
      "guid": "e6b4bed3-d5f3-4547-a134-7dc56028a71f",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-azure-mfa"
    },
    {
      "category": "同一性",
      "subcategory": "条件付きアクセス ポリシー",
      "text": "アクセス制御: 管理者に MFA を要求する",
      "guid": "fe1bd15d-d2f0-4d5e-972d-41e3611cc57b",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa"
    },
    {
      "category": "同一性",
      "subcategory": "条件付きアクセス ポリシー",
      "text": "アクセス制御: Azure 管理に MFA を要求する",
      "guid": "4a4b1410-d439-4589-ac22-89b3d6b57cfc",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management"
    },
    {
      "category": "同一性",
      "subcategory": "条件付きアクセス ポリシー",
      "text": "アクセス制御: ブロック レガシー プロトコル",
      "guid": "645461e1-a3e3-4453-a3c8-639637a552d6",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy"
    },
    {
      "category": "同一性",
      "subcategory": "条件付きアクセス ポリシー",
      "text": "アクセス制御: デバイスを準拠としてマークする必要がある",
      "guid": "7ae9eab4-0fd3-4290-998b-c178bdc5a06c",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/require-managed-devices"
    },
    {
      "category": "同一性",
      "subcategory": "ゲスト ユーザー",
      "text": "ゲストユーザーアカウントを追跡するポリシー(つまり、使用状況/削除/無効化)はありますか?",
      "description": "お客様が文書化したポリシー",
      "guid": "a7144351-e19d-4d34-929e-b7228137a151",
      "severity": "中程度",
      "link": "https://devblogs.microsoft.com/premier-developer/azure-active-directory-automating-guest-user-management/"
    },
    {
      "category": "同一性",
      "subcategory": "アイデンティティセキュアスコア",
      "text": "業界のベストプラクティスに基づくIDセキュアスコアの実装",
      "guid": "c5bb4e4f-1814-4287-b5ca-8c26c9b32ab5",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/identity-secure-score"
    },
    {
      "category": "同一性",
      "subcategory": "ガラスのアカウントを破る",
      "text": "少なくとも 2 つの非常口アカウントが作成され、その使用に関するポリシーが存在します。",
      "guid": "bcfc6998-a135-4e33-9897-e31c67d68cb6",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "アクセス制御",
      "text": "Azure Policy を活用して VM アクセスを制御する",
      "guid": "0ac252b9-99a6-48af-a7c9-a8f821b8eb8c",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "アクセス制御",
      "text": "テンプレートを活用して VM のセットアップとデプロイのばらつきを軽減",
      "guid": "0aa77e26-e4d5-4aea-a8dc-4e2436bc336d",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "アクセス制御",
      "text": "ガバナンスを通じてリソースにアクセスできるユーザーを減らすことにより、VMS を展開するための特権アクセスをセキュリティで保護",
      "guid": "b5945bda-4333-44fd-b91c-234182b65275",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "高可用性",
      "text": "ワークロードに複数の VM を使用して可用性を向上させる",
      "guid": "269440b4-be3d-43e0-a432-76d4bdc015bc",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/architecture/checklist/resiliency-per-service"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "高可用性",
      "text": "災害復旧ソリューションの展開とテスト",
      "guid": "f219e4a1-eb58-4879-935d-227886d30b66",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-first-look-arm"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "高可用性",
      "text": "可用性セット",
      "guid": "c57be595-1900-4838-95c5-86cb291ec16a",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "高可用性",
      "text": "アベイラビリティーゾーン",
      "guid": "1d076ef9-f141-4acd-ae57-9377bcdb3751",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/availability-zones/az-overview?context=/azure/virtual-machines/context/context"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "高可用性",
      "text": "地域のフォールトトレランス",
      "guid": "ab2ac1fa-d66e-415d-9d5a-2adb2c3e2326",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/architecture/resiliency/recovery-loss-azure-region"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "マルウェアからの保護",
      "text": "マルウェア対策ソリューションのインストール",
      "guid": "af225ca4-4e16-496f-bdde-ace4cb1deb4c",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/antimalware"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "マルウェアからの保護",
      "text": "マルウェア対策ソリューションをセキュリティセンターと統合する",
      "guid": "650c3fc1-4eeb-4b36-a382-9e3eec218368",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "VM の更新の管理",
      "text": "Azure オートメーションによる更新管理を使用して VM を最新の状態に保つ",
      "guid": "7a0177a2-b594-45bd-a433-34fdf91c2341",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/automation/update-management/overview"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "VM の更新の管理",
      "text": "展開する Windows イメージに最新のレベルの更新プログラムが適用されていることを確認する",
      "guid": "c6fa96b9-6ad8-4840-af37-2734c876ba28",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/virtual-machines/automatic-vm-guest-patching"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "VM の更新の管理",
      "text": "Microsoft Defender for Cloud を使用して VM にセキュリティ更新プログラムを迅速に適用する",
      "guid": "02145901-465d-438e-9309-ccbd979266bc",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/security-center/asset-inventory"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "VHD を暗号化する",
      "text": "VM で暗号化を有効にする",
      "guid": "ca274faa-19bf-439d-a5d4-4c7c8919ca1f",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "VHD を暗号化する",
      "text": "暗号化のためのセキュリティ層を追加するためのキー暗号化キー (KEK) の追加",
      "guid": "6d5315ae-524b-4a34-b458-5e12139bd7bb",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/virtual-machines/windows/disk-encryption-key-vault#set-up-a-key-encryption-key-kek"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "VHD を暗号化する",
      "text": "ロールバックの目的で暗号化の前にディスクのスナップショットを作成する",
      "guid": "012f7b95-e06e-4154-b2aa-3592828e6e20",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "直接インターネット接続を制限する",
      "text": "中央ネットワーク グループのみがネットワーク リソースに対するアクセス許可を持っていることを確認する",
      "guid": "5173676a-e466-491e-a835-ad942223E138",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "直接インターネット接続を制限する",
      "text": "「ANY」ソースIPアデスからのアクセスを許可する公開されたVMを識別して修復する",
      "guid": "10523081-a941-4741-9833-ff7ad7c6d373",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "直接インターネット接続を制限する",
      "text": "ジャストインタイムアクセスを使用した管理ポート(RDP、SSH)の制限",
      "guid": "75a91be1-f388-4f03-a4d2-cd463cbbbc86",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-just-in-time"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "直接インターネット接続を制限する",
      "text": "インターネット アクセスを削除し、RDP 用のジャンプ サーバーを実装する",
      "guid": "8295abc9-1a4e-4da0-bae2-cc84c47b6b78",
      "severity": "高い",
      "link": "http://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "直接インターネット接続を制限する",
      "text": "インターネットからRDP / SSHを使用してサーバーへの直接ログインを削除し、VPNまたは高速ルートを実装する",
      "guid": "1cbafe6c-4658-49d4-98a9-27c3974d1102",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-forced-tunneling"
    },
    {
      "category": "VM セキュリティ チェック",
      "subcategory": "直接インターネット接続を制限する",
      "text": "Azure Bastion を RDP/SSH ブローカーとして活用して、セキュリティの強化とフットプリントの削減を実現",
      "guid": "dad6aae1-1e6b-484e-b5df-47d2d92881b1",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/bastion/bastion-overview"
    },
    {
      "category": "番兵",
      "subcategory": "建築",
      "text": "すべてのテナントで、少なくとも1つのLog AnalyticsワークスペースでSentinelが有効になっている",
      "guid": "cd5d1e54-a297-459e-9968-0e78289c9356",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard"
    },
    {
      "category": "番兵",
      "subcategory": "建築",
      "text": "お客様がSentinelアーキテクチャを理解している",
      "guid": "57d02bff-4564-4b0d-a34a-359836ee79d6",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/sentinel/best-practices-workspace-architecture"
    },
    {
      "category": "番兵",
      "subcategory": "建築",
      "text": "お客様は、複数のSentinelインスタンスにわたるインシデントを監視する方法を熟知しています。",
      "guid": "e8f5c586-c7d9-4cdc-86ac-c075ef9b141a",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/sentinel/multiple-workspace-view"
    },
    {
      "category": "番兵",
      "subcategory": "概要",
      "text": "24時間以上オープンするインシデントはありません",
      "guid": "8989579e-76b8-497e-910A-7Da7be9966E1",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/sentinel/manage-soc-with-incident-metrics"
    },
    {
      "category": "番兵",
      "subcategory": "ニュースとガイド",
      "text": "お客様には[ニュースとガイド]タブが表示されている。",
      "guid": "5d3c4ada-97cb-43d1-925a-b225c6f4e068",
      "severity": "低い",
      "link": "https://learn.microsoft.com/azure/sentinel/whats-new"
    },
    {
      "category": "番兵",
      "subcategory": "UEBA",
      "text": "UEBA Configured (Sentinel/Settings/Settings/Configure UEBA)",
      "guid": "5edddea8-a4b7-4cde-a4c6-1fc3fc14eea6",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics"
    },
    {
      "category": "番兵",
      "subcategory": "データコネクタ",
      "text": "Azure Active Directory in configured and 'Last Received Log Received' が今日表示される",
      "guid": "e69d8d9a-3eec-4218-b687-ab077adb49e5",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory"
    },
    {
      "category": "番兵",
      "subcategory": "データコネクタ",
      "text": "Azure Active Directory ID Protection が構成され、\"最後に受信したログ\" が今日表示されます。",
      "guid": "b9603334-fdf8-4cc2-9318-db61171269f4",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-active-directory-identity-protection"
    },
    {
      "category": "番兵",
      "subcategory": "データコネクタ",
      "text": "Azure アクティビティが構成され、\"前回受信したログ\" が今日表示されます",
      "guid": "0b4aa3d3-e070-4327-9d4b-98b15b8a219a",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity"
    },
    {
      "category": "番兵",
      "subcategory": "データコネクタ",
      "text": "Microsoft Defender for Cloud が構成され、「最後に受信したログ」が本日表示される",
      "guid": "8e13f9cc-bd46-4826-9abc-a264f9a19bfe",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud"
    },
    {
      "category": "番兵",
      "subcategory": "データコネクタ",
      "text": "Azure ファイアウォールが構成され、\"最後に受信したログ\" が今日表示されます。",
      "guid": "9d55d04c-3c49-419c-a1b2-d1215ae114b9",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall"
    },
    {
      "category": "番兵",
      "subcategory": "データコネクタ",
      "text": "Windows ファイアウォールが構成され、[最後に受信したログ] が今日表示されます。",
      "guid": "34df585e-cccd-49bd-9ba0-cdb3b54eb2eb",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-firewall"
    },
    {
      "category": "番兵",
      "subcategory": "データコネクタ",
      "text": "セキュリティ イベントは AMA で構成されており、\"最後に受信したログ\" は今日表示されます。",
      "guid": "03ddaa25-9271-48d2-bdb1-0725769ef669",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama"
    },
    {
      "category": "番兵",
      "subcategory": "データコネクタ",
      "text": "セキュリティ イベント - Azure コンピューターが接続され、ワークスペースにデータが送信されていることを確認します。",
      "guid": "1a4834ac-9322-423e-ae80-b123081a5417",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference"
    },
    {
      "category": "番兵",
      "subcategory": "データコネクタ",
      "text": "セキュリティ イベント - Azure 以外のコンピューターが接続され、ワークスペースにデータが送信されていることを確認します。",
      "guid": "859c773e-7e26-4162-9b77-5a917e1f348e",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference"
    },
    {
      "category": "番兵",
      "subcategory": "データコネクタ",
      "text": "AWS のコネクタ",
      "guid": "f354c27d-42e8-4bba-a868-155abb9163e9",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/sentinel/connect-aws?tabs=s3"
    },
    {
      "category": "番兵",
      "subcategory": "データコネクタ",
      "text": "GCP用コネクタ",
      "guid": "909ae28c-84c3-43b6-a780-8bafe6c42149",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference"
    },
    {
      "category": "番兵",
      "subcategory": "分析ルール",
      "text": "お客様がアナリティクスルールを有効にし、インシデントを設定しました",
      "guid": "d413a923-c357-44d1-8028-ac6aae01e6a8",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/sentinel/detect-threats-built-in"
    },
    {
      "category": "番兵",
      "subcategory": "設定",
      "text": "お客様は日次上限を有効にしていません",
      "guid": "4de5df43-d299-4248-8718-d5d1e5f62565",
      "severity": "中程度",
      "link": "https://azure.microsoft.com/updates/controlling-data-volume-and-retention-in-log-analytics-2/"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "構成",
      "text": "Azure Firewall Premium がデプロイされました",
      "guid": "9e3558fd-7724-49c9-9111-2d027fe412f7",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/firewall/premium-features"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "構成",
      "text": "Azure ファイアウォール経由で有効なクワッド ゼロ/強制チューニング",
      "guid": "4dc74a74-8b66-433a-b2a0-916a764980ad",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal#create-a-default-route"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "アクセス制御",
      "text": "許可されたユーザーのみを使用可能にするように設定された RBAC",
      "guid": "0e278ee2-93c1-4bc3-92ba-aab7571849ab",
      "severity": "中程度",
      "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "診断設定",
      "text": "診断が有効になり、メトリックが Log Analytics ワークスペースに送信される",
      "guid": "8093dc9f-c9d1-4bb7-9b36-a5a67fbb9ed5",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "ファイアウォールマネージャ",
      "text": "ハブと仮想ネットワークは、ファイアウォールプレミアムを介して保護または接続されています",
      "guid": "b35478c3-4798-416b-8863-cffe1cac599e",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "ファイアウォールマネージャ",
      "text": "ポリシー: アクセス制御が構成されている (RBAC)",
      "guid": "f0d5a73d-d4de-436c-8c81-770afbc4c0e4",
      "severity": "高い",
      "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "ファイアウォールマネージャ",
      "text": "ポリシー: 親ポリシーが構成されている",
      "guid": "5c3a87af-4a79-41f8-a39b-da47768e14c1",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "ファイアウォールマネージャ",
      "text": "ポリシー: ルール コレクションが定義されている",
      "guid": "15675c1e-a55b-446a-a48f-f8ae7d7e4b47",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "ファイアウォールマネージャ",
      "text": "ポリシー: DNAT ポリシーが定義されている",
      "guid": "5b6c8bcb-f59b-4ce6-9de8-a03f97879468",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "ファイアウォールマネージャ",
      "text": "ポリシー: ネットワークルールが定義されている",
      "guid": "d66a786d-60e9-46c9-9ad8-855d04c2b39c",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "ファイアウォールマネージャ",
      "text": "ポリシー: アプリケーション ルールが定義されている",
      "guid": "986bb2c1-2149-4a11-9b5e-3df574ecccd9",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/firewall/features"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "ファイアウォールマネージャ",
      "text": "DNS:機能が理解され、適用されているか、または適用されていないか",
      "guid": "793a6bcd-a3b5-40eb-8eb0-3dd95d58d7c8",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/firewall/dns-details"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "ファイアウォールマネージャ",
      "text": "脅威インテリジェンス: アラートと拒否に設定",
      "guid": "d622f54b-29ba-4de3-aad1-e8c28ec93666",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "ファイアウォールマネージャ",
      "text": "脅威インテリジェンス:許可リスト(使用されているかどうかを正当化する - つまりパフォーマンス)",
      "guid": "7313b005-674b-41e9-94a4-59c373e7ed61",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings#allowlist-addresses"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "ファイアウォールマネージャ",
      "text": "TLS が有効",
      "guid": "623b365a-917e-4cbe-98eb-d54cd7df2e8b",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/firewall/premium-certificates"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "ファイアウォールマネージャ",
      "text": "IDPS が有効",
      "guid": "bac35715-59ab-4915-9e99-08aed8c44ce3",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "ファイアウォールマネージャ",
      "text": "SNAT: 設定済み",
      "guid": "b2b3808b-9fa1-4cf1-849d-003a923ce474",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/firewall/snat-private-range"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "DDOS保護",
      "text": "ファイアウォールのパブリックIPに対して有効",
      "guid": "dbcbd8ac-2aae-4bca-8a43-da1dae2cc992",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices"
    }
  ],
  "severities": [
    {
      "name": "高い"
    },
    {
      "name": "中程度"
    },
    {
      "name": "低い"
    }
  ],
  "status": [
    {
      "name": "未検証",
      "description": "このチェックはまだ見ていません"
    },
    {
      "name": "開ける",
      "description": "このチェックに関連付けられているアクションアイテムがあります"
    },
    {
      "name": "達成",
      "description": "このチェックは検証済みであり、それに関連付けられたアクションアイテムはこれ以上ありません。"
    },
    {
      "name": "必須ではありません",
      "description": "推奨事項は理解しているが、現在の要件では必要ではない"
    },
    {
      "name": "該当なし",
      "description": "現在の設計には適用されません"
    }
  ],
  "categories": [
    {
      "name": "クラウド用ディフェンダー"
    },
    {
      "name": "Azure Networking"
    },
    {
      "name": "同一性"
    },
    {
      "name": "VM セキュリティ チェック"
    },
    {
      "name": "番兵"
    },
    {
      "name": "Azure Firewall"
    }
  ]
}

checklists/security_checklist.es.json METASEP
{
  "metadata": {
    "name": "Lista de comprobación de revisión de seguridad de Azure"
  },
  "items": [
    {
      "category": "Defender para la nube",
      "subcategory": "Precios y configuración",
      "text": "Habilitación de Security Center/Defender en todas las suscripciones",
      "guid": "54174158-33fb-43ae-9c2d-e743165c3acb",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Precios y configuración",
      "text": "Security Center/Defender habilitado en todos los espacios de trabajo de Log Analytics",
      "guid": "349f0364-d28d-442e-abbb-c868255abc91",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Precios y configuración",
      "text": "Conjunto de recopilación de datos en 'Común'",
      "guid": "64e9a19a-e28c-484c-93b6-b7818ca0e6c4",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-data-collection?tabs=autoprovision-feature#what-event-types-are-stored-for-common-and-minimal"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Precios y configuración",
      "text": "Las funciones de seguridad mejoradas de Defender for Cloud están habilitadas",
      "guid": "2149d414-a923-4c35-94d1-1029bd6aaf11",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Precios y configuración",
      "text": "Aprovisionamiento automático habilitado según la directiva de la empresa (la directiva debe existir)",
      "guid": "e6b84ee5-ef43-4d29-a248-1718d5d1f5f7",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-enable-data-collection"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Precios y configuración",
      "text": "Notificaciones por correo electrónico habilitadas según la directiva de la empresa (la directiva debe existir)",
      "guid": "25759e35-680e-4782-9ac9-32213d027ff4",
      "severity": "Bajo",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-provide-security-contact-details"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Precios y configuración",
      "text": "Se seleccionan las opciones Habilitar integraciones ",
      "guid": "12f70993-0631-4583-9ee7-9d6c6d363206",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-wdatp?WT.mc_id=Portal-Microsoft_Azure_Security_CloudNativeCompute&tabs=windows"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Precios y configuración",
      "text": "La integración de CI/CD está configurada",
      "guid": "5b7bae4-4º-45e8-a79e-2e86667313c5",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/security-center/defender-for-container-registries-cicd"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Precios y configuración",
      "text": "La exportación continua 'Event Hub' está habilitada si se utiliza SIEM de 3ª parte",
      "guid": "05675c5e-985b-4859-a774-f7e371623b87",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Precios y configuración",
      "text": "La exportación continua 'Log Analytics Workspace' está habilitada si no se usa Azure Sentinel",
      "guid": "5a917e1f-349f-4036-9d28-d42e8bbbc868",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Precios y configuración",
      "text": "Conector en la nube habilitado para AWS",
      "guid": "255abc91-64e9-4a19-ae28-c84c43b6b781",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-aws?WT.mc_id=Portal-Microsoft_Azure_Security"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Precios y configuración",
      "text": "Conector en la nube habilitado para GCP",
      "guid": "8ca0e6c4-2149-4d41-9a92-3c3574d11029",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-gcp"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Precios y configuración",
      "text": "Si usa el proxy de aplicación de Azure AD, considere la posibilidad de integrarse con Microsoft Defender for Cloud Apps para supervisar el acceso a las aplicaciones en tiempo real y aplicar controles de seguridad avanzados.",
      "guid": "cce9bdf6-b483-45a0-85ec-c8232b230652",
      "severity": "Bajo",
      "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-integrate-with-microsoft-cloud-application-security"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Recomendaciones",
      "text": "Todas las recomendaciones remediadas o deshabilitadas si no es necesario.",
      "guid": "df9cc234-18db-4611-9126-5f4bb47a393a",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/security-center/secure-score-security-controls"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Recomendaciones",
      "text": "Puntuación de seguridad>70%",
      "description": "El objetivo mínimo de Microsoft para todos los clientes es del 70 %",
      "guid": "08032729-4798-4b15-98a2-19a46ceb5443",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Alertas de seguridad",
      "text": "Las alertas de seguridad contienen solo las generadas en las últimas 24 horas (corregir o deshabilitar las alertas de seguridad más antiguas)",
      "guid": "50259226-4429-42bb-9285-37a55119bf8e",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/tutorial-security-incident"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Libros",
      "text": "Si la exportación continua está habilitada, los libros predeterminados se publican en el panel de seguridad personalizado",
      "guid": "8f585428-7d9c-4dc1-96cd-072af9b141a8",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/security-center/custom-dashboards-azure-workbooks"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Comunidad",
      "text": "El cliente es consciente del valor de la página 'Comunidad' y tiene una cadencia regular configurada para revisar",
      "guid": "98a535e7-3789-47e7-8ca7-da7be9962a15",
      "severity": "Medio",
      "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Puntuación segura",
      "text": "Se muestran todas las suscripciones protegidas por Security Center (sin filtro de suscripción establecido)",
      "description": "Mejores prácticas operativas del cliente - Transparencia",
      "guid": "93846da9-7cc3-4923-856b-22586f4a1641",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Cumplimiento normativo",
      "text": "Los controles de cumplimiento son ecológicos para cualquier requisito de cumplimiento requerido",
      "guid": "bdddea8a-487c-4deb-9861-bc3bc14aea6e",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-compliance-dashboard"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Azure Defender",
      "text": "Las vulnerabilidades de VM de alta gravedad son cero (vacías)",
      "description": "Mejores prácticas operativas del cliente: verificar",
      "guid": "65e8d9a3-aec2-418e-9436-b0736db55f57",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/remediate-vulnerability-findings-vm"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Administrador de cortafuegos",
      "text": "Los concentradores están protegidos por un Firewall de Azure",
      "guid": "9603334b-df9c-4c23-918d-b61171265f4b",
      "severity": "Medio",
      "link": "https://techcommunity.microsoft.com/t5/azure-network-security/azure-firewall-manager-is-now-integrated-with-azure-security/ba-p/2228679"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Administrador de cortafuegos",
      "text": "Las redes virtuales están protegidas por un firewall",
      "description": "Mejores prácticas operativas del cliente: verificar",
      "guid": "b47a393a-0803-4272-a479-8b1578a219a4",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/network-best-practices"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Administrador de cortafuegos",
      "text": "DDoS Standard habilitado",
      "guid": "6ceb5443-5025-4922-9442-92bb628537a5",
      "severity": "Medio",
      "link": "https://azure.microsoft.com/blog/how-azure-security-center-detects-ddos-attack-using-cyber-threat-intelligence/"
    },
    {
      "category": "Defender para la nube",
      "subcategory": "Cobertura",
      "text": "Verifique que todas las suscripciones estén cubiertas (consulte los precios y la configuración para modificar)",
      "guid": "5119bf8e-8f58-4542-a7d9-cdc166cd072a",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started?WT.mc_id=Portal-Microsoft_Azure_Security"
    },
    {
      "category": "Azure Networking",
      "subcategory": "IP públicas",
      "text": "Las máquinas virtuales con IP públicas deben estar protegidas por NSG ",
      "guid": "4df585ec-dce9-4793-a7bc-db3b51eb2eb0",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses"
    },
    {
      "category": "Azure Networking",
      "subcategory": "IP públicas",
      "text": "Las máquinas virtuales con direcciones IP públicas se mueven detrás de Azure Firewall Premium",
      "description": "Mejores prácticas operativas del cliente: verificar",
      "guid": "3dda6e59-d7c8-4a2e-bb11-7d6769af669c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses"
    },
    {
      "category": "Azure Networking",
      "subcategory": "IP públicas",
      "text": "Las máquinas virtuales que no necesitan DIRECCIONES IP públicas no tienen IP públicas (es decir, solo RDP interno)",
      "description": "Mejores prácticas operativas del cliente: verificar",
      "guid": "a48e5a85-f222-43ec-b8bb-12308ca5017f",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access"
    },
    {
      "category": "Azure Networking",
      "subcategory": "NSG",
      "text": "NSG RBAC se utiliza para restringir el acceso al equipo de seguridad de red",
      "guid": "158e3ea3-a93c-42de-9e31-65c3a87a04b7",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "NSG",
      "text": "Las reglas de seguridad de entrada de NSG no contienen un * (comodín) en el campo Origen",
      "description": "Mejores prácticas operativas del cliente: verificar",
      "guid": "a209939b-da47-4778-b24c-116785c2fa55",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "NSG",
      "text": "Las reglas de seguridad salientes de NSG se utilizan para controlar el tráfico a direcciones IP específicas para el tráfico no enrutado a través de un firewall",
      "description": "Mejores prácticas operativas del cliente: verificar",
      "guid": "b56a9480-08be-47d7-b4c4-76b6d8bdcf59",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "NSG",
      "text": "NSG no tiene Source como * (comodín) en su lugar.",
      "description": "Mejores prácticas operativas del cliente: verificar",
      "guid": "bce65de8-a13f-4988-9946-8d66a786d60f",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "NSG",
      "text": "Los diagnósticos de NSG envían el tráfico NetworkSecurityGroupEvent y NetworkSecurityGroupRuleCounter a Sentinel LAW",
      "guid": "a6c97be9-955d-404c-9c49-c986cb2d1215",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-nsg-manage-log"
    },
    {
      "category": "Azure Networking",
      "subcategory": "UDR",
      "text": "UDR RBAC se utiliza para restringir el acceso al equipo de seguridad de red",
      "guid": "aa124b6e-4df5-485e-adce-9793b7bcdb3b",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "UDR",
      "text": "Si Zero Trust, los UDR se usan para enviar todo el tráfico a Azure Firewall Premium",
      "guid": "51eb2eb0-3dda-46e5-ad7c-8a2edb117d67",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "UDR",
      "text": "Los UDR que no envían todo el tráfico a AzureFirewallPremium son conocidos y documentados.",
      "description": "Mejores prácticas operativas del cliente: verificar",
      "guid": "69af669c-a48e-45a8-9f22-23ece8bb1230",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Redes virtuales",
      "text": "El cliente está familiarizado con los valores predeterminados de red de Azure / enrutamiento predeterminado de SDN en Azure",
      "guid": "8ca5017f-158e-43ea-9a93-c2de7e3165c3",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview#default"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Redes virtuales",
      "text": "RBAC de red virtual se usa para restringir el acceso al equipo de seguridad de red",
      "description": "Mejores prácticas operativas del cliente: verificar",
      "guid": "a87a04b7-a209-4939-ada4-7778f24c1167",
      "severity": "Medio",
      "link": "https://github.com/MicrosoftDocs/azure-docs/issues/53672"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Redes virtuales",
      "text": "Las recomendaciones de seguridad de la red virtual se han corregido y no hay redes virtuales \"en riesgo\" ",
      "guid": "85c2fa55-b56a-4948-808b-e7d7e4c476b6",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/policy-reference"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Redes virtuales",
      "text": "Se comprenden las conexiones de emparejamiento de red virtual y se documentan los flujos de tráfico esperados",
      "guid": "d8bdcf59-bce6-45de-aa13-f98879468d66",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Redes virtuales",
      "text": "Los extremos de servicio de red virtual están en uso, no existen extremos de servicio público heredados",
      "guid": "a786d60f-a6c9-47be-a955-d04c3c49c986",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Redes virtuales",
      "text": "Los puntos de conexión privados de red virtual están en uso para permitir el acceso desde entornos locales, no existen puntos de enlace públicos heredados",
      "guid": "1f625659-ee55-480a-9824-9c931213dbd7",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Redes virtuales",
      "text": "Supervisión de red virtual habilitada",
      "guid": "fb012f70-943f-4630-9722-ea39d2b1ce63",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Redes virtuales",
      "text": "Proteger el tráfico entre pods mediante directivas de red en Azure Kubernetes Service (AKS)",
      "guid": "2055b29b-ade4-4th-8e8c-39ec94666731",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/kubernetes-network-policies"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Redes virtuales",
      "text": "El cliente de VNet NVA (dispositivos) sigue el patrón de arquitectura publicado",
      "guid": "3c005674-c1e9-445b-959c-373e7ed71623",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-scenario-udr-gw-nva"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Redes virtuales",
      "text": "La configuración de diagnóstico de red virtual está habilitada y envía VMProtectionAlerts a Azure Sentinel LAW",
      "guid": "b375a917-ecbe-448f-ae64-dd7df2e8bbbc",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Conectividad",
      "text": "Usar ExpressRoute o VPN para acceder a los recursos de Azure desde entornos locales",
      "guid": "468155ab-c916-44e9-a09a-ed8c44cf3b2b",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Virtual WAN",
      "text": "VWAN RBAC se utiliza para restringir el acceso al equipo de seguridad de red",
      "guid": "bd8ac2aa-ebca-42a4-9da1-dbf3dd992481",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Virtual WAN",
      "text": "El cliente de VWAN está utilizando Secure Hub o Firewall externo para enrutar y monitorear el tráfico.",
      "guid": "718d1dca-1f62-4565-aee5-580a38249c93",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-global-transit-network-architecture"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Puerta de enlace de aplicaciones",
      "text": "AppGW RBAC se utiliza para restringir el acceso al equipo de seguridad de red",
      "guid": "1213dbd7-fb01-42f7-8943-f6304722ea39",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/web-application-firewall/overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Puerta de enlace de aplicaciones",
      "text": "AppGW Todos los servicios web externos están conectados a Application Gateways con WAF habilitado ",
      "guid": "d2b1ce63-2055-4b29-aade-4aad1e8c39ec",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Puerta de enlace de aplicaciones",
      "text": "AppGW Todos los servicios web internos están integrados en Application Gateways con WAF habilitado ",
      "guid": "94666731-3c00-4567-9c1e-945b459c373e",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Puerta de enlace de aplicaciones",
      "text": "AppGW - La cara externa tiene TLS / SSL habilitado y redirige todo el tráfico a 443 (sin tráfico del puerto 80)",
      "guid": "7ed71623-b375-4a91-9ecb-e48fbe64dd7d",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Puerta frontal",
      "text": "Front Door RBAC se utiliza para restringir el acceso al equipo de seguridad de red",
      "guid": "f2e8bbbc-4681-455a-ac91-64e9909aed8c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/frontdoor/"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Puerta frontal",
      "text": "Front Door está asociado a una política WAF",
      "guid": "44cf3b2b-3818-4baf-a2cf-2149d013a923",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/front-door-security-baseline?toc=/azure/frontdoor/TOC.json"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Puerta frontal",
      "text": "La directiva TLS/SSL de puerta principal está configurada",
      "guid": "ce574dcc-bd8a-4c2a-aebc-a2a44da1dbf3",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain-https"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Puerta frontal",
      "text": "El puerto de redirección de la puerta principal 80 al puerto 443 está configurado (oyentes)",
      "guid": "dd992481-718d-41dc-a1f6-25659ee5580a",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/frontdoor/front-door-url-redirect"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Puerta frontal",
      "text": "Los registros de diagnóstico de Front Door envían ApplicationGatewayAccessLog &ApplicationGateway FirewallLog a Sentinel LAW",
      "guid": "38249c93-1213-4dbd-9fb0-12f70943f630",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/frontdoor/front-door-diagnostics"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Protección DDOS",
      "text": "Habilitado para IP públicas de Firewall (todas las IP públicas)",
      "guid": "4722ea39-d2b1-4ce6-9205-5b29bade4aad",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices"
    },
    {
      "category": "Identidad",
      "subcategory": "Arrendatario",
      "text": "Establezca un directorio empresarial único para administrar las identidades de los empleados a tiempo completo y los recursos empresariales.",
      "guid": "346ad56f-bdb8-44db-8bcd-0a689af63f1e",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/security/compass/identity#a-single-enterprise-directory"
    },
    {
      "category": "Identidad",
      "subcategory": "Arrendatario",
      "text": "Sincronice su identidad en la nube con sus sistemas de identidad existentes.",
      "guid": "a46108cd-6a76-4749-ae69-b7bf61410010",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/security/compass/identity#synchronized-identity-systems"
    },
    {
      "category": "Identidad",
      "subcategory": "Arrendatario",
      "text": "Use los servicios de identidad en la nube para hospedar cuentas que no sean de empleados, como proveedores, socios y clientes, en lugar de incluirlos en su directorio local.",
      "guid": "a1ab96ceb-c149-4ce2-bcad-3bd375ebfc7f",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/security/compass/identity#cloud-provider-identity-source-for-third-parties"
    },
    {
      "category": "Identidad",
      "subcategory": "Arrendatario",
      "text": "Deshabilite los protocolos heredados inseguros para los servicios orientados a Internet.",
      "guid": "343473ec-ed5c-49e1-98f4-cb09524a23cd",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/security/compass/identity#block-legacy-authentication"
    },
    {
      "category": "Identidad",
      "subcategory": "Arrendatario",
      "text": "Habilitar el inicio de sesión único",
      "guid": "70dceb23-50c7-4d8d-bf53-8cc104c7dc44",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/identity-management-best-practices#enable-single-sign-on"
    },
    {
      "category": "Identidad",
      "subcategory": "Administración privilegiada",
      "text": "No sincronice cuentas con el acceso con privilegios más altos a los recursos locales mientras sincroniza sus sistemas de identidad empresarial con directorios en la nube.",
      "guid": "87791be1-1eb0-48ed-8003-ad9bcf241b99",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/security/compass/identity#no-on-premises-admin-accounts-in-cloud-identity-providers"
    },
    {
      "category": "Identidad",
      "subcategory": "Administración privilegiada",
      "text": "Limitar el número de administradores globales a menos de 5",
      "guid": "9e6efe9d-f28f-463b-9bff-b5080173e9fe",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5"
    },
    {
      "category": "Identidad",
      "subcategory": "Administración privilegiada",
      "text": "Usar grupos para asignaciones de roles de Azure AD y delegar la asignación de roles",
      "guid": "e0d968d3-87f6-41fb-a4f9-d852f1673f4c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#6-use-groups-for-azure-ad-role-assignments-and-delegate-the-role-assignment"
    },
    {
      "category": "Identidad",
      "subcategory": "Administración privilegiada",
      "text": "Asegúrese de que todos los administradores de impacto crítico sean administrados por el directorio empresarial para seguir la aplicación de las políticas de la organización.",
      "guid": "00350863-4df6-4050-9cf1-cbaa6d58283e",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#managed-accounts-for-admins"
    },
    {
      "category": "Identidad",
      "subcategory": "Administración privilegiada",
      "text": "Configurar revisiones de acceso recurrentes para revocar permisos innecesarios a lo largo del tiempo",
      "guid": "eae64d01-0d3a-4ae1-a89d-cc1c2ad3888f",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#4-configure-recurring-access-reviews-to-revoke-unneeded-permissions-over-time"
    },
    {
      "category": "Identidad",
      "subcategory": "Administración privilegiada",
      "text": "Garantice que los administradores de impacto crítico utilicen una estación de trabajo con protecciones de seguridad y supervisión elevadas",
      "guid": "922ac19f-916d-4697-b8ea-ded26bdd186f",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#admin-workstation-security"
    },
    {
      "category": "Identidad",
      "subcategory": "Identidades externas",
      "text": "Proveedores de identidad: verifique que los proveedores de identidad externos sean conocidos",
      "guid": "1e8c39ec-9466-4673-83c0-05674c1e945b",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/compare-with-b2c"
    },
    {
      "category": "Identidad",
      "subcategory": "Identidades externas",
      "text": "Configuración de colaboración externa: ¿El acceso de usuario invitado se establece en '¿El acceso de usuario invitado está restringido?'",
      "guid": "459c373e-7ed7-4162-9b37-5a917ecbe48f",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "Identidad",
      "subcategory": "Identidades externas",
      "text": "Configuración de colaboración externa: la configuración de invitación de invitado se establece en 'Solo usuarios asignados a roles de administrador específicos'",
      "guid": "be64dd7d-f2e8-4bbb-a468-155abc9164e9",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "Identidad",
      "subcategory": "Identidades externas",
      "text": "Configuración de colaboración externa: habilite el registro de autoservicio de invitados a través de flujos establecidos en 'Deshabilitado' ",
      "guid": "909aed8c-44cf-43b2-a381-8bafa2cf2149",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "Identidad",
      "subcategory": "Identidades externas",
      "text": "Configuración de colaboración externa: restricciones de colaboración establecidas en 'Permitir invitaciones a los dominios especificados'",
      "guid": "d013a923-ce57-44dc-abd8-ac2aaebca2a4",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "Identidad",
      "subcategory": "Identidades externas",
      "text": "Revisiones de acceso: habilitado para todos los grupos",
      "guid": "4da1dbf3-dd99-4248-8718-d1dca1f62565",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/active-directory/governance/deploy-access-reviews"
    },
    {
      "category": "Identidad",
      "subcategory": "Aplicaciones empresariales",
      "text": "Consentimiento y permisos: permitir el consentimiento del usuario para aplicaciones de editores verificados",
      "guid": "9ee5580a-3824-49c9-9121-3dbd7fb012f7",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent"
    },
    {
      "category": "Identidad",
      "subcategory": "Aplicaciones empresariales",
      "text": "Consentimiento y permisos: Permitir el consentimiento del propietario del grupo para los propietarios de grupos seleccionados ",
      "guid": "0943f630-4722-4ea3-ad2b-1ce632055b29",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent-groups"
    },
    {
      "category": "Identidad",
      "subcategory": "Dominios personalizados",
      "text": "Solo se registran los dominios de clientes validados",
      "guid": "bade4aad-1e8c-439e-a946-667313c00567",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-configure-custom-domain"
    },
    {
      "category": "Identidad",
      "subcategory": "Restablecimiento de contraseña",
      "text": "Requisito de directiva de restablecimiento de contraseña de autoservicio verificado conforme.",
      "guid": "4c1e945b-459c-4373-b7ed-71623b375a91",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-sspr"
    },
    {
      "category": "Identidad",
      "subcategory": "Restablecimiento de contraseña",
      "text": "Establecer el número de días antes de que se pida a los usuarios que vuelvan a confirmar que la información de autenticación no se establece en cero",
      "guid": "7ecbe48f-be64-4dd7-bf2e-8bbbc468155a",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment"
    },
    {
      "category": "Identidad",
      "subcategory": "Restablecimiento de contraseña",
      "text": "Se selecciona el número establecido de métodos necesarios para restablecer la contraseña",
      "guid": "bc9164e9-909a-4ed8-a44c-f3b2b3818baf",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment"
    },
    {
      "category": "Identidad",
      "subcategory": "Configuración de usuario",
      "text": "Deshabilitar 'Los usuarios pueden registrar aplicaciones'",
      "guid": "a2cf2149-d013-4a92-9ce5-74dccbd8ac2a",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/delegate-app-roles"
    },
    {
      "category": "Identidad",
      "subcategory": "Configuración de usuario",
      "text": "Restringir el acceso al portal administrativo (portal.azure.com) solo a los administradores",
      "guid": "aebca2a4-4da1-4dbf-9dd9-92481718d1dc",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/users-default-permissions"
    },
    {
      "category": "Identidad",
      "subcategory": "Configuración de usuario",
      "text": "Deshabilite la 'conexión de la cuenta de LinkedIn'",
      "guid": "a1f62565-9ee5-4580-a382-49c931213dbd",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/enterprise-users/linkedin-integration"
    },
    {
      "category": "Identidad",
      "subcategory": "Configuración de diagnóstico",
      "text": "Habilitado y enviar al área de trabajo de Log Analytics con Sentinel",
      "guid": "7fb012f7-0943-4f63-8472-2ea39d2b1ce6",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-monitoring"
    },
    {
      "category": "Identidad",
      "subcategory": "PIM habilitado",
      "text": "Administración de identidades privilegiada habilitada",
      "guid": "21e44a19-a9dd-4399-afd7-b28dc8355562",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan"
    },
    {
      "category": "Identidad",
      "subcategory": "PIM habilitado",
      "text": "Implementar el acceso \"justo a tiempo\" (JIT) para reducir aún más el tiempo de exposición de las cuentas privilegiadas (reducir el acceso permanente)",
      "guid": "46f4389a-7f42-4c78-b78c-06a63a21a495",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc"
    },
    {
      "category": "Identidad",
      "subcategory": "Directivas de acceso condicional",
      "text": "Configurar directivas de acceso condicional / Controles de acceso",
      "guid": "6e6a8dc4-a20e-427b-9e29-711b1352estado",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common"
    },
    {
      "category": "Identidad",
      "subcategory": "Directivas de acceso condicional",
      "text": "Condiciones: Ubicaciones restringidas",
      "guid": "079b588d-efc4-4972-ac3c-d21bf77036e5",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition"
    },
    {
      "category": "Identidad",
      "subcategory": "Directivas de acceso condicional",
      "text": "Controles de acceso: MFA habilitado para todos los usuarios",
      "guid": "e6b4bed3-d5f3-4547-a134-7dc56028a71f",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-azure-mfa"
    },
    {
      "category": "Identidad",
      "subcategory": "Directivas de acceso condicional",
      "text": "Controles de acceso: Requerir MFA para administradores",
      "guid": "fe1bd15d-d2f0-4d5e-972d-41e3611cc57b",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa"
    },
    {
      "category": "Identidad",
      "subcategory": "Directivas de acceso condicional",
      "text": "Controles de acceso: requerir MFA para Azure Management ",
      "guid": "4a4b1410-d439-4589-ac22-89b3d6b57cfc",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management"
    },
    {
      "category": "Identidad",
      "subcategory": "Directivas de acceso condicional",
      "text": "Controles de acceso: Bloquear protocolos heredados",
      "guid": "645461e1-a3e3-4453-a3c8-639637a552d6",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy"
    },
    {
      "category": "Identidad",
      "subcategory": "Directivas de acceso condicional",
      "text": "Controles de acceso: requieren que los dispositivos estén marcados como compatibles",
      "guid": "7ae9eab4-0fd3-4290-998b-c178bdc5a06c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/require-managed-devices"
    },
    {
      "category": "Identidad",
      "subcategory": "Usuarios invitados",
      "text": "¿Existe una política para rastrear las cuentas de usuario invitado (es decir, usar/eliminar/deshabilitar)?",
      "description": "Política documentada del cliente",
      "guid": "a7144351-e19d-4d34-929e-b7228137a151",
      "severity": "Medio",
      "link": "https://devblogs.microsoft.com/premier-developer/azure-active-directory-automating-guest-user-management/"
    },
    {
      "category": "Identidad",
      "subcategory": "Puntuación segura de identidad",
      "text": "Implemente Identity Secure Score basado en las mejores prácticas de su sector",
      "guid": "c5bb4e4f-1814-4287-b5ca-8c26c9b32ab5",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/identity-secure-score"
    },
    {
      "category": "Identidad",
      "subcategory": "Cuentas de Break Glass",
      "text": "Se han creado al menos dos cuentas de break glass y existe una política en torno a su uso.",
      "guid": "bcfc6998-a135-4e33-9897-e31c67d68cb6",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Control de acceso",
      "text": "Control del acceso a máquinas virtuales mediante la directiva de Azure",
      "guid": "0ac252b9-99a6-48af-a7c9-a8f821b8eb8c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Control de acceso",
      "text": "Reduzca la variabilidad en la configuración e implementación de máquinas virtuales aprovechando las plantillas",
      "guid": "0aa77e26-e4d5-4aea-a8dc-4e2436bc336d",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Control de acceso",
      "text": "Acceso privilegiado seguro para implementar VMS al reducir quién tiene acceso a los recursos a través de la gobernanza",
      "guid": "b5945bda-4333-44fd-b91c-234182b65275",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Alta disponibilidad ",
      "text": "Use varias máquinas virtuales para sus cargas de trabajo para una mejor disponibilidad ",
      "guid": "269440b4-be3d-43e0-a432-76d4bdc015bc",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/architecture/checklist/resiliency-per-service"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Alta disponibilidad ",
      "text": "Implementar y probar una solución de recuperación ante desastres ",
      "guid": "f219e4a1-eb58-4879-935d-227886d30b66",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-first-look-arm"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Alta disponibilidad ",
      "text": "Conjuntos de disponibilidad",
      "guid": "c57be595-1900-4838-95c5-86cb291ec16a",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Alta disponibilidad ",
      "text": "Zonas de disponibilidad",
      "guid": "1d076ef9-f141-4acd-ae57-9377bcdb3751",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/availability-zones/az-overview?context=/azure/virtual-machines/context/context"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Alta disponibilidad ",
      "text": "Tolerancia a fallos regional ",
      "guid": "ab2ac1fa-d66e-415d-9d5a-2adb2c3e2326",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/architecture/resiliency/recovery-loss-azure-region"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Protección contra el malware",
      "text": "Instalar soluciones antimalware",
      "guid": "af225ca4-4e16-496f-bdde-ace4cb1deb4c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/antimalware"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Protección contra el malware",
      "text": "Integre la solución antimalware con Security Center",
      "guid": "650c3fc1-4eeb-4b36-a382-9e3eec218368",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Administrar actualizaciones de máquinas virtuales",
      "text": "Mantenga actualizadas las máquinas virtuales mediante La administración de actualizaciones con Automatización de Azure",
      "guid": "7a0177a2-b594-45bd-a433-34fdf91c2341",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/automation/update-management/overview"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Administrar actualizaciones de máquinas virtuales",
      "text": "Asegúrese de que las imágenes de Windows para la implementación tengan el nivel más reciente de actualizaciones ",
      "guid": "c6fa96b9-6ad8-4840-af37-2734c876ba28",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/virtual-machines/automatic-vm-guest-patching"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Administrar actualizaciones de máquinas virtuales",
      "text": "Aplique rápidamente actualizaciones de seguridad a las máquinas virtuales con Microsoft Defender para la nube",
      "guid": "02145901-465d-438e-9309-ccbd979266bc",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/asset-inventory"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Cifre sus VHD",
      "text": "Habilite el cifrado en sus máquinas virtuales",
      "guid": "ca274faa-19bf-439d-a5d4-4c7c8919ca1f",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Cifre sus VHD",
      "text": "Agregar clave de cifrado de clave (KEK) para una capa adicional de seguridad para el cifrado ",
      "guid": "6d5315ae-524b-4a34-b458-5e12139bd7bb",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-machines/windows/disk-encryption-key-vault#set-up-a-key-encryption-key-kek"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Cifre sus VHD",
      "text": "Tome una instantánea de los discos antes del cifrado para fines de reversión",
      "guid": "012f7b95-e06e-4154-b2aa-3592828e6e20",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Restringir la conexión directa a Internet ",
      "text": "Asegúrese de que solo el grupo de red central tiene permisos para los recursos de red ",
      "guid": "5173676a-e466-491e-a835-ad942223E138",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Restringir la conexión directa a Internet ",
      "text": "Identifique y corrija las máquinas virtuales expuestas que permiten el acceso desde 'CUALQUIER' complemento de IP de origen",
      "guid": "10523081-a941-4741-9833-ff7ad7c6d373",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Restringir la conexión directa a Internet ",
      "text": "Restringir los puertos de administración (RDP, SSH) mediante el acceso justo a tiempo",
      "guid": "75a91be1-f388-4f03-a4d2-cd463cbbbc86",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-just-in-time"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Restringir la conexión directa a Internet ",
      "text": "Quitar el acceso a Internet e implementar servidores de salto para RDP",
      "guid": "8295abc9-1a4e-4da0-bae2-cc84c47b6b78",
      "severity": "Alto",
      "link": "http://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Restringir la conexión directa a Internet ",
      "text": "Elimine el inicio de sesión directo en los servidores que usan RDP / SSH de Internet e implemente VPN o ruta rápida",
      "guid": "1cbafe6c-4658-49d4-98a9-27c3974d1102",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-forced-tunneling"
    },
    {
      "category": "Comprobaciones de seguridad de VM",
      "subcategory": "Restringir la conexión directa a Internet ",
      "text": "Aproveche Azure Bastion como su agente RDP/SSH para mayor seguridad y reducción de la huella",
      "guid": "dad6aae1-1e6b-484e-b5df-47d2d92881b1",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/bastion/bastion-overview"
    },
    {
      "category": "Centinela",
      "subcategory": "Arquitectura ",
      "text": "Todos los inquilinos que contienen Sentinel tiene habilitado en al menos un área de trabajo de Log Analytics",
      "guid": "cd5d1e54-a297-459e-9968-0e78289c9356",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard"
    },
    {
      "category": "Centinela",
      "subcategory": "Arquitectura ",
      "text": "El cliente entiende la arquitectura de Sentinel",
      "guid": "57d02bff-4564-4b0d-a34a-359836ee79d6",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/best-practices-workspace-architecture"
    },
    {
      "category": "Centinela",
      "subcategory": "Arquitectura ",
      "text": "El cliente sabe cómo supervisar los incidentes en varias instancias de Sentinel",
      "guid": "e8f5c586-c7d9-4cdc-86ac-c075ef9b141a",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/sentinel/multiple-workspace-view"
    },
    {
      "category": "Centinela",
      "subcategory": "Visión general",
      "text": "No Hay incidencias abierto más de 24 horas",
      "guid": "8989579e-76b8-497e-910A-7Da7be9966E1",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/sentinel/manage-soc-with-incident-metrics"
    },
    {
      "category": "Centinela",
      "subcategory": "Noticias y Guías",
      "text": "A los clientes se les ha mostrado la pestaña Noticias y guías",
      "guid": "5d3c4ada-97cb-43d1-925a-b225c6f4e068",
      "severity": "Bajo",
      "link": "https://learn.microsoft.com/azure/sentinel/whats-new"
    },
    {
      "category": "Centinela",
      "subcategory": "UEBA ",
      "text": "UEBA configurado (Sentinel/Settings/Settings/Configure UEBA)",
      "guid": "5edddea8-a4b7-4cde-a4c6-1fc3fc14eea6",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics"
    },
    {
      "category": "Centinela",
      "subcategory": "Conectores de datos",
      "text": "Azure Active Directory en configurado y 'Último registro recibido' se muestra hoy",
      "guid": "e69d8d9a-3eec-4218-b687-ab077adb49e5",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory"
    },
    {
      "category": "Centinela",
      "subcategory": "Conectores de datos",
      "text": "Azure Active Directory Identity Protection está configurado y 'Último registro recibido' se muestra hoy",
      "guid": "b9603334-fdf8-4cc2-9318-db61171269f4",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-active-directory-identity-protection"
    },
    {
      "category": "Centinela",
      "subcategory": "Conectores de datos",
      "text": "Azure Activity está configurado y 'Último registro recibido' se muestra hoy",
      "guid": "0b4aa3d3-e070-4327-9d4b-98b15b8a219a",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity"
    },
    {
      "category": "Centinela",
      "subcategory": "Conectores de datos",
      "text": "Microsoft Defender para Cloud está configurado y 'Last Log Received' se muestra hoy",
      "guid": "8e13f9cc-bd46-4826-9abc-a264f9a19bfe",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud"
    },
    {
      "category": "Centinela",
      "subcategory": "Conectores de datos",
      "text": "Azure Firewall está configurado y 'Último registro recibido' se muestra hoy",
      "guid": "9d55d04c-3c49-419c-a1b2-d1215ae114b9",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall"
    },
    {
      "category": "Centinela",
      "subcategory": "Conectores de datos",
      "text": "Firewall de Windows está configurado y 'Último registro recibido' se muestra hoy",
      "guid": "34df585e-cccd-49bd-9ba0-cdb3b54eb2eb",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-firewall"
    },
    {
      "category": "Centinela",
      "subcategory": "Conectores de datos",
      "text": "Security Events está configurado con AMA y 'Last Log Received' se muestra hoy",
      "guid": "03ddaa25-9271-48d2-bdb1-0725769ef669",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama"
    },
    {
      "category": "Centinela",
      "subcategory": "Conectores de datos",
      "text": "Eventos de seguridad: compruebe que los equipos de Azure están conectados y envían datos al área de trabajo",
      "guid": "1a4834ac-9322-423e-ae80-b123081a5417",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference"
    },
    {
      "category": "Centinela",
      "subcategory": "Conectores de datos",
      "text": "Eventos de seguridad: compruebe que los equipos que no son de Azure están conectados y envían datos al área de trabajo",
      "guid": "859c773e-7e26-4162-9b77-5a917e1f348e",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference"
    },
    {
      "category": "Centinela",
      "subcategory": "Conectores de datos",
      "text": "Conector para AWS",
      "guid": "f354c27d-42e8-4bba-a868-155abb9163e9",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/connect-aws?tabs=s3"
    },
    {
      "category": "Centinela",
      "subcategory": "Conectores de datos",
      "text": "Conector para GCP",
      "guid": "909ae28c-84c3-43b6-a780-8bafe6c42149",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference"
    },
    {
      "category": "Centinela",
      "subcategory": "Reglas de análisis",
      "text": "El cliente ha habilitado las reglas de Analytics y ha configurado incidentes ",
      "guid": "d413a923-c357-44d1-8028-ac6aae01e6a8",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/sentinel/detect-threats-built-in"
    },
    {
      "category": "Centinela",
      "subcategory": "Configuración",
      "text": "El cliente no tiene un límite diario habilitado",
      "guid": "4de5df43-d299-4248-8718-d5d1e5f62565",
      "severity": "Medio",
      "link": "https://azure.microsoft.com/updates/controlling-data-volume-and-retention-in-log-analytics-2/"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Configuración",
      "text": "Implementación de Azure Firewall Premium",
      "guid": "9e3558fd-7724-49c9-9111-2d027fe412f7",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall/premium-features"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Configuración",
      "text": "Ajuste de cuatro cero/fuerza habilitado a través de Azure Firewall",
      "guid": "4dc74a74-8b66-433a-b2a0-916a764980ad",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal#create-a-default-route"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Control de acceso",
      "text": "RBAC establecido para habilitar solo usuarios autorizados",
      "guid": "0e278ee2-93c1-4bc3-92ba-aab7571849ab",
      "severity": "Medio",
      "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Configuración de diagnóstico",
      "text": "Diagnóstico habilitado y envío de métricas a un área de trabajo de Log Analytics ",
      "guid": "8093dc9f-c9d1-4bb7-9b36-a5a67fbb9ed5",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Administrador de cortafuegos",
      "text": "Los concentradores y las redes virtuales están protegidos o conectados a través de Firewall Premium",
      "guid": "b35478c3-4798-416b-8863-cffe1cac599e",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Administrador de cortafuegos",
      "text": "Directiva: Los controles de acceso están configurados (RBAC)",
      "guid": "f0d5a73d-d4de-436c-8c81-770afbc4c0e4",
      "severity": "Alto",
      "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Administrador de cortafuegos",
      "text": "Directiva: la directiva principal está configurada ",
      "guid": "5c3a87af-4a79-41f8-a39b-da47768e14c1",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Administrador de cortafuegos",
      "text": "Directiva: se definen las colecciones de reglas",
      "guid": "15675c1e-a55b-446a-a48f-f8ae7d7e4b47",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Administrador de cortafuegos",
      "text": "Política: Se definen las políticas de DNAT",
      "guid": "5b6c8bcb-f59b-4ce6-9de8-a03f97879468",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Administrador de cortafuegos",
      "text": "Directiva: Se definen las reglas de red",
      "guid": "d66a786d-60e9-46c9-9ad8-855d04c2b39c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Administrador de cortafuegos",
      "text": "Directiva: Se definen las reglas de aplicación",
      "guid": "986bb2c1-2149-4a11-9b5e-3df574ecccd9",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall/features"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Administrador de cortafuegos",
      "text": "DNS: Característica entendida y aplicada o no aplicada",
      "guid": "793a6bcd-a3b5-40eb-8eb0-3dd95d58d7c8",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/firewall/dns-details"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Administrador de cortafuegos",
      "text": "Inteligencia de amenazas: Configurado para alertar y denegar",
      "guid": "d622f54b-29ba-4de3-aad1-e8c28ec93666",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Administrador de cortafuegos",
      "text": "Inteligencia de amenazas: Lista permitida (justifique si se están utilizando, es decir, rendimiento)",
      "guid": "7313b005-674b-41e9-94a4-59c373e7ed61",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings#allowlist-addresses"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Administrador de cortafuegos",
      "text": "TLS habilitado",
      "guid": "623b365a-917e-4cbe-98eb-d54cd7df2e8b",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall/premium-certificates"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Administrador de cortafuegos",
      "text": "IDPS habilitados",
      "guid": "bac35715-59ab-4915-9e99-08aed8c44ce3",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Administrador de cortafuegos",
      "text": "SNAT: Configurado ",
      "guid": "b2b3808b-9fa1-4cf1-849d-003a923ce474",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/firewall/snat-private-range"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Protección DDOS",
      "text": "Habilitado para IP públicas de Firewall",
      "guid": "dbcbd8ac-2aae-4bca-8a43-da1dae2cc992",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices"
    }
  ],
  "severities": [
    {
      "name": "Alto"
    },
    {
      "name": "Medio"
    },
    {
      "name": "Bajo"
    }
  ],
  "status": [
    {
      "name": "No verificado",
      "description": "Esta comprobación aún no se ha analizado"
    },
    {
      "name": "Abrir",
      "description": "Hay un elemento de acción asociado a esta comprobación"
    },
    {
      "name": "Cumplido",
      "description": "Esta comprobación se ha verificado y no hay más elementos de acción asociados a ella"
    },
    {
      "name": "No es necesario",
      "description": "Recomendación entendida, pero no necesaria por los requisitos actuales"
    },
    {
      "name": "N/A",
      "description": "No aplicable para el diseño actual"
    }
  ],
  "categories": [
    {
      "name": "Defender para la nube"
    },
    {
      "name": "Azure Networking"
    },
    {
      "name": "Identidad"
    },
    {
      "name": "Comprobaciones de seguridad de VM"
    },
    {
      "name": "Centinela"
    },
    {
      "name": "Azure Firewall"
    }
  ]
}

checklists/security_checklist.en.json METASEP
{
  "$schema": "checklist.schema.json",
  "items": [
    {
      "category": "Defender For Cloud",
      "subcategory": "Pricing & Settings",
      "text": "Security Center/Defender enable in all subscriptions",
      "guid": "54174158-33fb-43ae-9c2d-e743165c3acb",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Pricing & Settings",
      "text": "Security Center/Defender enabled on all Log Analytics workspaces",
      "guid": "349f0364-d28d-442e-abbb-c868255abc91",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Pricing & Settings",
      "text": "Data collection set to 'Common'",
      "guid": "64e9a19a-e28c-484c-93b6-b7818ca0e6c4",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-data-collection?tabs=autoprovision-feature#what-event-types-are-stored-for-common-and-minimal"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Pricing & Settings",
      "text": "Defender for Cloud enhanced security features are all enabled",
      "guid": "2149d414-a923-4c35-94d1-1029bd6aaf11",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Pricing & Settings",
      "text": "Auto-provisioning enabled as per company policy (policy must exist)",
      "guid": "e6b84ee5-ef43-4d29-a248-1718d5d1f5f7",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-enable-data-collection"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Pricing & Settings",
      "text": "Email notifications enabled as per company policy (policy must exist)",
      "guid": "25759e35-680e-4782-9ac9-32213d027ff4",
      "severity": "Low",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-provide-security-contact-details"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Pricing & Settings",
      "text": "Enable integrations options are selected ",
      "guid": "12f70993-0631-4583-9ee7-9d6c6d363206",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-wdatp?WT.mc_id=Portal-Microsoft_Azure_Security_CloudNativeCompute&tabs=windows"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Pricing & Settings",
      "text": "CI/CD integration is configured",
      "guid": "5b7abae4-4aad-45e8-a79e-2e86667313c5",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/security-center/defender-for-container-registries-cicd"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Pricing & Settings",
      "text": "Continuous export 'Event Hub' is enabled if using 3rd party SIEM",
      "guid": "05675c5e-985b-4859-a774-f7e371623b87",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Pricing & Settings",
      "text": "Continuous export 'Log Analytics Workspace' is enabled if not using Azure Sentinel",
      "guid": "5a917e1f-349f-4036-9d28-d42e8bbbc868",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Pricing & Settings",
      "text": "Cloud connector enabled for AWS",
      "guid": "255abc91-64e9-4a19-ae28-c84c43b6b781",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-aws?WT.mc_id=Portal-Microsoft_Azure_Security"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Pricing & Settings",
      "text": "Cloud connector enabled for GCP",
      "guid": "8ca0e6c4-2149-4d41-9a92-3c3574d11029",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-gcp"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Pricing & Settings",
      "text": "If using Azure AD Application proxy, consider integrating with Microsoft Defender for Cloud Apps to monitor application access in real-time and apply advanced security controls.",
      "guid": "cce9bdf6-b483-45a0-85ec-c8232b230652",
      "severity": "Low",
      "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-integrate-with-microsoft-cloud-application-security"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Recommendations",
      "text": "All recommendations remediated or disabled if not required.",
      "guid": "df9cc234-18db-4611-9126-5f4bb47a393a",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/security-center/secure-score-security-controls"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Recommendations",
      "text": "Security Score>70%",
      "description": "Microsoft minimum target for all customers is 70%",
      "guid": "08032729-4798-4b15-98a2-19a46ceb5443",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Security Alerts",
      "text": "Security Alerts contain only those generated in the past 24 hours (remediate or disable older security alerts)",
      "guid": "50259226-4429-42bb-9285-37a55119bf8e",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/tutorial-security-incident"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Workbooks",
      "text": "If continuous export is enabled, default workbooks published to custom security dashboard",
      "guid": "8f585428-7d9c-4dc1-96cd-072af9b141a8",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/security-center/custom-dashboards-azure-workbooks"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Community",
      "text": "Customer is aware of the value of the 'Community' page and has a regular cadence set up to review",
      "guid": "98a535e7-3789-47e7-8ca7-da7be9962a15",
      "severity": "Medium",
      "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Secure Score",
      "text": "All subscriptions protected by Security Center are shown (no subscription filter set)",
      "description": "Customer Operational best practice - Transparency",
      "guid": "93846da9-7cc3-4923-856b-22586f4a1641",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Regulatory Compliance",
      "text": "Compliance controls are green for any required compliance requirements",
      "guid": "bdddea8a-487c-4deb-9861-bc3bc14aea6e",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-compliance-dashboard"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Azure Defender",
      "text": "High severity VM vulnerabilities is zero (empty)",
      "description": "Customer Operational best practice - verify",
      "guid": "65e8d9a3-aec2-418e-9436-b0736db55f57",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/remediate-vulnerability-findings-vm"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Firewall Manager",
      "text": "Hubs are protected by an Azure Firewall",
      "guid": "9603334b-df9c-4c23-918d-b61171265f4b",
      "severity": "Medium",
      "link": "https://techcommunity.microsoft.com/t5/azure-network-security/azure-firewall-manager-is-now-integrated-with-azure-security/ba-p/2228679"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Firewall Manager",
      "text": "Virtual Networks are protected by a Firewall",
      "description": "Customer Operational best practice - verify",
      "guid": "b47a393a-0803-4272-a479-8b1578a219a4",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/network-best-practices"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Firewall Manager",
      "text": "DDoS Standard enabled",
      "guid": "6ceb5443-5025-4922-9442-92bb628537a5",
      "severity": "Medium",
      "link": "https://azure.microsoft.com/blog/how-azure-security-center-detects-ddos-attack-using-cyber-threat-intelligence/"
    },
    {
      "category": "Defender For Cloud",
      "subcategory": "Coverage",
      "text": "Verify that all subscriptions are covered (see pricing and settings to modify)",
      "guid": "5119bf8e-8f58-4542-a7d9-cdc166cd072a",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started?WT.mc_id=Portal-Microsoft_Azure_Security"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Public IPs",
      "text": "VM's with public IPs should be protected by NSG ",
      "guid": "4df585ec-dce9-4793-a7bc-db3b51eb2eb0",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Public IPs",
      "text": "VMs with public IPs are moved  behind Azure Firewall Premium",
      "description": "Customer operational best practice -  verify",
      "guid": "3dda6e59-d7c8-4a2e-bb11-7d6769af669c",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Public IPs",
      "text": "VM's that don't need public IPs do not have public IPs (i.e. internal RDP only)",
      "description": "Customer operational best practice - verify",
      "guid": "a48e5a85-f222-43ec-b8bb-12308ca5017f",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access"
    },
    {
      "category": "Azure Networking",
      "subcategory": "NSG",
      "text": "NSG RBAC is used to restrict access to network security team",
      "guid": "158e3ea3-a93c-42de-9e31-65c3a87a04b7",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "NSG",
      "text": "NSG Inbound security rules do not contain a * (wildcard) in Source field",
      "description": "Customer operational best practice - verify",
      "guid": "a209939b-da47-4778-b24c-116785c2fa55",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "NSG",
      "text": "NSG outbound security rules are used to control traffic to specific IP addresses for traffic not routed through a Firewall",
      "description": "Customer operational best practice - verify",
      "guid": "b56a9480-08be-47d7-b4c4-76b6d8bdcf59",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "NSG",
      "text": "NSG do not have Source as a * (wildcard) in place.",
      "description": "Customer operational best practice - verify",
      "guid": "bce65de8-a13f-4988-9946-8d66a786d60f",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "NSG",
      "text": "NSG Diagnostics send NetworkSecurityGroupEvent and NetworkSecurityGroupRuleCounter traffic to Sentinel LAW",
      "guid": "a6c97be9-955d-404c-9c49-c986cb2d1215",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-nsg-manage-log"
    },
    {
      "category": "Azure Networking",
      "subcategory": "UDR",
      "text": "UDR RBAC is used to restrict access to the network security team",
      "guid": "aa124b6e-4df5-485e-adce-9793b7bcdb3b",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "UDR",
      "text": "If Zero Trust, then UDR's are used to send all traffic to the Azure Firewall Premium",
      "guid": "51eb2eb0-3dda-46e5-ad7c-8a2edb117d67",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "UDR",
      "text": "UDR's that do not send all traffic to AzureFirewallPremium are known and documented.",
      "description": "Customer operational best practice - verify",
      "guid": "69af669c-a48e-45a8-9f22-23ece8bb1230",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Virtual Networks",
      "text": "Customer is familiar with Azure networking defaults / SDN default routing in Azure",
      "guid": "8ca5017f-158e-43ea-9a93-c2de7e3165c3",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview#default"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Virtual Networks",
      "text": "VNet RBAC is used to restrict access to the network security team",
      "description": "Customer operational best practice - verify",
      "guid": "a87a04b7-a209-4939-ada4-7778f24c1167",
      "severity": "Medium",
      "link": "https://github.com/MicrosoftDocs/azure-docs/issues/53672"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Virtual Networks",
      "text": "VNet Security recommendations are remediated and there are no 'At-risk' VNets ",
      "guid": "85c2fa55-b56a-4948-808b-e7d7e4c476b6",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/virtual-network/policy-reference"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Virtual Networks",
      "text": "VNet Peering connections are understood and expected traffic flows are documented",
      "guid": "d8bdcf59-bce6-45de-aa13-f98879468d66",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Virtual Networks",
      "text": "VNet Service Endpoints are in use, no legacy Public Service Endpoints exist",
      "guid": "a786d60f-a6c9-47be-a955-d04c3c49c986",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Virtual Networks",
      "text": "VNet Private Endpoints are in use to allow access from on-premises environments, no legacy public endpoints exist",
      "guid": "1f625659-ee55-480a-9824-9c931213dbd7",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Virtual Networks",
      "text": "VNet Monitoring enabled",
      "guid": "fb012f70-943f-4630-9722-ea39d2b1ce63",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Virtual Networks",
      "text": "Secure traffic between pods using network policies in Azure Kubernetes Service (AKS)",
      "guid": "2055b29b-ade4-4aad-8e8c-39ec94666731",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/virtual-network/kubernetes-network-policies"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Virtual Networks",
      "text": "VNet NVA (appliances) customer follows published architecture pattern",
      "guid": "3c005674-c1e9-445b-959c-373e7ed71623",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-scenario-udr-gw-nva"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Virtual Networks",
      "text": "VNet Diagnostic settings are enabled and sending VMProtectionAlerts to the Azure Sentinel LAW",
      "guid": "b375a917-ecbe-448f-ae64-dd7df2e8bbbc",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Connectivity",
      "text": "Use ExpressRoute or VPN to access Azure resources from on-premises environments",
      "guid": "468155ab-c916-44e9-a09a-ed8c44cf3b2b",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Virtual WAN",
      "text": "VWAN RBAC is used to restrict access to the network security team",
      "guid": "bd8ac2aa-ebca-42a4-9da1-dbf3dd992481",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Virtual WAN",
      "text": "VWAN Customer is using Secure Hub or external Firewall to route and monitor traffic.",
      "guid": "718d1dca-1f62-4565-aee5-580a38249c93",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-global-transit-network-architecture"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Application Gateway",
      "text": "AppGW RBAC is used to restrict access to the network security team",
      "guid": "1213dbd7-fb01-42f7-8943-f6304722ea39",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/web-application-firewall/overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Application Gateway",
      "text": "AppGW All external facing web services are behind Application Gateways with WAF enabled ",
      "guid": "d2b1ce63-2055-4b29-aade-4aad1e8c39ec",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Application Gateway",
      "text": "AppGW All internal facing web services are behind Application Gateways with WAF enabled ",
      "guid": "94666731-3c00-4567-9c1e-945b459c373e",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip"
    },
    {
      "category": "Azure Networking",
      "subcategory": "Application Gateway",
      "text": "AppGW - External facing has TLS/SSL enabled and redirects all traffic to 443 (no port 80 traffic)",
      "guid": "7ed71623-b375-4a91-9ecb-e48fbe64dd7d",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview"
    },
    {
      "category": "Azure Networking",
      "subcategory": "FrontDoor",
      "text": "Front Door RBAC is used to restrict access to the network security team",
      "guid": "f2e8bbbc-4681-455a-ac91-64e9909aed8c",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/frontdoor/"
    },
    {
      "category": "Azure Networking",
      "subcategory": "FrontDoor",
      "text": "Front Door is associated with a WAF policy",
      "guid": "44cf3b2b-3818-4baf-a2cf-2149d013a923",
      "severity": "High",
      "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/front-door-security-baseline?toc=/azure/frontdoor/TOC.json"
    },
    {
      "category": "Azure Networking",
      "subcategory": "FrontDoor",
      "text": "Front Door TLS/SSL policy is configured",
      "guid": "ce574dcc-bd8a-4c2a-aebc-a2a44da1dbf3",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain-https"
    },
    {
      "category": "Azure Networking",
      "subcategory": "FrontDoor",
      "text": "Front Door redirect port 80 to port 443 is configured (listeners)",
      "guid": "dd992481-718d-41dc-a1f6-25659ee5580a",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/frontdoor/front-door-url-redirect"
    },
    {
      "category": "Azure Networking",
      "subcategory": "FrontDoor",
      "text": "Front Door diagnostics logs send ApplicationGatewayAccessLog &ApplicationGateway FirewallLog to Sentinel LAW",
      "guid": "38249c93-1213-4dbd-9fb0-12f70943f630",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/frontdoor/front-door-diagnostics"
    },
    {
      "category": "Azure Networking",
      "subcategory": "DDOS Protection",
      "text": "Enabled for Firewall public  IP's  (all public IPs)",
      "guid": "4722ea39-d2b1-4ce6-9205-5b29bade4aad",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices"
    },
    {
      "category": "Identity",
      "subcategory": "Tenant",
      "text": "Establish a single enterprise directory for managing identities of full-time employees and enterprise resources.",
      "guid": "346ad56f-bdb8-44db-8bcd-0a689af63f1e",
      "severity": "High",
      "link": "https://learn.microsoft.com/security/compass/identity#a-single-enterprise-directory"
    },
    {
      "category": "Identity",
      "subcategory": "Tenant",
      "text": "Synchronize your cloud identity with your existing identity systems.",
      "guid": "a46108cd-6a76-4749-ae69-b7bf61410010",
      "severity": "High",
      "link": "https://learn.microsoft.com/security/compass/identity#synchronized-identity-systems"
    },
    {
      "category": "Identity",
      "subcategory": "Tenant",
      "text": "Use cloud identity services to host non-employee accounts such as vendors, partners, and customers, rather than rather than including them in your on-premises directory.",
      "guid": "a1ab96ceb-c149-4ce2-bcad-3bd375ebfc7f",
      "severity": "High",
      "link": "https://learn.microsoft.com/security/compass/identity#cloud-provider-identity-source-for-third-parties"
    },
    {
      "category": "Identity",
      "subcategory": "Tenant",
      "text": "Disable insecure legacy protocols for internet-facing services.",
      "guid": "343473ec-ed5c-49e1-98f4-cb09524a23cd",
      "severity": "High",
      "link": "https://learn.microsoft.com/security/compass/identity#block-legacy-authentication"
    },
    {
      "category": "Identity",
      "subcategory": "Tenant",
      "text": "Enable single sign-on",
      "guid": "70dceb23-50c7-4d8d-bf53-8cc104c7dc44",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/identity-management-best-practices#enable-single-sign-on"
    },
    {
      "category": "Identity",
      "subcategory": "Privileged administration",
      "text": "Don’t synchronize accounts with the highest privilege access to on-premises resources as you synchronize your enterprise identity systems with cloud directories.",
      "guid": "87791be1-1eb0-48ed-8003-ad9bcf241b99",
      "severity": "High",
      "link": "https://learn.microsoft.com/security/compass/identity#no-on-premises-admin-accounts-in-cloud-identity-providers"
    },
    {
      "category": "Identity",
      "subcategory": "Privileged administration",
      "text": "Limit the number of Global Administrators to less than 5",
      "guid": "9e6efe9d-f28f-463b-9bff-b5080173e9fe",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5"
    },
    {
      "category": "Identity",
      "subcategory": "Privileged administration",
      "text": "Use groups for Azure AD role assignments and delegate the role assignment",
      "guid": "e0d968d3-87f6-41fb-a4f9-d852f1673f4c",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#6-use-groups-for-azure-ad-role-assignments-and-delegate-the-role-assignment"
    },
    {
      "category": "Identity",
      "subcategory": "Privileged administration",
      "text": "Ensure all critical impact admins are managed by enterprise directory to follow organizational policy enforcement.",
      "guid": "00350863-4df6-4050-9cf1-cbaa6d58283e",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#managed-accounts-for-admins"
    },
    {
      "category": "Identity",
      "subcategory": "Privileged administration",
      "text": "Configure recurring access reviews to revoke unneeded permissions over time",
      "guid": "eae64d01-0d3a-4ae1-a89d-cc1c2ad3888f",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#4-configure-recurring-access-reviews-to-revoke-unneeded-permissions-over-time"
    },
    {
      "category": "Identity",
      "subcategory": "Privileged administration",
      "text": "Ensure critical impact admins use a workstation with elevated security protections and monitoring",
      "guid": "922ac19f-916d-4697-b8ea-ded26bdd186f",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#admin-workstation-security"
    },
    {
      "category": "Identity",
      "subcategory": "External Identities",
      "text": "Identity Providers: Verify external identity providers are known",
      "guid": "1e8c39ec-9466-4673-83c0-05674c1e945b",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/compare-with-b2c"
    },
    {
      "category": "Identity",
      "subcategory": "External Identities",
      "text": "External Collaboration Settings: Guest user access set to 'Guest user access is restricted?'",
      "guid": "459c373e-7ed7-4162-9b37-5a917ecbe48f",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "Identity",
      "subcategory": "External Identities",
      "text": "External Collaboration Settings: Guest invite settings set to  'Only users assigned to specific admin roles'",
      "guid": "be64dd7d-f2e8-4bbb-a468-155abc9164e9",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "Identity",
      "subcategory": "External Identities",
      "text": "External Collaboration Settings: Enable guest self-service sign up via flows set  to 'Disabled' ",
      "guid": "909aed8c-44cf-43b2-a381-8bafa2cf2149",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "Identity",
      "subcategory": "External Identities",
      "text": "External Collaboration Settings: Collaboration restrictions set to 'Allow invitations to the specified domains'",
      "guid": "d013a923-ce57-44dc-abd8-ac2aaebca2a4",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations"
    },
    {
      "category": "Identity",
      "subcategory": "External Identities",
      "text": "Access Reviews: Enabled for all groups",
      "guid": "4da1dbf3-dd99-4248-8718-d1dca1f62565",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/active-directory/governance/deploy-access-reviews"
    },
    {
      "category": "Identity",
      "subcategory": "Enterprise Applications",
      "text": "Consent & Permissions: Allow user consent for apps from verified publishers",
      "guid": "9ee5580a-3824-49c9-9121-3dbd7fb012f7",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent"
    },
    {
      "category": "Identity",
      "subcategory": "Enterprise Applications",
      "text": "Consent & Permissions: Allow group owner consent for selected group owners ",
      "guid": "0943f630-4722-4ea3-ad2b-1ce632055b29",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent-groups"
    },
    {
      "category": "Identity",
      "subcategory": "Custom Domains",
      "text": "Only validated customer domains are registered",
      "guid": "bade4aad-1e8c-439e-a946-667313c00567",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-configure-custom-domain"
    },
    {
      "category": "Identity",
      "subcategory": "Password Reset",
      "text": "Self-service password reset policy requirement verified compliant.",
      "guid": "4c1e945b-459c-4373-b7ed-71623b375a91",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-sspr"
    },
    {
      "category": "Identity",
      "subcategory": "Password Reset",
      "text": "Set number of days before users are asked to re-confirm authentication information is not set to zero",
      "guid": "7ecbe48f-be64-4dd7-bf2e-8bbbc468155a",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment"
    },
    {
      "category": "Identity",
      "subcategory": "Password Reset",
      "text": "Set number of methods required to reset password are selected",
      "guid": "bc9164e9-909a-4ed8-a44c-f3b2b3818baf",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment"
    },
    {
      "category": "Identity",
      "subcategory": "User Setting",
      "text": "Disable 'Users can register applications'",
      "guid": "a2cf2149-d013-4a92-9ce5-74dccbd8ac2a",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/delegate-app-roles"
    },
    {
      "category": "Identity",
      "subcategory": "User Setting",
      "text": "Restrict access to Administrative portal (portal.azure.com) to administrators only",
      "guid": "aebca2a4-4da1-4dbf-9dd9-92481718d1dc",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/users-default-permissions"
    },
    {
      "category": "Identity",
      "subcategory": "User Setting",
      "text": "Disable 'LinkedIn account connection'",
      "guid": "a1f62565-9ee5-4580-a382-49c931213dbd",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/enterprise-users/linkedin-integration"
    },
    {
      "category": "Identity",
      "subcategory": "Diagnostic Settings",
      "text": "Enabled and send to Log Analytics workspace with Sentinel",
      "guid": "7fb012f7-0943-4f63-8472-2ea39d2b1ce6",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-monitoring"
    },
    {
      "category": "Identity",
      "subcategory": "PIM enabled",
      "text": "Privileged Identity Management enabled",
      "guid": "21e44a19-a9dd-4399-afd7-b28dc8355562",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan"
    },
    {
      "category": "Identity",
      "subcategory": "PIM enabled",
      "text": "Implement 'just in time' (JIT) access to further lower the exposure time for privileged accounts (reduce standing access)",
      "guid": "46f4389a-7f42-4c78-b78c-06a63a21a495",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc"
    },
    {
      "category": "Identity",
      "subcategory": "Conditional Access Policies",
      "text": "Configure conditional access policies / Access Controls",
      "guid": "6e6a8dc4-a20e-427b-9e29-711b1352beee",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common"
    },
    {
      "category": "Identity",
      "subcategory": "Conditional Access Policies",
      "text": "Conditions: Restricted Locations",
      "guid": "079b588d-efc4-4972-ac3c-d21bf77036e5",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition"
    },
    {
      "category": "Identity",
      "subcategory": "Conditional Access Policies",
      "text": "Access Controls:  MFA enabled for all users",
      "guid": "e6b4bed3-d5f3-4547-a134-7dc56028a71f",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-azure-mfa"
    },
    {
      "category": "Identity",
      "subcategory": "Conditional Access Policies",
      "text": "Access Controls:  Require MFA for Administrators",
      "guid": "fe1bd15d-d2f0-4d5e-972d-41e3611cc57b",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa"
    },
    {
      "category": "Identity",
      "subcategory": "Conditional Access Policies",
      "text": "Access Controls:  Require MFA for Azure Management ",
      "guid": "4a4b1410-d439-4589-ac22-89b3d6b57cfc",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management"
    },
    {
      "category": "Identity",
      "subcategory": "Conditional Access Policies",
      "text": "Access Controls:  Block Legacy Protocols",
      "guid": "645461e1-a3e3-4453-a3c8-639637a552d6",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy"
    },
    {
      "category": "Identity",
      "subcategory": "Conditional Access Policies",
      "text": "Access Controls: Require devices to be marked as compliant",
      "guid": "7ae9eab4-0fd3-4290-998b-c178bdc5a06c",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/require-managed-devices"
    },
    {
      "category": "Identity",
      "subcategory": "Guest users",
      "text": "Is there a policy to track guest user accounts (i.e. usage/delete/disable)?",
      "description": "Customer documented policy",
      "guid": "a7144351-e19d-4d34-929e-b7228137a151",
      "severity": "Medium",
      "link": "https://devblogs.microsoft.com/premier-developer/azure-active-directory-automating-guest-user-management/"
    },
    {
      "category": "Identity",
      "subcategory": "Identity Secure Score",
      "text": "Implement Identity Secure Score based on best practices in your industry",
      "guid": "c5bb4e4f-1814-4287-b5ca-8c26c9b32ab5",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/identity-secure-score"
    },
    {
      "category": "Identity",
      "subcategory": "Break Glass Accounts",
      "text": "At least two break glass accounts have been created and policy around their use exists",
      "guid": "bcfc6998-a135-4e33-9897-e31c67d68cb6",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "Access Control",
      "text": "Control VM Access leveraging Azure Policy",
      "guid": "0ac252b9-99a6-48af-a7c9-a8f821b8eb8c",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "Access Control",
      "text": "Reduce variability in your setup and deployment of VMs by leveraging templates",
      "guid": "0aa77e26-e4d5-4aea-a8dc-4e2436bc336d",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "Access Control",
      "text": "Secure privileged access to deploy VMS by reducing who has access to Resources through Governance",
      "guid": "b5945bda-4333-44fd-b91c-234182b65275",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "High Availability ",
      "text": "Use multiple VMs for your workloads for better availability ",
      "guid": "269440b4-be3d-43e0-a432-76d4bdc015bc",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/architecture/checklist/resiliency-per-service"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "High Availability ",
      "text": "Deploy and test a disaster recovery solution ",
      "guid": "f219e4a1-eb58-4879-935d-227886d30b66",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-first-look-arm"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "High Availability ",
      "text": "Availability sets",
      "guid": "c57be595-1900-4838-95c5-86cb291ec16a",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "High Availability ",
      "text": "Availability Zones",
      "guid": "1d076ef9-f141-4acd-ae57-9377bcdb3751",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/availability-zones/az-overview?context=/azure/virtual-machines/context/context"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "High Availability ",
      "text": "Regional fault tolerance ",
      "guid": "ab2ac1fa-d66e-415d-9d5a-2adb2c3e2326",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/architecture/resiliency/recovery-loss-azure-region"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "Protect against malware",
      "text": "Install antimalware solutions",
      "guid": "af225ca4-4e16-496f-bdde-ace4cb1deb4c",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/antimalware"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "Protect against malware",
      "text": "Integrate antimalware solution with Security Center",
      "guid": "650c3fc1-4eeb-4b36-a382-9e3eec218368",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "Manage VM Updates",
      "text": "Keep VMs up to date using Update Management with Azure Automation",
      "guid": "7a0177a2-b594-45bd-a433-34fdf91c2341",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/automation/update-management/overview"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "Manage VM Updates",
      "text": "Ensure Windows images for deployment have the most recent level of updates ",
      "guid": "c6fa96b9-6ad8-4840-af37-2734c876ba28",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/virtual-machines/automatic-vm-guest-patching"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "Manage VM Updates",
      "text": "Rapidly apply security updates to VMs using Microsoft Defender for Cloud",
      "guid": "02145901-465d-438e-9309-ccbd979266bc",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/security-center/asset-inventory"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "Encrypt your VHDs",
      "text": "Enable encryption on your VMs",
      "guid": "ca274faa-19bf-439d-a5d4-4c7c8919ca1f",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "Encrypt your VHDs",
      "text": "Add Key Encryption Key (KEK) for added layer of security for encryption ",
      "guid": "6d5315ae-524b-4a34-b458-5e12139bd7bb",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/virtual-machines/windows/disk-encryption-key-vault#set-up-a-key-encryption-key-kek"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "Encrypt your VHDs",
      "text": "Take a snapshot of disks before encryption for rollback purposes",
      "guid": "012f7b95-e06e-4154-b2aa-3592828e6e20",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "Restrict direct internet connection ",
      "text": "Ensure only the central networking group has permissions to networking resources ",
      "guid": "5173676a-e466-491e-a835-ad942223e138",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "Restrict direct internet connection ",
      "text": "Identity and remediate exposed VMs that allow access from 'ANY' source IP address",
      "guid": "10523081-a941-4741-9833-ff7ad7c6d373",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "Restrict direct internet connection ",
      "text": "Restrict management ports (RDP, SSH) using Just-in-Time Access",
      "guid": "75a91be1-f388-4f03-a4d2-cd463cbbbc86",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/security-center/security-center-just-in-time"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "Restrict direct internet connection ",
      "text": "Remove internet access and implement jump servers for RDP",
      "guid": "8295abc9-1a4e-4da0-bae2-cc84c47b6b78",
      "severity": "High",
      "link": "http://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "Restrict direct internet connection ",
      "text": "Remove direct logging into servers using RDP/SSH from internet and implement VPN or express route",
      "guid": "1cbafe6c-4658-49d4-98a9-27c3974d1102",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-forced-tunneling"
    },
    {
      "category": "VM Security Checks",
      "subcategory": "Restrict direct internet connection ",
      "text": "Leverage Azure Bastion as your RDP/SSH broker for added security and reduction in footprint",
      "guid": "dad6aae1-1e6b-484e-b5df-47d2d92881b1",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/bastion/bastion-overview"
    },
    {
      "category": "Sentinel",
      "subcategory": "Architecture ",
      "text": "All tenants contain have Sentinel enabled on at least one Log Analytics workspace",
      "guid": "cd5d1e54-a297-459e-9968-0e78289c9356",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard"
    },
    {
      "category": "Sentinel",
      "subcategory": "Architecture ",
      "text": "Customer understands Sentinel architecture",
      "guid": "57d02bff-4564-4b0d-a34a-359836ee79d6",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/sentinel/best-practices-workspace-architecture"
    },
    {
      "category": "Sentinel",
      "subcategory": "Architecture ",
      "text": "Customer knows how to monitor Incidents across multiple Sentinel instances",
      "guid": "e8f5c586-c7d9-4cdc-86ac-c075ef9b141a",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/sentinel/multiple-workspace-view"
    },
    {
      "category": "Sentinel",
      "subcategory": "Overview",
      "text": "No Incidents open more than 24 hours",
      "guid": "8989579e-76b8-497e-910a-7da7be9966e1",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/sentinel/manage-soc-with-incident-metrics"
    },
    {
      "category": "Sentinel",
      "subcategory": "News & Guides",
      "text": "Customer have been shown the News & Guides tab",
      "guid": "5d3c4ada-97cb-43d1-925a-b225c6f4e068",
      "severity": "Low",
      "link": "https://learn.microsoft.com/azure/sentinel/whats-new"
    },
    {
      "category": "Sentinel",
      "subcategory": "UEBA ",
      "text": "UEBA Configured (Sentinel/Settings/Settings/Configure UEBA)",
      "guid": "5edddea8-a4b7-4cde-a4c6-1fc3fc14eea6",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics"
    },
    {
      "category": "Sentinel",
      "subcategory": "Data Connectors",
      "text": "Azure Active Directory in configured and 'Last Log Received' shows today",
      "guid": "e69d8d9a-3eec-4218-b687-ab077adb49e5",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory"
    },
    {
      "category": "Sentinel",
      "subcategory": "Data Connectors",
      "text": "Azure Active Directory Identity Protection is configured and 'Last Log Received' shows today",
      "guid": "b9603334-fdf8-4cc2-9318-db61171269f4",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-active-directory-identity-protection"
    },
    {
      "category": "Sentinel",
      "subcategory": "Data Connectors",
      "text": "Azure Activity is configured is configured and 'Last Log Received' shows today",
      "guid": "0b4aa3d3-e070-4327-9d4b-98b15b8a219a",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity"
    },
    {
      "category": "Sentinel",
      "subcategory": "Data Connectors",
      "text": "Microsoft Defender for Cloud is configured and 'Last Log Received' shows today",
      "guid": "8e13f9cc-bd46-4826-9abc-a264f9a19bfe",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud"
    },
    {
      "category": "Sentinel",
      "subcategory": "Data Connectors",
      "text": "Azure Firewall is configured and 'Last Log Received' shows today",
      "guid": "9d55d04c-3c49-419c-a1b2-d1215ae114b9",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall"
    },
    {
      "category": "Sentinel",
      "subcategory": "Data Connectors",
      "text": "Windows Firewall is configured and 'Last Log Received' shows today",
      "guid": "34df585e-cccd-49bd-9ba0-cdb3b54eb2eb",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-firewall"
    },
    {
      "category": "Sentinel",
      "subcategory": "Data Connectors",
      "text": "Security Events is configured with AMA and 'Last Log Received' shows today",
      "guid": "03ddaa25-9271-48d2-bdb1-0725769ef669",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama"
    },
    {
      "category": "Sentinel",
      "subcategory": "Data Connectors",
      "text": "Security Events - verify Azure computers are connected and sending data to the workspace",
      "guid": "1a4834ac-9322-423e-ae80-b123081a5417",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference"
    },
    {
      "category": "Sentinel",
      "subcategory": "Data Connectors",
      "text": "Security Events - verify non-Azure computers are connected and sending data to the workspace",
      "guid": "859c773e-7e26-4162-9b77-5a917e1f348e",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference"
    },
    {
      "category": "Sentinel",
      "subcategory": "Data Connectors",
      "text": "Connector for AWS",
      "guid": "f354c27d-42e8-4bba-a868-155abb9163e9",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/sentinel/connect-aws?tabs=s3"
    },
    {
      "category": "Sentinel",
      "subcategory": "Data Connectors",
      "text": "Connector for GCP",
      "guid": "909ae28c-84c3-43b6-a780-8bafe6c42149",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference"
    },
    {
      "category": "Sentinel",
      "subcategory": "Analytics Rules",
      "text": "Customer has enabled Analytics rules and configured Incidents ",
      "guid": "d413a923-c357-44d1-8028-ac6aae01e6a8",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/sentinel/detect-threats-built-in"
    },
    {
      "category": "Sentinel",
      "subcategory": "Settings",
      "text": "Customer does not have a daily cap enabled",
      "guid": "4de5df43-d299-4248-8718-d5d1e5f62565",
      "severity": "Medium",
      "link": "https://azure.microsoft.com/updates/controlling-data-volume-and-retention-in-log-analytics-2/"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Configuration",
      "text": "Azure Firewall Premium deployed",
      "guid": "9e3558fd-7724-49c9-9111-2d027fe412f7",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/firewall/premium-features"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Configuration",
      "text": "Quad zero/force tunning enabled through Azure Firewall",
      "guid": "4dc74a74-8b66-433a-b2a0-916a764980ad",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal#create-a-default-route"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Access Control",
      "text": "RBAC set to enable only authorized users",
      "guid": "0e278ee2-93c1-4bc3-92ba-aab7571849ab",
      "severity": "Medium",
      "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Diagnostic Settings",
      "text": "Diagnostics enabled and sending metrics to a Log Analytics workspace ",
      "guid": "8093dc9f-c9d1-4bb7-9b36-a5a67fbb9ed5",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Firewall Manager",
      "text": "Hubs and virtual networks are protected or connected through Firewall Premium",
      "guid": "b35478c3-4798-416b-8863-cffe1cac599e",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Firewall Manager",
      "text": "Policy: Access controls are configured (RBAC)",
      "guid": "f0d5a73d-d4de-436c-8c81-770afbc4c0e4",
      "severity": "High",
      "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Firewall Manager",
      "text": "Policy: Parent policy is configured ",
      "guid": "5c3a87af-4a79-41f8-a39b-da47768e14c1",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Firewall Manager",
      "text": "Policy: Rule collections are defined",
      "guid": "15675c1e-a55b-446a-a48f-f8ae7d7e4b47",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Firewall Manager",
      "text": "Policy: DNAT policies are defined",
      "guid": "5b6c8bcb-f59b-4ce6-9de8-a03f97879468",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Firewall Manager",
      "text": "Policy: Network rules are defined",
      "guid": "d66a786d-60e9-46c9-9ad8-855d04c2b39c",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Firewall Manager",
      "text": "Policy: Application rules are defined",
      "guid": "986bb2c1-2149-4a11-9b5e-3df574ecccd9",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/firewall/features"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Firewall Manager",
      "text": "DNS: Feature understood and applied or not applied",
      "guid": "793a6bcd-a3b5-40eb-8eb0-3dd95d58d7c8",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/firewall/dns-details"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Firewall Manager",
      "text": "Threat Intelligence: Set to Alert & Deny",
      "guid": "d622f54b-29ba-4de3-aad1-e8c28ec93666",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Firewall Manager",
      "text": "Threat Intelligence: Allowed list (justify if they are being used - ie performance)",
      "guid": "7313b005-674b-41e9-94a4-59c373e7ed61",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings#allowlist-addresses"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Firewall Manager",
      "text": "TLS enabled",
      "guid": "623b365a-917e-4cbe-98eb-d54cd7df2e8b",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/firewall/premium-certificates"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Firewall Manager",
      "text": "IDPS enabled",
      "guid": "bac35715-59ab-4915-9e99-08aed8c44ce3",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/firewall/rule-processing"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "Firewall Manager",
      "text": "SNAT: Configured ",
      "guid": "b2b3808b-9fa1-4cf1-849d-003a923ce474",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/firewall/snat-private-range"
    },
    {
      "category": "Azure Firewall",
      "subcategory": "DDOS Protection",
      "text": "Enabled for Firewall public  IP's",
      "guid": "dbcbd8ac-2aae-4bca-8a43-da1dae2cc992",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices"
    }
  ],
  "categories": [
    {
      "name": "Defender For Cloud"
    },
    {
      "name": "Azure Networking"
    },
    {
      "name": "Identity"
    },
    {
      "name": "VM Security Checks"
    },
    {
      "name": "Sentinel"
    },
    {
      "name": "Azure Firewall"
    }
  ],
  "status": [
    {
      "name": "Not verified",
      "description": "This check has not been looked at yet"
    },
    {
      "name": "Open",
      "description": "There is an action item associated to this check"
    },
    {
      "name": "Fulfilled",
      "description": "This check has been verified, and there are no further action items associated to it"
    },
    {
      "name": "Not required",
      "description": "Recommendation understood, but not needed by current requirements"
    },
    {
      "name": "N/A",
      "description": "Not applicable for current design"
    }
  ],
  "severities": [
    {
      "name": "High"
    },
    {
      "name": "Medium"
    },
    {
      "name": "Low"
    }
  ],
  "metadata": {
    "name": "Azure Security Review Checklist",
    "state": "Preview",
    "timestamp": "Feb 13, 2023"
  }
}

checklists/sap_checklist.pt.json METASEP
{
  "items": [
    {
      "category": "Identidade e Acesso",
      "subcategory": "Identidade",
      "text": "Imponha um modelo RBAC para grupos de gerenciamento, assinaturas, grupos de recursos e recursos",
      "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
      "severity": "Alto",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
    },
    {
      "category": "Identidade e Acesso",
      "subcategory": "Identidade",
      "text": "Imponha propogação de princípio para o encaminhamento da identidade do aplicativo de nuvem SAP para SAP no local (Incluindo IaaS) através do conector de nuvem",
      "guid": "45911475-e39e-4530-accc-d979366bcda2",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/"
    },
    {
      "category": "Identidade e Acesso",
      "subcategory": "Identidade",
      "text": "Implemente o Single Sign on (SSO) usando o Azure Active Directory ou o Active Directory Federation Services (AD FS) para que os usuários finais condam o nécto aos aplicativos SAP, sempre que possível.",
      "guid": "750ab-039d-495d-94c7-c8929cb107d5",
      "severity": "Alto",
      "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/"
    },
    {
      "category": "Identidade e Acesso",
      "subcategory": "Identidade",
      "text": "Se o SuccessFactor for usado como aplicativo HCM, aproveite o recurso automatizado de provisionamento do usuário para o Azure AD.",
      "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
      "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial"
    },
    {
      "category": "Identidade e Acesso",
      "subcategory": "Identidade",
      "text": "Aplicativos web baseados em SSO para SAP Netweaver como Fiori, webgui etc. podem ser implementados usando SAML",
      "guid": "f7c95f06-e154-4e3a-a359-2829e6e20617",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
      "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure"
    },
    {
      "category": "Identidade e Acesso",
      "subcategory": "Identidade",
      "text": "O SSO para SAP GUI pode ser implementado usando o SAP SSO ou uma solução de terceiros",
      "guid": "3686af46-791f-4893-9ada-43324e138115",
      "severity": "Alto",
      "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
      "link": "https://learn.microsoft.com/azure/active-directory-b2c/user-overview"
    },
    {
      "category": "Identidade e Acesso",
      "subcategory": "Identidade",
      "text": "Aplicativos SSO para SAP SaaS como SAP Analytics Cloud, SAP Cloud Platform, SAP Cloud Platform IAS e SAP C4C com AZure AD podem ser implementados usando SAML",
      "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
      "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal"
    },
    {
      "category": "Identidade e Acesso",
      "subcategory": "Identidade",
      "text": "&nbsp",
      "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access"
    },
    {
      "category": "Identidade e Acesso",
      "subcategory": "Identidade",
      "text": "&nbsp",
      "guid": "16785d6f-a96c-496a-b885-18f482734c88",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
      "link": "https://azure.microsoft.com/resources/achieving-compliant-data-residency-and-security-with-azure/"
    },
    {
      "category": "Grupo de Gestão e Assinaturas",
      "subcategory": "Assinaturas",
      "text": "aplicar as políticas existentes do Grupo de Gerenciamento para assinaturas SAP",
      "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Grupo de Gestão e Assinaturas",
      "subcategory": "Assinaturas",
      "text": "enfore aplicativos intimamente acoplado na mesma assinatura SAP para evitar roteamento adicional e complexidade de gerenciamento",
      "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/resource-tagging/?toc=/azure/azure-resource-manager/management/toc.json"
    },
    {
      "category": "Grupo de Gestão e Assinaturas",
      "subcategory": "Assinaturas",
      "text": "Aproveite a Suscription como unidade de escala e dimensione nossos recursos, considere implantar a assinatura por ambiente, por exemplo. Sandbox, não-prod, prod ",
      "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Grupo de Gestão e Assinaturas",
      "subcategory": "Assinaturas",
      "text": "Garanta o aumento do contingente como parte do provisionamento de subscrição (por exemplo, núcleos VM totais disponíveis dentro de uma assinatura).",
      "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Grupo de Gestão e Assinaturas",
      "subcategory": "Assinaturas",
      "text": "Certifique-se de que os serviços e recursos necessários estejam disponíveis nas regiões de implantação escolhidas, por exemplo. ANF, Zona etc.",
      "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Grupo de Gestão e Assinaturas",
      "subcategory": "Assinaturas",
      "text": "Aproveite a etiqueta de recursos do Azure para categorização de custos e agrupamento de recursos (: BillTo, Departamento (ou Unidade de Negócios), Ambiente (Produção, Estágio, Desenvolvimento), Nível (Nível Web, Nível de Aplicação), Proprietário de Aplicativos, ProjectName)",
      "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Grupo de Gestão e Assinaturas",
      "subcategory": "Assinaturas",
      "text": "&nbsp",
      "guid": "7d474317-6c8b-4cbf-95bb-e609d8a03e97",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Grupo de Gestão e Assinaturas",
      "subcategory": "Assinaturas",
      "text": "&nbsp",
      "guid": "778424d6-1678-45d6-ba96-c96ad88518f4",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Topologia e Conectividade de Rede",
      "subcategory": "Plano IP",
      "text": "A atribuição de I.P pública para VM executando a carga de trabalho SAP não é recomendada.",
      "guid": "82734c88-6ba2-4802-8459-11475e39e530",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing"
    },
    {
      "category": "Topologia e Conectividade de Rede",
      "subcategory": "Plano IP",
      "text": "Considere reservar endereço I.P no lado DR ao configurar ASR",
      "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing"
    },
    {
      "category": "Topologia e Conectividade de Rede",
      "subcategory": "Plano IP",
      "text": "Evite usar faixas de endereço IP sobrepostas para locais de produção e DR.",
      "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances"
    },
    {
      "category": "Topologia e Conectividade de Rede",
      "subcategory": "Plano IP",
      "text": "Certifique-se de que o Networking Accelarated esteja habilitado para todos os VM quando for aplicável.",
      "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances"
    },
    {
      "category": "Topologia e Conectividade de Rede",
      "subcategory": "Híbrido",
      "text": "Os pares VNet locais e globais fornecem conectividade e são as abordagens preferidas para garantir conectividade entre zonas de pouso para implantações SAP em várias regiões do Azure",
      "guid": "a3592829-e6e2-4061-9368-6af46791f893",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
      "link": "https://learn.microsoft.com/azure/networking/"
    },
    {
      "category": "Topologia e Conectividade de Rede",
      "subcategory": "Paas",
      "text": "Use um firewall de aplicativo web para digitalizar seu tráfego quando ele estiver exposto à internet. Outra opção é usá-lo com seu balanceador de carga ou com recursos que tenham recursos de firewall incorporados, como o Application Gateway ou soluções de terceiros.",
      "guid": "5ada4332-4e13-4811-9231-81aa41742694",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
      "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services"
    },
    {
      "category": "Topologia e Conectividade de Rede",
      "subcategory": "Paas",
      "text": "Certifique-se de que as implantações internas do Balanceador de Carga do Azure estejam configuradas para usar DSR (Direct Server Return, retorno do servidor direto) para configuração HA na camada DBMS",
      "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
      "severity": "Média"
    },
    {
      "category": "Topologia e Conectividade de Rede",
      "subcategory": "Internet",
      "text": "Use o Firewall Azure para governar o tráfego de saída do Azure para a internet, conexões de entrada não-HTTP/S e filtragem de tráfego Leste/Oeste (se a organização exigir)",
      "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
      "link": "https://learn.microsoft.com/azure/app-service/networking-features"
    },
    {
      "category": "Topologia e Conectividade de Rede",
      "subcategory": "Internet",
      "text": "Use o despachante SAP Web ou serviço de terceiros como o NetScaler em conjucção com o gateway do aplicativo, se necessário, para superar a limitação reversa do proxy para aplicativos web SAP.",
      "guid": "d88518f4-8273-44c8-a6ba-280214591147",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/firewall/"
    },
    {
      "category": "Topologia e Conectividade de Rede",
      "subcategory": "Internet",
      "text": "Use as políticas Azure Front Door e WAF para fornecer proteção global em todas as regiões do Azure para conexões HTTP/S de entrada a uma zona de pouso.",
      "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview"
    },
    {
      "category": "Topologia e Conectividade de Rede",
      "subcategory": "Internet",
      "text": "Ao usar o Azure Front Door e o Azure Application Gateway para ajudar a proteger aplicativos HTTP/S, use as políticas WAF no Azure Front Door. Bloqueie o Portal de Aplicativos Azure para receber tráfego apenas a partir da Porta da Frente do Azure.",
      "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview"
    },
    {
      "category": "Topologia e Conectividade de Rede",
      "subcategory": "Entrega de aplicativos",
      "text": "Para uma entrega segura de aplicativos HTTP/S, use o Application Gateway v2 e garanta que a proteção e as políticas do WAF estejam ativadas.",
      "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview"
    },
    {
      "category": "Topologia e Conectividade de Rede",
      "subcategory": "Segmentação",
      "text": "Se os arquivos do Azure NetApp forem usados para implantação sap, certifique-se de que apenas uma sub-rede de delegados pode existir em uma Vnet para Azure NetAppFiles",
      "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/organize-resources?tabs=AzureManagementGroupsAndHierarchy"
    },
    {
      "category": "Topologia e Conectividade de Rede",
      "subcategory": "Segmentação",
      "text": "Use NSGs e grupos de segurança de aplicativos para tráfego de microsegmentar dentro da camada de aplicativos SAP, como sub-rede de aplicativos, sub-rede DB e sub-rede web etc.",
      "guid": "6791f893-5ada-4433-84e1-3811523181aa",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works"
    },
    {
      "category": "Topologia e Conectividade de Rede",
      "subcategory": "Segmentação",
      "text": "Ele não é suportado para implantar qualquer NVA entre o aplicativo SAP e o servidor SAP Database",
      "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works"
    },
    {
      "category": "Topologia e Conectividade de Rede",
      "subcategory": "Segmentação",
      "text": "A colocação da camada de aplicativo SAP e do SAP DBMS em diferentes VNets Azure que não são espiadas não é suportada",
      "guid": "45bbe609-d8a0-43e9-9778-424d616785d6"
    },
    {
      "category": "Topologia e Conectividade de Rede",
      "subcategory": "Segmentação",
      "text": "Para obter uma latência de rede ideal com aplicativos SAP, considere usar grupos de colocação de proximidade do Azure.",
      "guid": "fa96c96a-d885-418f-9827-34c886ba2802"
    },
    {
      "category": "Gestão e Monitoramento",
      "subcategory": "Monitorização",
      "text": "Use o SAP Solution Manager e o Azure Monitor for SAP Solutions para monitorar o SAP HANA, clusters SUSE de alta disponibilidade e sistemas SQL",
      "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
      "severity": "Média"
    },
    {
      "category": "Gestão e Monitoramento",
      "subcategory": "Monitorização",
      "text": "Execute uma extensão VM para verificação SAP. A VM Extension for SAP usa a identidade gerenciada atribuída de uma máquina virtual para acessar dados de monitoramento e configuração de VM.",
      "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "Gestão e Monitoramento",
      "subcategory": "Monitorização",
      "text": "Use a Política Azure para relatórios de controle de acesso e conformidade. A Política Azure fornece a capacidade de impor configurações em toda a organização para garantir a adesão consistente à política e a rápida detecção de violações. ",
      "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "Gestão e Monitoramento",
      "subcategory": "Monitorização",
      "text": "Proteja seu banco de dados HANA com o serviço Azure Backup. Se você implantar os Arquivos do Azure NetApp (ANF) para o seu banco de dados HANA, use a ferramenta Azure Application Consistent Snapshot (AzAcSnap) para tirar instantâneos consistentes com aplicativos",
      "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
      "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create"
    },
    {
      "category": "Gestão e Monitoramento",
      "subcategory": "Monitorização",
      "text": "Realize uma verificação de qualidade para SAP HANA na infraestrutura do Azure provisionada para verificar se os VMs provisionados estão em conformidade com o SAP HANA sobre as melhores práticas do Azure.",
      "guid": "73686af4-6791-4f89-95ad-a43324e13811",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
      "link": "https://learn.microsoft.com/azure/automation/update-management/overview"
    },
    {
      "category": "Gestão e Monitoramento",
      "subcategory": "Monitorização",
      "text": "Use o Network Watcher Connection Monitor para monitorar as métricas de latência do servidor de banco de dados e aplicativos SAP ou coletar e exibir medições de latência da rede com o Azure Monitor.",
      "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
      "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview"
    },
    {
      "category": "Gestão e Monitoramento",
      "subcategory": "Monitorização",
      "text": "Otimize e gerencie as operações do SAP Base usando o SAP Landscape Management (LaMa). Use o conector SAP LaMa para o Azure para realocar, copiar, clonar e atualizar sistemas SAP.",
      "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
      "severity": "Média",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
      "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json"
    },
    {
      "category": "Gestão e Monitoramento",
      "subcategory": "Monitorização",
      "text": "Para cada assinatura do Azure, execute um teste de latência da Zona de Disponibilidade do Azure antes da implantação zonal para escolher zonas de baixa latência para SAP na implantação do Azure.",
      "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Gestão e Monitoramento",
      "subcategory": "Monitorização",
      "text": "Implementar proteção contra ameaças para SAP com o Microsoft Sentinel.",
      "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard"
    },
    {
      "category": "Gestão e Monitoramento",
      "subcategory": "Monitorização",
      "text": "A aplicação da configuração do gerenciamento de atualizações por meio da política garante que todos os VMs sejam incluídos no regime de gerenciamento de patches, fornece às equipes de aplicativos a capacidade de gerenciar a implantação de patches para seus VMs e fornece recursos de visibilidade e execução de TI central em todos os VMs",
      "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "Gestão e Monitoramento",
      "subcategory": "Monitorização",
      "text": "Habilite os insights de VM para as cargas de trabalho SAP em execução da VM.",
      "guid": "c486ba28-0dc0-4591-af65-de8e1309cccd",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor"
    },
    {
      "category": "Gestão e Monitoramento",
      "subcategory": "Monitorização",
      "text": "A marcação do Azure pode ser aproveitada para agrupar e rastrear logicamente recursos, automatizar suas implantações e, o mais importante, fornecer visibilidade sobre os custos incorridos.",
      "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery"
    },
    {
      "category": "Gestão e Monitoramento",
      "subcategory": "Monitorização",
      "text": "&nbsp",
      "guid": "4919cb1b-3d13-425a-b124-ba34df685edd",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/backup/backup-center-overview"
    },
    {
      "category": "Segurança, Governança e Compliance",
      "subcategory": "Segredos",
      "text": "Use o Azure Key Vault para armazenar seus segredos e credenciais",
      "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/key-vault/general/overview"
    },
    {
      "category": "Segurança, Governança e Compliance",
      "subcategory": "Segredos",
      "text": "Recomenda-se bloquear a implantação pós-sucesso do Azure Resources para proteger contra alterações não autorizadas",
      "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling"
    },
    {
      "category": "Segurança, Governança e Compliance",
      "subcategory": "Segredos",
      "text": "Provision Azure Key Vault com as políticas de exclusão e eliminação suaves habilitadas para permitir proteção de retenção para objetos excluídos.",
      "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Segurança, Governança e Compliance",
      "subcategory": "Segredos",
      "text": "Com base nos requisitos existentes, controles regulatórios e de conformidade (internos/externos) - Determine quais são necessárias as Políticas Azure e o papel do Azure RBAC",
      "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Segurança, Governança e Compliance",
      "subcategory": "Segredos",
      "text": "Quando você habilitar o Microsoft Defender for Cloud Standard para SAP, certifique-se de excluir os servidores de banco de dados SAP de qualquer política que instale proteção de ponto final.",
      "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Segurança, Governança e Compliance",
      "subcategory": "Segredos",
      "text": "Delegue um papel personalizado de administração SAP com acesso just-in-time.",
      "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Segurança, Governança e Compliance",
      "subcategory": "Segredos",
      "text": "criptografar dados em trânsito integrando o produto de segurança de terceiros com comunicações seguras de rede (SNC) para DIAG (SAP GUI), RFC e SPNEGO para HTTPS",
      "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Segurança, Governança e Compliance",
      "subcategory": "Segredos",
      "text": "O Azure Active Directory (Azure AD) com o SAML 2.0 também pode fornecer SSO para uma gama de aplicativos e plataformas SAP como SAP NetWeaver, SAP HANA e a PLATAFORMA SAP Cloud",
      "guid": "55d04c3c-4919-4cb1-a3d1-325ae124ba34",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Segurança, Governança e Compliance",
      "subcategory": "Segredos",
      "text": "Certifique-se de endurecer o sistema operacional para erradicar vulnerabilidades que podem levar a ataques no banco de dados SAP.",
      "guid": "df685edd-ce9b-4d3b-a0cd-b3b55eb2ec14",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Segurança, Governança e Compliance",
      "subcategory": "Segredos",
      "text": "Padrão para as chaves gerenciadas pela Microsoft para a funcionalidade principal de criptografia e use chaves gerenciadas pelo cliente quando necessário.",
      "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Segurança, Governança e Compliance",
      "subcategory": "Segredos",
      "text": "Use um Cofre de Chave Azure por aplicativo por ambiente por região.",
      "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Segurança, Governança e Compliance",
      "subcategory": "Segredos",
      "text": "&nbsp",
      "guid": "5833fb4a-e3c2-4df7-9316-5c3acbe05bbe",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Segurança, Governança e Compliance",
      "subcategory": "Governança",
      "text": "Personalize funções de controle de acesso baseado em papel (RBAC) para assinaturas de voz SAP no Azure para evitar alterações acidentais relacionadas à rede",
      "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Segurança, Governança e Compliance",
      "subcategory": "Governança",
      "text": "Isole DMZs e NVAs do resto da propriedade SAP, configure o Azure Private Link e gerencie e controle com segurança o SAP sobre os recursos do Azure",
      "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Segurança, Governança e Compliance",
      "subcategory": "Governança",
      "text": "Para criptografia de servidor de banco de dados SAP, use a tecnologia de criptografia nativa SAP HANA. Se você estiver usando o Azure SQL Database, use O TDE (Transparent Data Encryption, criptografia de dados transparente) oferecido pelo provedor DBMS para proteger seus dados e registrar arquivos e garantir que os backups também sejam criptografados.",
      "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Segurança, Governança e Compliance",
      "subcategory": "Governança",
      "text": "A criptografia de armazenamento do Azure é ativada por padrão",
      "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Segurança, Governança e Compliance",
      "subcategory": "Governança",
      "text": "&nbsp",
      "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Segurança, Governança e Compliance",
      "subcategory": "Governança",
      "text": "&nbsp",
      "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Continuidade de Negócios e Recuperação de Desastres",
      "subcategory": "&nbsp",
      "text": "Não combine o cluster ASCS e o database em VM único/mesmo",
      "guid": "aff6691b-4935-4ada-9222-3ece81b12318",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports"
    },
    {
      "category": "Continuidade de Negócios e Recuperação de Desastres",
      "subcategory": "&nbsp",
      "text": "Certifique-se de que o IP flutuante está ativado no balanceador de carga",
      "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-data-export?tabs=portal"
    },
    {
      "category": "Continuidade de Negócios e Recuperação de Desastres",
      "subcategory": "&nbsp",
      "text": "Não misture servidores de diferentes funções no mesmo conjunto de disponibilidade. Mantenha VMs de serviços centrais, VMs de banco de dados, VMs de aplicativos em seus próprios conjuntos de disponibilidade",
      "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/security-center/"
    },
    {
      "category": "Continuidade de Negócios e Recuperação de Desastres",
      "subcategory": "&nbsp",
      "text": "Use um grupo de colocação de proximidade por SAP SID. Grupos não se estendem por zonas de disponibilidade ou regiões do Azure",
      "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/security-center/"
    },
    {
      "category": "Continuidade de Negócios e Recuperação de Desastres",
      "subcategory": "&nbsp",
      "text": "Atualmente, o Azure não suporta a combinação de ASCS e db HA no mesmo cluster Linux Pacemaker; separá-los em aglomerados individuais. No entanto, você pode combinar até cinco vários clusters de serviços centrais em um par de VMs.",
      "guid": "80dc0591-cf65-4de8-b130-9cccd579266b",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "Continuidade de Negócios e Recuperação de Desastres",
      "subcategory": "&nbsp",
      "text": "Use um SKU balanceador de carga padrão na frente de clusters ASCS e DB",
      "guid": "cca275fa-a1ab-4fe9-b55d-04c3c4919cb1",
      "severity": "Média",
      "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response"
    },
    {
      "category": "Continuidade de Negócios e Recuperação de Desastres",
      "subcategory": "&nbsp",
      "text": "Ambos os VMs no par HA devem ser implantados em um conjunto de disponibilidade, ou zonas de disponibilidade devem ter o mesmo tamanho e ter a mesma configuração de armazenamento",
      "guid": "b3d1325a-e124-4ba3-9df6-85eddce9bd3b",
      "severity": "Média",
      "link": "https://www.microsoft.com/itshowcase/implementing-a-zero-trust-security-model-at-microsoft"
    },
    {
      "category": "Continuidade de Negócios e Recuperação de Desastres",
      "subcategory": "&nbsp",
      "text": "A tecnologia nativa de replicação do banco de dados deve ser usada para sincronizar o banco de dados em um par HA.",
      "guid": "b0cdb3b5-5eb2-4ec1-9eea-a3592829e2ed",
      "severity": "Média",
      "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response"
    },
    {
      "category": "Continuidade de Negócios e Recuperação de Desastres",
      "subcategory": "&nbsp",
      "text": "Realize uma recuperação pontual para seus bancos de dados de produção a qualquer momento e em um período de tempo que atenda ao seu RTO; a recuperação point-in-time normalmente inclui erros do operador excluindo dados na camada DBMS ou através do SAP, aliás",
      "guid": "b2173676-aff6-4691-a493-5ada42223ece",
      "severity": "Média",
      "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response"
    },
    {
      "category": "Continuidade de Negócios e Recuperação de Desastres",
      "subcategory": "&nbsp",
      "text": "O CIDR para a rede virtual primária (VNet) não deve entrar em conflito ou se sobrepor com o CIDR do Vnet do site DR",
      "guid": "81b12318-1a54-4174-8583-3fb4ae3c2df7"
    },
    {
      "category": "Continuidade de Negócios e Recuperação de Desastres",
      "subcategory": "&nbsp",
      "text": "Use a Recuperação do Site para replicar um servidor de aplicativo em um site dr. A recuperação do site também pode ajudar na replicação de VMs de cluster de serviços centrais para o site da DR. Quando você invocar DR, você precisará reconfigurar o cluster Linux Pacemaker no site DR (por exemplo, substituir o VIP ou SBD, executar corosync.conf e muito mais).",
      "guid": "43165c3a-cbe0-45bb-b209-d490da477784"
    },
    {
      "category": "Continuidade de Negócios e Recuperação de Desastres",
      "subcategory": "&nbsp",
      "text": "A replicação nativa do banco de dados deve ser usada para sincronizar dados com o site DR, em vez de recuperação do local do Azure",
      "guid": "24d11678-5d2f-4a56-a56a-d48408fe7273"
    },
    {
      "category": "Continuidade de Negócios e Recuperação de Desastres",
      "subcategory": "&nbsp",
      "text": "&nbsp",
      "guid": "4c486ba2-80dc-4059-8cf6-5de8e1309ccc"
    },
    {
      "category": "Armazenamento",
      "subcategory": "&nbsp",
      "text": "Disque-de-disco para Oracle, SQL, HANA",
      "guid": "d579266b-cca2-475f-aa1a-bfe9d55d04c3"
    },
    {
      "category": "Checlistas",
      "subcategory": "&nbsp",
      "text": "&nbsp",
      "guid": "c4919cb1-b3d1-4325-ae12-4ba34df685ed"
    },
    {
      "category": "Calcular",
      "subcategory": "&nbsp",
      "text": "SEIVA ",
      "guid": "dce9bd3b-b0cd-4b3b-95eb-2ec14eeaa359"
    },
    {
      "category": "Calcular",
      "subcategory": "&nbsp",
      "text": "Faça pedidos de cotas para VM SKU e Zonas corretas",
      "guid": "2829e2ed-b217-4367-9aff-6691b4935ada",
      "severity": "Média"
    }
  ],
  "categories": [
    {
      "name": "Identidade e Acesso"
    },
    {
      "name": "Topologia e Conectividade de Rede"
    },
    {
      "name": "Segurança, Governança e Compliance"
    },
    {
      "name": "Gestão e Monitoramento"
    },
    {
      "name": "Grupo de Gestão e Assinaturas"
    }
  ],
  "status": [
    {
      "name": "Não verificado"
    },
    {
      "name": "Abrir"
    },
    {
      "name": "Cumprido"
    },
    {
      "name": "N/A"
    }
  ],
  "metadata": {
    "name": "Revisão da zona de desembarque do Azure"
  },
  "severities": [
    {
      "name": "Alto"
    },
    {
      "name": "Média"
    },
    {
      "name": "Baixo"
    }
  ]
}

checklists/sap_checklist.ko.json METASEP
{
  "items": [
    {
      "category": "ID 및 액세스",
      "subcategory": "신원",
      "text": "관리 그룹, 구독, 리소스 그룹 및 리소스에 대한 RBAC 모델 적용",
      "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
      "severity": "높다",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
    },
    {
      "category": "ID 및 액세스",
      "subcategory": "신원",
      "text": "클라우드 커넥터를 통해 SAP 클라우드 애플리케이션에서 SAP 온프레미스(IaaS 포함)로 ID를 전달하기 위한 원칙 전파 적용",
      "guid": "45911475-e39e-4530-accc-d979366bcda2",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/"
    },
    {
      "category": "ID 및 액세스",
      "subcategory": "신원",
      "text": "Azure Active Directory 또는 AD FS(Active Directory Federation Services)를 사용하여 SSO(Single Signon)를 구현하여 최종 사용자가 가능한 경우 SAP 응용 프로그램에 연결할 수 있도록 합니다.",
      "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
      "severity": "높다",
      "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/"
    },
    {
      "category": "ID 및 액세스",
      "subcategory": "신원",
      "text": "SuccessFactor가 HCM 응용 프로그램으로 사용되는 경우 자동화된 사용자 프로비저닝 기능을 Azure AD에 활용합니다.",
      "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
      "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial"
    },
    {
      "category": "ID 및 액세스",
      "subcategory": "신원",
      "text": "SSO는 피오리, 웹GUI 등과 같은 SAP Netweaver 기반 웹 응용 프로그램을 SAML을 사용하여 구현할 수 있습니다.",
      "guid": "f7c95f06-e154-4e3a-a359-2829e6e20617",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
      "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure"
    },
    {
      "category": "ID 및 액세스",
      "subcategory": "신원",
      "text": "SAP GUI에 대한 SSO는 SAP SSO 또는 제 3 자 솔루션을 사용하여 구현할 수 있습니다.",
      "guid": "3686af46-791f-4893-9ada-43324e138115",
      "severity": "높다",
      "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
      "link": "https://learn.microsoft.com/azure/active-directory-b2c/user-overview"
    },
    {
      "category": "ID 및 액세스",
      "subcategory": "신원",
      "text": "SAP Analytics Cloud, SAP Cloud Platform, SAP Cloud Platform IAS 및 SAP C4C와 Azure AD와 같은 SAP SaaS 애플리케이션에 대한 SSO는 SAML을 사용하여 구현할 수 있습니다.",
      "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
      "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal"
    },
    {
      "category": "ID 및 액세스",
      "subcategory": "신원",
      "text": "&nbsp",
      "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access"
    },
    {
      "category": "ID 및 액세스",
      "subcategory": "신원",
      "text": "&nbsp",
      "guid": "16785d6f-a96c-496a-b885-18f482734c88",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
      "link": "https://azure.microsoft.com/resources/achieving-compliant-data-residency-and-security-with-azure/"
    },
    {
      "category": "관리 그룹 및 구독",
      "subcategory": "구독",
      "text": "SAP 구독에 기존 관리 그룹 정책 적용",
      "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "관리 그룹 및 구독",
      "subcategory": "구독",
      "text": "추가 라우팅 및 관리 복잡성을 피하기 위해 동일한 SAP 구독에 밀접하게 결합 된 응용 프로그램을 미리 준비하십시오.",
      "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/resource-tagging/?toc=/azure/azure-resource-manager/management/toc.json"
    },
    {
      "category": "관리 그룹 및 구독",
      "subcategory": "구독",
      "text": "Suscription을 확장 단위로 활용하고 리소스를 확장하면 환경별로 구독을 배포하는 것이 좋습니다. 샌드 박스, 비 prod, prod ",
      "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "관리 그룹 및 구독",
      "subcategory": "구독",
      "text": "구독 프로비저닝의 일부로 할당량이 증가하는지 확인합니다(예: 구독 내에서 사용 가능한 총 VM 코어).",
      "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "관리 그룹 및 구독",
      "subcategory": "구독",
      "text": "필요한 서비스 및 기능을 선택한 배포 지역 내에서 사용할 수 있는지 확인합니다(예: ANF, 구역 등",
      "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "관리 그룹 및 구독",
      "subcategory": "구독",
      "text": "비용 분류 및 리소스 그룹화에 Azure 리소스 태그 활용(: BillTo, 부서(또는 비즈니스 단위), 환경(프로덕션, 단계, 개발), 계층(웹 계층, 응용 프로그램 계층), 응용 프로그램 소유자, 프로젝트 이름)",
      "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "관리 그룹 및 구독",
      "subcategory": "구독",
      "text": "&nbsp",
      "guid": "7d474317-6c8b-4cbf-95bb-e609d8a03e97",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "관리 그룹 및 구독",
      "subcategory": "구독",
      "text": "&nbsp",
      "guid": "778424d6-1678-45d6-ba96-c96ad88518f4",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "네트워크 토폴로지 및 연결",
      "subcategory": "IP 계획",
      "text": "SAP 워크로드를 실행하는 VM에 대한 공용 I.P 할당은 권장되지 않습니다.",
      "guid": "82734c88-6ba2-4802-8459-11475e39e530",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing"
    },
    {
      "category": "네트워크 토폴로지 및 연결",
      "subcategory": "IP 계획",
      "text": "ASR을 구성할 때 DR 측에서 I.P 주소를 예약하는 것이 좋습니다.",
      "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing"
    },
    {
      "category": "네트워크 토폴로지 및 연결",
      "subcategory": "IP 계획",
      "text": "프로덕션 및 DR 사이트에 겹치는 IP 주소 범위를 사용하지 마십시오.",
      "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances"
    },
    {
      "category": "네트워크 토폴로지 및 연결",
      "subcategory": "IP 계획",
      "text": "적용 가능한 모든 VM에 대해 가속 네트워킹이 사용하도록 설정되어 있는지 확인합니다.",
      "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances"
    },
    {
      "category": "네트워크 토폴로지 및 연결",
      "subcategory": "잡종",
      "text": "로컬 및 글로벌 VNet 피어링은 연결을 제공하며 여러 Azure 지역에 걸쳐 SAP 배포를 위한 방문 영역 간의 연결을 보장하기 위해 선호되는 접근 방식입니다.",
      "guid": "a3592829-e6e2-4061-9368-6af46791f893",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
      "link": "https://learn.microsoft.com/azure/networking/"
    },
    {
      "category": "네트워크 토폴로지 및 연결",
      "subcategory": "파아스",
      "text": "웹 응용 프로그램 방화벽을 사용하여 트래픽이 인터넷에 노출되었을 때 트래픽을 검사합니다. 또 다른 옵션은 부하 분산 장치 또는 응용 프로그램 게이트웨이 또는 타사 솔루션과 같은 기본 제공 방화벽 기능이 있는 리소스와 함께 사용하는 것입니다.",
      "guid": "5ada4332-4e13-4811-9231-81aa41742694",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
      "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services"
    },
    {
      "category": "네트워크 토폴로지 및 연결",
      "subcategory": "파아스",
      "text": "Azure 부하 분산 장치에 대한 내부 배포가 DBMS 계층의 HA 구성에 DSR(직접 서버 반환)을 사용하도록 설정되어 있는지 확인합니다.",
      "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
      "severity": "보통"
    },
    {
      "category": "네트워크 토폴로지 및 연결",
      "subcategory": "인터넷",
      "text": "Azure 방화벽을 사용하여 인터넷에 대한 Azure 아웃바운드 트래픽, HTTP/S 인바운드 연결이 아닌 연결 및 동부/서부 트래픽 필터링(조직에서 요구하는 경우)을 제어합니다.",
      "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
      "link": "https://learn.microsoft.com/azure/app-service/networking-features"
    },
    {
      "category": "네트워크 토폴로지 및 연결",
      "subcategory": "인터넷",
      "text": "SAP 웹 디스패처 또는 NetScaler와 같은 타사 서비스를 필요한 경우 응용 프로그램 게이트웨이와 연결하여 SAP 웹 앱에 대한 역방향 프록시 제한을 극복하십시오.",
      "guid": "d88518f4-8273-44c8-a6ba-280214591147",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/firewall/"
    },
    {
      "category": "네트워크 토폴로지 및 연결",
      "subcategory": "인터넷",
      "text": "Azure Front Door 및 WAF 정책을 사용하여 방문 영역에 대한 인바운드 HTTP/S 연결에 대해 Azure 지역 전체에서 전역 보호를 제공합니다.",
      "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview"
    },
    {
      "category": "네트워크 토폴로지 및 연결",
      "subcategory": "인터넷",
      "text": "Azure Front Door 및 Azure Application Gateway를 사용하여 HTTP/S 앱을 보호하는 경우 Azure Front Door에서 WAF 정책을 사용합니다. Azure 응용 프로그램 게이트웨이를 잠궈 Azure 프런트 도어에서만 트래픽을 받습니다.",
      "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview"
    },
    {
      "category": "네트워크 토폴로지 및 연결",
      "subcategory": "앱 배달",
      "text": "HTTP/S 앱을 안전하게 전달하려면 애플리케이션 게이트웨이 v2를 사용하고 WAF 보호 및 정책이 사용하도록 설정되어 있는지 확인합니다.",
      "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview"
    },
    {
      "category": "네트워크 토폴로지 및 연결",
      "subcategory": "세분화",
      "text": "SAP 배포에 Azure NetApp 파일을 사용하는 경우 Azure NetAppFiles용 Vnet에 하나의 대리자 서브넷만 존재할 수 있는지 확인합니다.",
      "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/organize-resources?tabs=AzureManagementGroupsAndHierarchy"
    },
    {
      "category": "네트워크 토폴로지 및 연결",
      "subcategory": "세분화",
      "text": "NSG 및 애플리케이션 보안 그룹을 사용하여 앱 서브넷, DB 서브넷 및 웹 서브넷 등과 같은 SAP 애플리케이션 계층 내의 트래픽을 마이크로 세그먼트화합니다.",
      "guid": "6791f893-5ada-4433-84e1-3811523181aa",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works"
    },
    {
      "category": "네트워크 토폴로지 및 연결",
      "subcategory": "세분화",
      "text": "SAP 응용 프로그램과 SAP 데이터베이스 서버 간에 NVA를 배포하는 것은 지원되지 않습니다.",
      "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works"
    },
    {
      "category": "네트워크 토폴로지 및 연결",
      "subcategory": "세분화",
      "text": "SAP 응용 프로그램 계층 및 SAP DBMS를 피어링되지 않은 다른 Azure VNet에 배치하는 것은 지원되지 않습니다.",
      "guid": "45bbe609-d8a0-43e9-9778-424d616785d6"
    },
    {
      "category": "네트워크 토폴로지 및 연결",
      "subcategory": "세분화",
      "text": "SAP 응용 프로그램을 사용한 네트워크 대기 시간을 최적화하려면 Azure 근접 배치 그룹을 사용하는 것이 좋습니다.",
      "guid": "fa96c96a-d885-418f-9827-34c886ba2802"
    },
    {
      "category": "관리 및 모니터링",
      "subcategory": "모니터링",
      "text": "SAP 솔루션용 SAP 솔루션 관리자 및 Azure 모니터를 사용하여 SAP HANA, 고가용성 SUSE 클러스터 및 SQL 시스템을 모니터링합니다.",
      "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
      "severity": "보통"
    },
    {
      "category": "관리 및 모니터링",
      "subcategory": "모니터링",
      "text": "SAP 검사를 위해 VM 확장을 실행합니다. SAP용 VM 확장은 가상 머신의 할당된 관리 ID를 사용하여 VM 모니터링 및 구성 데이터에 액세스합니다.",
      "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "관리 및 모니터링",
      "subcategory": "모니터링",
      "text": "액세스 제어 및 규정 준수 보고에 Azure 정책을 사용합니다. Azure Policy는 일관된 정책 준수와 빠른 위반 감지를 보장하기 위해 조직 전체 설정을 적용하는 기능을 제공합니다. ",
      "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "관리 및 모니터링",
      "subcategory": "모니터링",
      "text": "Azure 백업 서비스를 사용하여 HANA 데이터베이스를 보호합니다. HANA 데이터베이스에 대해 Azure ANF(NetApp 파일)를 배포하는 경우 Azure 응용 프로그램 일관된 스냅숏 도구(AzAcSnap)를 사용하여 응용 프로그램 일관된 스냅숏을 만듭니다.",
      "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
      "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create"
    },
    {
      "category": "관리 및 모니터링",
      "subcategory": "모니터링",
      "text": "프로비전된 Azure 인프라에서 SAP HANA에 대한 품질 검사를 수행하여 프로비전된 VM이 Azure 모범 사례에서 SAP HANA를 준수하는지 확인합니다.",
      "guid": "73686af4-6791-4f89-95ad-a43324e13811",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
      "link": "https://learn.microsoft.com/azure/automation/update-management/overview"
    },
    {
      "category": "관리 및 모니터링",
      "subcategory": "모니터링",
      "text": "네트워크 감시자 연결 모니터를 사용하여 SAP 데이터베이스 및 응용 프로그램 서버 대기 시간 메트릭을 모니터링하거나 Azure Monitor를 사용하여 네트워크 대기 시간 측정값을 수집 및 표시합니다.",
      "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
      "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview"
    },
    {
      "category": "관리 및 모니터링",
      "subcategory": "모니터링",
      "text": "SAP Landscape Management (LaMa)를 사용하여 SAP Basis 운영을 최적화하고 관리합니다. Azure용 SAP LaMa 커넥터를 사용하여 SAP 시스템을 재배치, 복사, 복제 및 새로 고칩니다.",
      "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
      "severity": "보통",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
      "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json"
    },
    {
      "category": "관리 및 모니터링",
      "subcategory": "모니터링",
      "text": "각 Azure 구독에 대해 영역 배포 전에 Azure 가용성 영역 대기 시간 테스트를 실행하여 Azure 배포에서 SAP에 대해 대기 시간이 짧은 영역을 선택합니다.",
      "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "관리 및 모니터링",
      "subcategory": "모니터링",
      "text": "Microsoft Sentinel을 사용하여 SAP에 대한 위협 보호를 구현합니다.",
      "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard"
    },
    {
      "category": "관리 및 모니터링",
      "subcategory": "모니터링",
      "text": "정책을 통해 업데이트 관리의 구성을 적용하면 모든 VM이 패치 관리 요법에 포함되고, 애플리케이션 팀이 VM에 대한 패치 배포를 관리할 수 있는 기능을 제공하고, 중앙 IT에 모든 VM에 대한 가시성 및 적용 기능을 제공합니다.",
      "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "관리 및 모니터링",
      "subcategory": "모니터링",
      "text": "VM의 실행 중인 SAP 워크로드에 대해 VM 인사이트를 사용하도록 설정합니다.",
      "guid": "c486ba28-0dc0-4591-af65-de8e1309cccd",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor"
    },
    {
      "category": "관리 및 모니터링",
      "subcategory": "모니터링",
      "text": "Azure 태그 지정을 활용하여 리소스를 논리적으로 그룹화 및 추적하고, 배포를 자동화하고, 가장 중요한 것은 발생한 비용에 대한 가시성을 제공하는 것입니다.",
      "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery"
    },
    {
      "category": "관리 및 모니터링",
      "subcategory": "모니터링",
      "text": "&nbsp",
      "guid": "4919cb1b-3d13-425a-b124-ba34df685edd",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/backup/backup-center-overview"
    },
    {
      "category": "보안, 거버넌스 및 규정 준수",
      "subcategory": "비밀",
      "text": "Azure 키 자격 증명 모음을 사용하여 비밀 및 자격 증명 저장",
      "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/key-vault/general/overview"
    },
    {
      "category": "보안, 거버넌스 및 규정 준수",
      "subcategory": "비밀",
      "text": "무단 변경으로부터 보호하기 위해 성공적인 배포 후 Azure 리소스를 잠그는 것이 좋습니다.",
      "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling"
    },
    {
      "category": "보안, 거버넌스 및 규정 준수",
      "subcategory": "비밀",
      "text": "삭제된 개체에 대한 보존 보호를 허용하도록 설정된 소프트 삭제 및 제거 정책을 사용하여 Azure Key Vault를 프로비전합니다.",
      "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "보안, 거버넌스 및 규정 준수",
      "subcategory": "비밀",
      "text": "기존 요구 사항, 규정 및 규정 준수 제어(내부/외부) 기반 - 필요한 Azure 정책 및 Azure RBAC 역할 결정",
      "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "보안, 거버넌스 및 규정 준수",
      "subcategory": "비밀",
      "text": "SAP용 클라우드 표준용 Microsoft Defender를 사용하도록 설정하는 경우 끝점 보호를 설치하는 정책에서 SAP 데이터베이스 서버를 제외해야 합니다.",
      "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "보안, 거버넌스 및 규정 준수",
      "subcategory": "비밀",
      "text": "적시 액세스를 사용하여 SAP 관리자 사용자 지정 역할을 위임합니다.",
      "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "보안, 거버넌스 및 규정 준수",
      "subcategory": "비밀",
      "text": "타사 보안 제품을 DIAG(SAP GUI), RFC 및 HTTPS용 SPNEGO용 보안 네트워크 통신(SNC)과 통합하여 전송 중인 데이터를 암호화합니다.",
      "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "보안, 거버넌스 및 규정 준수",
      "subcategory": "비밀",
      "text": "SAML 2.0이 포함된 Azure Active Directory(Azure AD)는 SAP NetWeaver, SAP HANA 및 SAP 클라우드 플랫폼과 같은 다양한 SAP 응용 프로그램 및 플랫폼에 SSO를 제공할 수도 있습니다.",
      "guid": "55d04c3c-4919-4cb1-a3d1-325ae124ba34",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "보안, 거버넌스 및 규정 준수",
      "subcategory": "비밀",
      "text": "SAP 데이터베이스에 대한 공격으로 이어질 수 있는 취약성을 근절하기 위해 운영 체제를 강화해야 합니다.",
      "guid": "df685edd-ce9b-4d3b-a0cd-b3b55eb2ec14",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "보안, 거버넌스 및 규정 준수",
      "subcategory": "비밀",
      "text": "주체 암호화 기능을 위해 Microsoft에서 관리하는 키로 기본 설정되며 필요한 경우 고객 관리 키를 사용합니다.",
      "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "보안, 거버넌스 및 규정 준수",
      "subcategory": "비밀",
      "text": "지역별 환경당 응용 프로그램당 Azure Key Vault를 사용합니다.",
      "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "보안, 거버넌스 및 규정 준수",
      "subcategory": "비밀",
      "text": "&nbsp",
      "guid": "5833fb4a-e3c2-4df7-9316-5c3acbe05bbe",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "보안, 거버넌스 및 규정 준수",
      "subcategory": "거버넌스",
      "text": "실수로 네트워크 관련 변경을 방지하기 위해 Azure 스포크 구독의 SAP에 대한 RBAC(역할 기반 액세스 제어) 역할 사용자 지정",
      "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "보안, 거버넌스 및 규정 준수",
      "subcategory": "거버넌스",
      "text": "DMZ 및 NVA를 나머지 SAP 자산과 격리하고, Azure 개인 링크를 구성하고, Azure 리소스에서 SAP를 안전하게 관리 및 제어합니다.",
      "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "보안, 거버넌스 및 규정 준수",
      "subcategory": "거버넌스",
      "text": "SAP 데이터베이스 서버 암호화의 경우 SAP HANA 네이티브 암호화 기술을 사용합니다. Azure SQL 데이터베이스를 사용하는 경우 DBMS 공급자가 제공하는 TDE(투명한 데이터 암호화)를 사용하여 데이터 및 로그 파일을 보호하고 백업도 암호화되도록 합니다.",
      "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "보안, 거버넌스 및 규정 준수",
      "subcategory": "거버넌스",
      "text": "Azure 저장소 암호화는 기본적으로 사용하도록 설정되어 있습니다.",
      "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "보안, 거버넌스 및 규정 준수",
      "subcategory": "거버넌스",
      "text": "&nbsp",
      "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "보안, 거버넌스 및 규정 준수",
      "subcategory": "거버넌스",
      "text": "&nbsp",
      "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "비즈니스 연속성 및 재해 복구",
      "subcategory": "&nbsp",
      "text": "ASCS와 데이터베이스 클러스터를 단일/동일한 VM에 결합하지 마십시오.",
      "guid": "aff6691b-4935-4ada-9222-3ece81b12318",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports"
    },
    {
      "category": "비즈니스 연속성 및 재해 복구",
      "subcategory": "&nbsp",
      "text": "부하 분산 장치에서 플로팅 IP가 활성화되어 있는지 확인합니다.",
      "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-data-export?tabs=portal"
    },
    {
      "category": "비즈니스 연속성 및 재해 복구",
      "subcategory": "&nbsp",
      "text": "동일한 가용성 집합에서 서로 다른 역할의 서버를 혼합하지 마십시오. 중앙 서비스 VM, 데이터베이스 VM, 애플리케이션 VM을 자체 가용성 집합에 유지",
      "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/security-center/"
    },
    {
      "category": "비즈니스 연속성 및 재해 복구",
      "subcategory": "&nbsp",
      "text": "SAP SID당 하나의 근접 배치 그룹을 사용합니다. 그룹이 가용 영역 또는 Azure 지역에 걸쳐 있지 않습니다.",
      "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/security-center/"
    },
    {
      "category": "비즈니스 연속성 및 재해 복구",
      "subcategory": "&nbsp",
      "text": "Azure는 현재 동일한 Linux 페이스메이커 클러스터에서 ASCS와 db HA의 결합을 지원하지 않습니다. 개별 클러스터로 분리하십시오. 그러나 최대 다섯 개의 여러 중앙 서비스 클러스터를 한 쌍의 VM으로 결합할 수 있습니다.",
      "guid": "80dc0591-cf65-4de8-b130-9cccd579266b",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "비즈니스 연속성 및 재해 복구",
      "subcategory": "&nbsp",
      "text": "ASCS 및 DB 클러스터 앞에서 표준 부하 분산 장치 SKU 사용",
      "guid": "cca275fa-a1ab-4fe9-b55d-04c3c4919cb1",
      "severity": "보통",
      "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response"
    },
    {
      "category": "비즈니스 연속성 및 재해 복구",
      "subcategory": "&nbsp",
      "text": "HA 쌍의 VM 모두 가용성 집합에 배포되어야 하거나 가용 영역의 크기가 동일하고 저장소 구성이 동일해야 합니다.",
      "guid": "b3d1325a-e124-4ba3-9df6-85eddce9bd3b",
      "severity": "보통",
      "link": "https://www.microsoft.com/itshowcase/implementing-a-zero-trust-security-model-at-microsoft"
    },
    {
      "category": "비즈니스 연속성 및 재해 복구",
      "subcategory": "&nbsp",
      "text": "네이티브 데이터베이스 복제 기술을 사용하여 HA 쌍에서 데이터베이스를 동기화해야 합니다.",
      "guid": "b0cdb3b5-5eb2-4ec1-9eea-a3592829e2ed",
      "severity": "보통",
      "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response"
    },
    {
      "category": "비즈니스 연속성 및 재해 복구",
      "subcategory": "&nbsp",
      "text": "RTO를 충족하는 시간 프레임에서 프로덕션 데이터베이스에 대한 특정 시점 복구를 수행합니다. 특정 시점 복구에는 일반적으로 DBMS 계층 또는 SAP를 통해 데이터를 삭제하는 운영자 오류가 포함됩니다.",
      "guid": "b2173676-aff6-4691-a493-5ada42223ece",
      "severity": "보통",
      "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response"
    },
    {
      "category": "비즈니스 연속성 및 재해 복구",
      "subcategory": "&nbsp",
      "text": "VNet(기본 가상 네트워크)의 CIDR이 DR 사이트의 Vnet의 CIDR과 충돌하거나 겹치지 않아야 합니다.",
      "guid": "81b12318-1a54-4174-8583-3fb4ae3c2df7"
    },
    {
      "category": "비즈니스 연속성 및 재해 복구",
      "subcategory": "&nbsp",
      "text": "사이트 복구를 사용하여 애플리케이션 서버를 DR 사이트에 복제합니다. 사이트 복구는 중앙 서비스 클러스터 VM을 DR 사이트에 복제하는 데도 도움이 될 수 있습니다. DR을 호출할 때 DR 사이트에서 Linux Pacemaker 클러스터를 다시 구성해야 합니다(예: VIP 또는 SBD 교체, corosync.conf 실행 등).",
      "guid": "43165c3a-cbe0-45bb-b209-d490da477784"
    },
    {
      "category": "비즈니스 연속성 및 재해 복구",
      "subcategory": "&nbsp",
      "text": "네이티브 데이터베이스 복제를 사용하여 Azure 사이트 복구가 아닌 DR 사이트에 데이터를 동기화해야 합니다.",
      "guid": "24d11678-5d2f-4a56-a56a-d48408fe7273"
    },
    {
      "category": "비즈니스 연속성 및 재해 복구",
      "subcategory": "&nbsp",
      "text": "&nbsp",
      "guid": "4c486ba2-80dc-4059-8cf6-5de8e1309ccc"
    },
    {
      "category": "보관",
      "subcategory": "&nbsp",
      "text": "Oracle, SQL, HANA에 대한 디스크 구성",
      "guid": "d579266b-cca2-475f-aa1a-bfe9d55d04c3"
    },
    {
      "category": "체클리스트",
      "subcategory": "&nbsp",
      "text": "&nbsp",
      "guid": "c4919cb1-b3d1-4325-ae12-4ba34df685ed"
    },
    {
      "category": "계산",
      "subcategory": "&nbsp",
      "text": "수액 ",
      "guid": "dce9bd3b-b0cd-4b3b-95eb-2ec14eeaa359"
    },
    {
      "category": "계산",
      "subcategory": "&nbsp",
      "text": "올바른 VM SKU 및 영역에 대한 할당량 요청 만들기",
      "guid": "2829e2ed-b217-4367-9aff-6691b4935ada",
      "severity": "보통"
    }
  ],
  "categories": [
    {
      "name": "ID 및 액세스"
    },
    {
      "name": "네트워크 토폴로지 및 연결"
    },
    {
      "name": "보안, 거버넌스 및 규정 준수"
    },
    {
      "name": "관리 및 모니터링"
    },
    {
      "name": "관리 그룹 및 구독"
    }
  ],
  "status": [
    {
      "name": "확인되지 않음"
    },
    {
      "name": "열다"
    },
    {
      "name": "성취"
    },
    {
      "name": "해당 없음"
    }
  ],
  "metadata": {
    "name": "Azure Landing Zone Review"
  },
  "severities": [
    {
      "name": "높다"
    },
    {
      "name": "보통"
    },
    {
      "name": "낮다"
    }
  ]
}

checklists/sap_checklist.ja.json METASEP
{
  "items": [
    {
      "category": "アイデンティティとアクセス",
      "subcategory": "同一性",
      "text": "管理グループ、サブスクリプション、リソース グループ、およびリソースに対する RBAC モデルの適用",
      "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
      "severity": "高い",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
    },
    {
      "category": "アイデンティティとアクセス",
      "subcategory": "同一性",
      "text": "クラウド コネクタを介して SAP クラウド アプリケーションからオンプレミス (IaaS を含む) に ID を転送するための原則の伝播を強制する",
      "guid": "45911475-e39e-4530-accc-d979366bcda2",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/"
    },
    {
      "category": "アイデンティティとアクセス",
      "subcategory": "同一性",
      "text": "Azure Active Directory または Active Directory フェデレーション サービス (AD FS) を使用してシングル サインオン (SSO) を実装し、エンド ユーザーが可能な限り SAP アプリケーションに接続できるようにします。",
      "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
      "severity": "高い",
      "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/"
    },
    {
      "category": "アイデンティティとアクセス",
      "subcategory": "同一性",
      "text": "SuccessFactor を HCM アプリケーションとして使用する場合は、Azure AD への自動ユーザー プロビジョニング機能を活用します。",
      "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
      "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial"
    },
    {
      "category": "アイデンティティとアクセス",
      "subcategory": "同一性",
      "text": "SSO から SAP Netweaver への Fiori、webgui などの Web アプリケーションは、SAML を使用して実装できます。",
      "guid": "f7c95f06-e154-4e3a-a359-2829e6e20617",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
      "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure"
    },
    {
      "category": "アイデンティティとアクセス",
      "subcategory": "同一性",
      "text": "SSO から SAP GUI への変換は、SAP SSO またはサードパーティ製ソリューションのいずれかを使用して実装できます。",
      "guid": "3686af46-791f-4893-9ada-43324e138115",
      "severity": "高い",
      "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
      "link": "https://learn.microsoft.com/azure/active-directory-b2c/user-overview"
    },
    {
      "category": "アイデンティティとアクセス",
      "subcategory": "同一性",
      "text": "SAP Analytics Cloud、SAP Cloud Platform、SAP Cloud Platform IAS、SAP C4C with Azure ADなどのSSOからSAP SaaSへのアプリケーションは、SAMLを使用して実装できます。",
      "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
      "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal"
    },
    {
      "category": "アイデンティティとアクセス",
      "subcategory": "同一性",
      "text": "&nbsp",
      "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access"
    },
    {
      "category": "アイデンティティとアクセス",
      "subcategory": "同一性",
      "text": "&nbsp",
      "guid": "16785d6f-a96c-496a-b885-18f482734c88",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
      "link": "https://azure.microsoft.com/resources/achieving-compliant-data-residency-and-security-with-azure/"
    },
    {
      "category": "管理グループとサブスクリプション",
      "subcategory": "サブスクリプション",
      "text": "既存の管理グループポリシーをSAPサブスクリプションに適用する",
      "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "管理グループとサブスクリプション",
      "subcategory": "サブスクリプション",
      "text": "緊密に結合されたアプリケーションを同じSAPサブスクリプションに組み込み、ルーティングと管理の複雑さを増すのを回避",
      "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/resource-tagging/?toc=/azure/azure-resource-manager/management/toc.json"
    },
    {
      "category": "管理グループとサブスクリプション",
      "subcategory": "サブスクリプション",
      "text": "Suscriptionをスケールユニットとして活用し、リソースをスケーリングするには、環境ごとにサブスクリプションを展開することを検討してください。サンドボックス、非製品、製品",
      "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "管理グループとサブスクリプション",
      "subcategory": "サブスクリプション",
      "text": "サブスクリプション プロビジョニングの一環としてクォータの増加を確認します (サブスクリプション内で使用可能な VM コアの合計など)。",
      "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "管理グループとサブスクリプション",
      "subcategory": "サブスクリプション",
      "text": "必要なサービスと機能が、選択した展開地域内で利用可能であることを確認します。ANF、ゾーンなど",
      "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "管理グループとサブスクリプション",
      "subcategory": "サブスクリプション",
      "text": "Azure リソース タグを活用して、コストの分類とリソースのグループ化 (: BillTo、部門 (または部署)、環境 (運用、ステージ、開発)、層 (Web 層、アプリケーション層)、アプリケーション所有者、プロジェクト名)",
      "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "管理グループとサブスクリプション",
      "subcategory": "サブスクリプション",
      "text": "&nbsp",
      "guid": "7d474317-6c8b-4cbf-95bb-e609d8a03e97",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "管理グループとサブスクリプション",
      "subcategory": "サブスクリプション",
      "text": "&nbsp",
      "guid": "778424d6-1678-45d6-ba96-c96ad88518f4",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "ネットワーク トポロジと接続性",
      "subcategory": "IPプラン",
      "text": "SAP ワークロードを実行している VM へのパブリック I.P 割り当ては推奨されません。",
      "guid": "82734c88-6ba2-4802-8459-11475e39e530",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing"
    },
    {
      "category": "ネットワーク トポロジと接続性",
      "subcategory": "IPプラン",
      "text": "ASR を設定するとき DR 側で I.P アドレスを予約することを検討して下さい",
      "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing"
    },
    {
      "category": "ネットワーク トポロジと接続性",
      "subcategory": "IPプラン",
      "text": "運用サイトと DR サイトに重複する IP アドレス範囲を使用しないでください。",
      "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances"
    },
    {
      "category": "ネットワーク トポロジと接続性",
      "subcategory": "IPプラン",
      "text": "[昇格ネットワーク] が該当するすべての VM で有効になっていることを確認します。",
      "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances"
    },
    {
      "category": "ネットワーク トポロジと接続性",
      "subcategory": "ハイブリッド",
      "text": "ローカルおよびグローバル VNet ピアリングは接続性を提供し、複数の Azure リージョンにまたがる SAP デプロイのランディング ゾーン間の接続性を確保するために推奨されるアプローチです。",
      "guid": "a3592829-e6e2-4061-9368-6af46791f893",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
      "link": "https://learn.microsoft.com/azure/networking/"
    },
    {
      "category": "ネットワーク トポロジと接続性",
      "subcategory": "パース",
      "text": "Web アプリケーションファイアウォールを使用して、インターネットに公開されているトラフィックをスキャンします。もう1つのオプションは、ロードバランサー、またはアプリケーションゲートウェイやサードパーティのソリューションなどのファイアウォール機能が組み込まれているリソースで使用することです。",
      "guid": "5ada4332-4e13-4811-9231-81aa41742694",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
      "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services"
    },
    {
      "category": "ネットワーク トポロジと接続性",
      "subcategory": "パース",
      "text": "Azure ロード バランサーの内部デプロイが、DBMS レイヤーの HA 構成にダイレクト サーバー リターン (DSR) を使用するように設定されていることを確認します。",
      "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
      "severity": "中程度"
    },
    {
      "category": "ネットワーク トポロジと接続性",
      "subcategory": "インターネット",
      "text": "Azure ファイアウォールを使用して、インターネットへの Azure アウトバウンド トラフィック、非 HTTP/S インバウンド接続、および東/西トラフィック フィルタリング (組織で必要な場合) を管理します。",
      "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
      "link": "https://learn.microsoft.com/azure/app-service/networking-features"
    },
    {
      "category": "ネットワーク トポロジと接続性",
      "subcategory": "インターネット",
      "text": "SAP WebディスパッチャまたはNetScalerなどのサードパーティサービスをアプリケーションゲートウェイと組み合わせて使用し、SAP Webアプリケーションのリバースプロキシ制限を克服します。",
      "guid": "d88518f4-8273-44c8-a6ba-280214591147",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/firewall/"
    },
    {
      "category": "ネットワーク トポロジと接続性",
      "subcategory": "インターネット",
      "text": "Azure Front Door ポリシーと WAF ポリシーを使用して、ランディング ゾーンへの受信 HTTP/S 接続を Azure リージョン全体でグローバルに保護します。",
      "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview"
    },
    {
      "category": "ネットワーク トポロジと接続性",
      "subcategory": "インターネット",
      "text": "Azure Front Door と Azure Application Gateway を使用して HTTP/S アプリを保護する場合は、Azure Front Door で WAF ポリシーを使用します。Azure Front Door からのみトラフィックを受信するように Azure Application Gateway をロックダウンします。",
      "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview"
    },
    {
      "category": "ネットワーク トポロジと接続性",
      "subcategory": "アプリ配信",
      "text": "HTTP/S アプリを安全に配信するには、アプリケーション ゲートウェイ v2 を使用し、WAF 保護とポリシーが有効になっていることを確認します。",
      "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview"
    },
    {
      "category": "ネットワーク トポロジと接続性",
      "subcategory": "セグメンテーション",
      "text": "Azure NetApp Files が SAP デプロイに使用される場合、Azure NetAppFiles の Vnet に存在できるデリゲート サブネットが 1 つだけであることを確認します。",
      "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/organize-resources?tabs=AzureManagementGroupsAndHierarchy"
    },
    {
      "category": "ネットワーク トポロジと接続性",
      "subcategory": "セグメンテーション",
      "text": "NSGとアプリケーションセキュリティグループを使用して、アプリケーションサブネット、DBサブネット、WebサブネットなどのSAPアプリケーション層内のトラフィックをマイクロセグメント化します。",
      "guid": "6791f893-5ada-4433-84e1-3811523181aa",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works"
    },
    {
      "category": "ネットワーク トポロジと接続性",
      "subcategory": "セグメンテーション",
      "text": "SAP アプリケーションと SAP データベースサーバー間での NVA のデプロイはサポートされていません。",
      "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works"
    },
    {
      "category": "ネットワーク トポロジと接続性",
      "subcategory": "セグメンテーション",
      "text": "ピアリングされていない異なる Azure VNet への SAP アプリケーション層と SAP DBMS の配置はサポートされていません。",
      "guid": "45bbe609-d8a0-43e9-9778-424d616785d6"
    },
    {
      "category": "ネットワーク トポロジと接続性",
      "subcategory": "セグメンテーション",
      "text": "SAP アプリケーションで最適なネットワーク待機時間を実現するには、Azure 近接通信配置グループの使用を検討してください。",
      "guid": "fa96c96a-d885-418f-9827-34c886ba2802"
    },
    {
      "category": "管理と監視",
      "subcategory": "モニタリング",
      "text": "SAP Solution Manager と Azure Monitor for SAP Solutions を使用して、SAP HANA、高可用性 SUSE クラスタ、および SQL システムを監視します。",
      "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
      "severity": "中程度"
    },
    {
      "category": "管理と監視",
      "subcategory": "モニタリング",
      "text": "SAP チェック用の VM 拡張機能を実行します。SAP 用 VM 拡張機能は、仮想マシンの割り当てられた管理対象 ID を使用して、VM の監視および構成データにアクセスします。",
      "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "管理と監視",
      "subcategory": "モニタリング",
      "text": "アクセス制御とコンプライアンス レポートには Azure Policy を使用します。Azure Policy では、組織全体の設定を適用して、一貫したポリシーの遵守と迅速な違反検出を確保できます。",
      "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "管理と監視",
      "subcategory": "モニタリング",
      "text": "Azure Backup サービスで HANA データベースを保護します。HANA データベースに Azure NetApp Files (ANF) をデプロイする場合は、Azure Application Consistent Snapshot ツール (AzAcSnap) を使用して、アプリケーション整合性スナップショットを作成します。",
      "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
      "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create"
    },
    {
      "category": "管理と監視",
      "subcategory": "モニタリング",
      "text": "プロビジョニングされた Azure インフラストラクチャで SAP HANA の品質チェックを実行して、プロビジョニングされた VM が SAP HANA on Azure のベスト プラクティスに準拠していることを確認します。",
      "guid": "73686af4-6791-4f89-95ad-a43324e13811",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
      "link": "https://learn.microsoft.com/azure/automation/update-management/overview"
    },
    {
      "category": "管理と監視",
      "subcategory": "モニタリング",
      "text": "ネットワーク監視接続モニターを使用して、SAP データベースとアプリケーション サーバーの待機時間のメトリックを監視したり、Azure Monitor でネットワーク待機時間の測定値を収集して表示したりします。",
      "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
      "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview"
    },
    {
      "category": "管理と監視",
      "subcategory": "モニタリング",
      "text": "SAP ランドスケープ管理 (LaMa) を使用して、SAP ベーシスオペレーションを最適化および管理します。Azure 用 SAP LaMa コネクタを使用して、SAP システムの再配置、コピー、複製、および更新を行います。",
      "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
      "severity": "中程度",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
      "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json"
    },
    {
      "category": "管理と監視",
      "subcategory": "モニタリング",
      "text": "Azure サブスクリプションごとに、ゾーン展開の前に Azure アベイラビリティーゾーンの待機時間テストを実行して、Azure デプロイ上の SAP の低待機時間ゾーンを選択します。",
      "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "管理と監視",
      "subcategory": "モニタリング",
      "text": "Microsoft Sentinel を使用して SAP の脅威保護を実装します。",
      "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard"
    },
    {
      "category": "管理と監視",
      "subcategory": "モニタリング",
      "text": "ポリシーを使用してパッチ管理の構成を適用すると、すべての VM がパッチ管理レジメンに含まれ、アプリケーション チームが VM のパッチ展開を管理できるようになり、すべての VM にわたる可視性と適用機能が中央 IT に提供されます。",
      "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "管理と監視",
      "subcategory": "モニタリング",
      "text": "VM で実行中の SAP ワークロードの VM インサイトを有効にします。",
      "guid": "c486ba28-0dc0-4591-af65-de8e1309cccd",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor"
    },
    {
      "category": "管理と監視",
      "subcategory": "モニタリング",
      "text": "Azure のタグ付けを活用して、リソースを論理的にグループ化して追跡し、デプロイを自動化し、最も重要なのは、発生したコストを可視化することです。",
      "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery"
    },
    {
      "category": "管理と監視",
      "subcategory": "モニタリング",
      "text": "&nbsp",
      "guid": "4919cb1b-3d13-425a-b124-ba34df685edd",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/backup/backup-center-overview"
    },
    {
      "category": "セキュリティ、ガバナンス、コンプライアンス",
      "subcategory": "秘密",
      "text": "Azure Key Vault を使用してシークレットと資格情報を保存する",
      "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/key-vault/general/overview"
    },
    {
      "category": "セキュリティ、ガバナンス、コンプライアンス",
      "subcategory": "秘密",
      "text": "デプロイが成功したら Azure リソースをロックして、承認されていない変更から保護することをお勧めします。",
      "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling"
    },
    {
      "category": "セキュリティ、ガバナンス、コンプライアンス",
      "subcategory": "秘密",
      "text": "論理的な削除ポリシーと削除ポリシーを有効にして Azure Key Vault をプロビジョニングし、削除されたオブジェクトの保持保護を許可します。",
      "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "セキュリティ、ガバナンス、コンプライアンス",
      "subcategory": "秘密",
      "text": "既存の要件、規制およびコンプライアンスの制御 (内部/外部) に基づいて、必要な Azure ポリシーと Azure RBAC ロールを決定します。",
      "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "セキュリティ、ガバナンス、コンプライアンス",
      "subcategory": "秘密",
      "text": "Microsoft Defender for Cloud Standard for SAP を有効にする場合は、エンドポイント保護をインストールするポリシーから SAP データベース サーバーを除外してください。",
      "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "セキュリティ、ガバナンス、コンプライアンス",
      "subcategory": "秘密",
      "text": "ジャストインタイムアクセスでSAP管理者カスタムロールを委任します。",
      "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "セキュリティ、ガバナンス、コンプライアンス",
      "subcategory": "秘密",
      "text": "サードパーティのセキュリティ製品を DIAG (SAP GUI)、RFC、および SPNEGO for HTTPS 用のセキュア ネットワーク通信 (SNC) と統合することにより、転送中のデータを暗号化します。",
      "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "セキュリティ、ガバナンス、コンプライアンス",
      "subcategory": "秘密",
      "text": "Azure Active Directory (Azure AD) with SAML 2.0 では、SAP NetWeaver、SAP HANA、SAP Cloud Platform などのさまざまな SAP アプリケーションおよびプラットフォームに SSO を提供することもできます。",
      "guid": "55d04c3c-4919-4cb1-a3d1-325ae124ba34",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "セキュリティ、ガバナンス、コンプライアンス",
      "subcategory": "秘密",
      "text": "SAP データベースへの攻撃につながる可能性のある脆弱性を根絶するために、オペレーティングシステムを強化してください。",
      "guid": "df685edd-ce9b-4d3b-a0cd-b3b55eb2ec14",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "セキュリティ、ガバナンス、コンプライアンス",
      "subcategory": "秘密",
      "text": "プリンシパル暗号化機能については、既定で Microsoft が管理するキーを使用し、必要に応じて顧客管理キーを使用します。",
      "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "セキュリティ、ガバナンス、コンプライアンス",
      "subcategory": "秘密",
      "text": "Azure Key Vault は、アプリケーションごとに、リージョンごとの環境ごとに使用します。",
      "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "セキュリティ、ガバナンス、コンプライアンス",
      "subcategory": "秘密",
      "text": "&nbsp",
      "guid": "5833fb4a-e3c2-4df7-9316-5c3acbe05bbe",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "セキュリティ、ガバナンス、コンプライアンス",
      "subcategory": "統治",
      "text": "SAP on Azure スポーク サブスクリプションのロールベースのアクセス制御 (RBAC) ロールをカスタマイズして、偶発的なネットワーク関連の変更を回避します。",
      "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "セキュリティ、ガバナンス、コンプライアンス",
      "subcategory": "統治",
      "text": "DMZ と NVA を SAP 資産の残りの部分から分離し、Azure プライベート リンクを構成し、Azure リソース上の SAP を安全に管理および制御します。",
      "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "セキュリティ、ガバナンス、コンプライアンス",
      "subcategory": "統治",
      "text": "SAP データベースサーバーの暗号化には、SAP HANA ネイティブ暗号化テクノロジを使用します。Azure SQL Database を使用している場合は、DBMS プロバイダーが提供する透過的なデータ暗号化 (TDE) を使用して、データとログ ファイルをセキュリティで保護し、バックアップも暗号化されていることを確認します。",
      "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "セキュリティ、ガバナンス、コンプライアンス",
      "subcategory": "統治",
      "text": "Azure Storage の暗号化は既定で有効になっています。",
      "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "セキュリティ、ガバナンス、コンプライアンス",
      "subcategory": "統治",
      "text": "&nbsp",
      "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "セキュリティ、ガバナンス、コンプライアンス",
      "subcategory": "統治",
      "text": "&nbsp",
      "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "ビジネス継続性と災害復旧",
      "subcategory": "&nbsp",
      "text": "ASCS とデータベース クラスタを単一/同一の VM に結合しない",
      "guid": "aff6691b-4935-4ada-9222-3ece81b12318",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports"
    },
    {
      "category": "ビジネス継続性と災害復旧",
      "subcategory": "&nbsp",
      "text": "フローティングIPがロードバランサーで有効になっていることを確認します",
      "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-data-export?tabs=portal"
    },
    {
      "category": "ビジネス継続性と災害復旧",
      "subcategory": "&nbsp",
      "text": "同じ可用性セット内で異なる役割のサーバーを混在させないでください。中央サービス VM、データベース VM、アプリケーション VM を独自の可用性セットに保持する",
      "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/security-center/"
    },
    {
      "category": "ビジネス継続性と災害復旧",
      "subcategory": "&nbsp",
      "text": "SAP SID ごとに 1 つの近接通信配置グループを使用します。グループがアベイラビリティーゾーンまたは Azure リージョンにまたがっていない",
      "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/security-center/"
    },
    {
      "category": "ビジネス継続性と災害復旧",
      "subcategory": "&nbsp",
      "text": "Azure では現在、同じ Linux ペースメーカー クラスター内での ASCS と db HA の組み合わせはサポートされていません。それらを個々のクラスターに分離します。ただし、最大 5 つの複数の中央サービス クラスターを 1 組の VM に結合できます。",
      "guid": "80dc0591-cf65-4de8-b130-9cccd579266b",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "ビジネス継続性と災害復旧",
      "subcategory": "&nbsp",
      "text": "ASCS および DB クラスタの前で標準ロード バランサー SKU を使用する",
      "guid": "cca275fa-a1ab-4fe9-b55d-04c3c4919cb1",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response"
    },
    {
      "category": "ビジネス継続性と災害復旧",
      "subcategory": "&nbsp",
      "text": "HA ペアの両方の VM を可用性セットにデプロイするか、アベイラビリティーゾーンが同じサイズで同じストレージ構成を持つ必要があります。",
      "guid": "b3d1325a-e124-4ba3-9df6-85eddce9bd3b",
      "severity": "中程度",
      "link": "https://www.microsoft.com/itshowcase/implementing-a-zero-trust-security-model-at-microsoft"
    },
    {
      "category": "ビジネス継続性と災害復旧",
      "subcategory": "&nbsp",
      "text": "ネイティブ・データベース・レプリケーション・テクノロジーを使用して、HA ペアのデータベースを同期する必要があります。",
      "guid": "b0cdb3b5-5eb2-4ec1-9eea-a3592829e2ed",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response"
    },
    {
      "category": "ビジネス継続性と災害復旧",
      "subcategory": "&nbsp",
      "text": "運用データベースのポイント イン タイム リカバリを、RTO を満たす任意の時点および時間枠で実行します。ポイント・イン・タイム・リカバリには、通常、DBMSレイヤー上またはSAP経由でデータを削除するオペレータ・エラーが含まれます。",
      "guid": "b2173676-aff6-4691-a493-5ada42223ece",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response"
    },
    {
      "category": "ビジネス継続性と災害復旧",
      "subcategory": "&nbsp",
      "text": "プライマリ仮想ネットワーク (VNet) の CIDR は、DR サイトの Vnet の CIDR と競合したり重複したりしてはなりません。",
      "guid": "01b12318-1a54-4174-8583-3fb4ae3c2df7"
    },
    {
      "category": "ビジネス継続性と災害復旧",
      "subcategory": "&nbsp",
      "text": "Site Recovery を使用して、アプリケーション サーバーを DR サイトにレプリケートします。Site Recovery は、中央サービスのクラスター VM を DR サイトにレプリケートする際にも役立ちます。DR を呼び出すときは、DR サイトで Linux ペースメーカー クラスターを再構成する必要があります (たとえば、VIP または SBD の置き換え、corosync.conf の実行など)。",
      "guid": "43165c3a-cbe0-45bb-b209-d490da477784"
    },
    {
      "category": "ビジネス継続性と災害復旧",
      "subcategory": "&nbsp",
      "text": "ネイティブ データベース レプリケーションは、Azure サイトの回復ではなく、DR サイトにデータを同期するために使用する必要があります。",
      "guid": "24d11678-5d2f-4a56-a56a-d48408fe7273"
    },
    {
      "category": "ビジネス継続性と災害復旧",
      "subcategory": "&nbsp",
      "text": "&nbsp",
      "guid": "4c486ba2-80dc-4059-8cf6-5de8e1309ccc"
    },
    {
      "category": "貯蔵",
      "subcategory": "&nbsp",
      "text": "Oracle、SQL、HANA のディスク構成",
      "guid": "d579266b-cca2-475f-aa1a-bfe9d55d04c3"
    },
    {
      "category": "チェクリストたち",
      "subcategory": "&nbsp",
      "text": "&nbsp",
      "guid": "c4919cb1-b3d1-4325-ae12-4ba34df685ed"
    },
    {
      "category": "計算する",
      "subcategory": "&nbsp",
      "text": "樹液",
      "guid": "dce9bd3b-b0cd-4b3b-95eb-2ec14eeaa359"
    },
    {
      "category": "計算する",
      "subcategory": "&nbsp",
      "text": "正しい VM SKU とゾーンのクォータ要求を行う",
      "guid": "2829e2ed-b217-4367-9aff-6691b4935ada",
      "severity": "中程度"
    }
  ],
  "categories": [
    {
      "name": "アイデンティティとアクセス"
    },
    {
      "name": "ネットワーク トポロジと接続性"
    },
    {
      "name": "セキュリティ、ガバナンス、コンプライアンス"
    },
    {
      "name": "管理と監視"
    },
    {
      "name": "管理グループとサブスクリプション"
    }
  ],
  "status": [
    {
      "name": "未検証"
    },
    {
      "name": "開ける"
    },
    {
      "name": "達成"
    },
    {
      "name": "該当なし"
    }
  ],
  "metadata": {
    "name": "Azure ランディング ゾーンのレビュー"
  },
  "severities": [
    {
      "name": "高い"
    },
    {
      "name": "中程度"
    },
    {
      "name": "低い"
    }
  ]
}

checklists/sap_checklist.es.json METASEP
{
  "items": [
    {
      "category": "Identidad y acceso",
      "subcategory": "Identidad",
      "text": "Aplicar un modelo RBAC para grupos de administración, suscripciones, grupos de recursos y recursos",
      "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
      "severity": "Alto",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
    },
    {
      "category": "Identidad y acceso",
      "subcategory": "Identidad",
      "text": "Aplicar la propogación del principio para reenviar la identidad de la aplicación en la nube de SAP a SAP local (incluida IaaS) a través del conector en la nube",
      "guid": "45911475-e39e-4530-accc-d979366bcda2",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/"
    },
    {
      "category": "Identidad y acceso",
      "subcategory": "Identidad",
      "text": "Implemente el inicio de sesión único (SSO) con Azure Active Directory o los Servicios de federación de Active Directory (AD FS) para que los usuarios finales puedan conectarse a las aplicaciones SAP siempre que sea posible.",
      "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
      "severity": "Alto",
      "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/"
    },
    {
      "category": "Identidad y acceso",
      "subcategory": "Identidad",
      "text": "Si SuccessFactor se usa como aplicación HCM, aproveche la característica de aprovisionamiento automatizado de usuarios en Azure AD.",
      "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
      "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial"
    },
    {
      "category": "Identidad y acceso",
      "subcategory": "Identidad",
      "text": "Las aplicaciones web basadas en SSO a SAP Netweaver como Fiori, webgui, etc. se pueden implementar utilizando SAML",
      "guid": "f7c95f06-e154-4e3a-a359-2829e6e20617",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
      "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure"
    },
    {
      "category": "Identidad y acceso",
      "subcategory": "Identidad",
      "text": "SSO a SAP GUI se puede implementar utilizando SAP SSO o una solución de 3ª parte",
      "guid": "3686af46-791f-4893-9ada-43324e138115",
      "severity": "Alto",
      "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
      "link": "https://learn.microsoft.com/azure/active-directory-b2c/user-overview"
    },
    {
      "category": "Identidad y acceso",
      "subcategory": "Identidad",
      "text": "Las aplicaciones de SSO a SAP SaaS como SAP Analytics Cloud, SAP Cloud Platform, SAP Cloud Platform IAS y SAP C4C con Azure AD se pueden implementar mediante SAML",
      "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
      "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal"
    },
    {
      "category": "Identidad y acceso",
      "subcategory": "Identidad",
      "text": "&nbsp",
      "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access"
    },
    {
      "category": "Identidad y acceso",
      "subcategory": "Identidad",
      "text": "&nbsp",
      "guid": "16785d6f-a96c-496a-b885-18f482734c88",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
      "link": "https://azure.microsoft.com/resources/achieving-compliant-data-residency-and-security-with-azure/"
    },
    {
      "category": "Grupo de administración y suscripciones",
      "subcategory": "Suscripciones",
      "text": "aplicar las directivas existentes del grupo de administración a las suscripciones de SAP",
      "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Grupo de administración y suscripciones",
      "subcategory": "Suscripciones",
      "text": "acople las aplicaciones estrechamente acopladas en la misma suscripción de SAP para evitar una complejidad adicional de enrutamiento y administración",
      "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/resource-tagging/?toc=/azure/azure-resource-manager/management/toc.json"
    },
    {
      "category": "Grupo de administración y suscripciones",
      "subcategory": "Suscripciones",
      "text": "Aproveche la suscripción como unidad de escala y amplíe nuestros recursos, considere implementar la suscripción por entorno, por ejemplo. Sandbox, non-prod, prod ",
      "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Grupo de administración y suscripciones",
      "subcategory": "Suscripciones",
      "text": "Asegúrese de aumentar la cuota como parte del aprovisionamiento de suscripciones (por ejemplo, el total de núcleos de vm disponibles dentro de una suscripción).",
      "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Grupo de administración y suscripciones",
      "subcategory": "Suscripciones",
      "text": "Asegúrese de que los servicios y características requeridos estén disponibles dentro de las regiones de implementación elegidas, por ejemplo. ANF, Zona, etc.",
      "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Grupo de administración y suscripciones",
      "subcategory": "Suscripciones",
      "text": "Aproveche la etiqueta de recursos de Azure para la categorización de costos y la agrupación de recursos (: BillTo, Departamento (o unidad de negocio), Entorno (Producción, Etapa, Desarrollo), Nivel (nivel web, Nivel de aplicación), Propietario de la aplicación, ProjectName)",
      "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Grupo de administración y suscripciones",
      "subcategory": "Suscripciones",
      "text": "&nbsp",
      "guid": "7d474317-6c8b-4cbf-95bb-e609d8a03e97",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Grupo de administración y suscripciones",
      "subcategory": "Suscripciones",
      "text": "&nbsp",
      "guid": "778424d6-1678-45d6-ba96-c96ad88518f4",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Topología y conectividad de red",
      "subcategory": "Plan IP",
      "text": "No se recomienda la asignación de I.P pública a máquinas virtuales que ejecuten SAP Workload.",
      "guid": "82734c88-6ba2-4802-8459-11475e39e530",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing"
    },
    {
      "category": "Topología y conectividad de red",
      "subcategory": "Plan IP",
      "text": "Considere reservar la dirección IP en el lado DR al configurar ASR",
      "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing"
    },
    {
      "category": "Topología y conectividad de red",
      "subcategory": "Plan IP",
      "text": "Evite el uso de rangos de direcciones IP superpuestos para sitios de producción y recuperación ante desastres.",
      "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances"
    },
    {
      "category": "Topología y conectividad de red",
      "subcategory": "Plan IP",
      "text": "Asegúrese de que Accelarated Networking esté habilitado para todas las máquinas virtuales donde sea aplicable.",
      "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances"
    },
    {
      "category": "Topología y conectividad de red",
      "subcategory": "Híbrido",
      "text": "El emparejamiento de redes virtuales locales y globales proporciona conectividad y son los enfoques preferidos para garantizar la conectividad entre zonas de aterrizaje para implementaciones de SAP en varias regiones de Azure",
      "guid": "a3592829-e6e2-4061-9368-6af46791f893",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
      "link": "https://learn.microsoft.com/azure/networking/"
    },
    {
      "category": "Topología y conectividad de red",
      "subcategory": "Paas",
      "text": "Use un firewall de aplicaciones web para escanear su tráfico cuando esté expuesto a Internet. Otra opción es usarlo con su equilibrador de carga o con recursos que tengan capacidades de firewall integradas como Application Gateway o soluciones de terceros.",
      "guid": "5ada4332-4e13-4811-9231-81aa41742694",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
      "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services"
    },
    {
      "category": "Topología y conectividad de red",
      "subcategory": "Paas",
      "text": "Asegúrese de que las implementaciones internas de Azure Load Balancer estén configuradas para usar direct server return (DSR) para la configuración de alta disponibilidad en la capa DBMS",
      "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
      "severity": "Medio"
    },
    {
      "category": "Topología y conectividad de red",
      "subcategory": "Internet",
      "text": "Usar Azure Firewall para controlar el tráfico saliente de Azure a Internet, las conexiones entrantes que no son HTTP/S y el filtrado de tráfico Este/Oeste (si la organización lo requiere)",
      "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
      "link": "https://learn.microsoft.com/azure/app-service/networking-features"
    },
    {
      "category": "Topología y conectividad de red",
      "subcategory": "Internet",
      "text": "Utilice SAP Web Dispatcher o un servicio de terceros como NetScaler en conjunción con Application Gateway si es necesario para superar la limitación de proxy inverso para SAP web Apps.",
      "guid": "d88518f4-8273-44c8-a6ba-280214591147",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/firewall/"
    },
    {
      "category": "Topología y conectividad de red",
      "subcategory": "Internet",
      "text": "Use las directivas de Azure Front Door y WAF para proporcionar protección global en todas las regiones de Azure para las conexiones HTTP/S entrantes a una zona de aterrizaje.",
      "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview"
    },
    {
      "category": "Topología y conectividad de red",
      "subcategory": "Internet",
      "text": "Cuando use Azure Front Door y Azure Application Gateway para ayudar a proteger las aplicaciones HTTP/S, use directivas WAF en Azure Front Door. Bloquee Azure Application Gateway para recibir tráfico solo de Azure Front Door.",
      "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview"
    },
    {
      "category": "Topología y conectividad de red",
      "subcategory": "Entrega de aplicaciones",
      "text": "Para una entrega segura de aplicaciones HTTP/S, use Application Gateway v2 y asegúrese de que la protección y las directivas de WAF estén habilitadas.",
      "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview"
    },
    {
      "category": "Topología y conectividad de red",
      "subcategory": "Segmentación",
      "text": "Si Azure NetApp Files se usa para la implementación de SAP, asegúrese de que solo pueda existir una subred delegada en una red virtual para Azure NetAppFiles",
      "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/organize-resources?tabs=AzureManagementGroupsAndHierarchy"
    },
    {
      "category": "Topología y conectividad de red",
      "subcategory": "Segmentación",
      "text": "Utilice NSG y grupos de seguridad de aplicaciones para microsegmentar el tráfico dentro de la capa de aplicación de SAP, como la subred de aplicaciones, la subred de base de datos y la subred web, etc.",
      "guid": "6791f893-5ada-4433-84e1-3811523181aa",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works"
    },
    {
      "category": "Topología y conectividad de red",
      "subcategory": "Segmentación",
      "text": "No se admite la implementación de ningún NVA entre la aplicación SAP y el servidor de base de datos SAP",
      "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works"
    },
    {
      "category": "Topología y conectividad de red",
      "subcategory": "Segmentación",
      "text": "No se admite la colocación de la capa de aplicación de SAP y SAP DBMS en diferentes redes virtuales de Azure que no están emparejadas",
      "guid": "45bbe609-d8a0-43e9-9778-424d616785d6"
    },
    {
      "category": "Topología y conectividad de red",
      "subcategory": "Segmentación",
      "text": "Para obtener una latencia de red óptima con aplicaciones SAP, considere la posibilidad de usar grupos de ubicación de proximidad de Azure.",
      "guid": "fa96c96a-d885-418f-9827-34c886ba2802"
    },
    {
      "category": "Gestión y Seguimiento",
      "subcategory": "Monitorización",
      "text": "Use SAP Solution Manager y Azure Monitor for SAP Solutions para supervisar SAP HANA, clústeres de SUSE de alta disponibilidad y sistemas SQL",
      "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
      "severity": "Medio"
    },
    {
      "category": "Gestión y Seguimiento",
      "subcategory": "Monitorización",
      "text": "Ejecute una extensión de máquina virtual para la comprobación de SAP. VM Extension for SAP utiliza la identidad administrada asignada de una máquina virtual para acceder a los datos de supervisión y configuración de VM.",
      "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "Gestión y Seguimiento",
      "subcategory": "Monitorización",
      "text": "Use Azure Policy para el control de acceso y los informes de cumplimiento. Azure Policy proporciona la capacidad de aplicar la configuración de toda la organización para garantizar el cumplimiento coherente de las directivas y la detección rápida de infracciones. ",
      "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "Gestión y Seguimiento",
      "subcategory": "Monitorización",
      "text": "Proteja su base de datos de HANA con el servicio Copia de seguridad de Azure. Si implementa Azure NetApp Files (ANF) para la base de datos hana, use la herramienta Azure Application Consistent Snapshot (AzAcSnap) para tomar instantáneas coherentes con la aplicación",
      "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
      "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create"
    },
    {
      "category": "Gestión y Seguimiento",
      "subcategory": "Monitorización",
      "text": "Realice una comprobación de calidad de SAP HANA en la infraestructura de Azure aprovisionada para comprobar que las máquinas virtuales aprovisionadas cumplen con los procedimientos recomendados de SAP HANA en Azure.",
      "guid": "73686af4-6791-4f89-95ad-a43324e13811",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
      "link": "https://learn.microsoft.com/azure/automation/update-management/overview"
    },
    {
      "category": "Gestión y Seguimiento",
      "subcategory": "Monitorización",
      "text": "Use network Watcher Connection Monitor para supervisar las métricas de latencia de la base de datos SAP y del servidor de aplicaciones, o recopile y muestre mediciones de latencia de red con Azure Monitor.",
      "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
      "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview"
    },
    {
      "category": "Gestión y Seguimiento",
      "subcategory": "Monitorización",
      "text": "Optimice y gestione las operaciones de SAP Basis mediante SAP Landscape Management (LaMa). Use el conector de SAP LaMa para Azure para reubicar, copiar, clonar y actualizar sistemas SAP.",
      "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
      "severity": "Medio",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
      "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json"
    },
    {
      "category": "Gestión y Seguimiento",
      "subcategory": "Monitorización",
      "text": "Para cada suscripción de Azure, ejecute una prueba de latencia de la zona de disponibilidad de Azure antes de la implementación zonal para elegir zonas de baja latencia para SAP en la implementación de Azure.",
      "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Gestión y Seguimiento",
      "subcategory": "Monitorización",
      "text": "Implemente la protección contra amenazas para SAP con Microsoft Sentinel.",
      "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard"
    },
    {
      "category": "Gestión y Seguimiento",
      "subcategory": "Monitorización",
      "text": "La aplicación de la configuración de la administración de actualizaciones a través de directivas garantiza que todas las máquinas virtuales se incluyan en el régimen de administración de revisiones, proporciona a los equipos de aplicaciones la capacidad de administrar la implementación de revisiones para sus máquinas virtuales y proporciona a la TI central capacidades de visibilidad y aplicación en todas las máquinas virtuales.",
      "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "Gestión y Seguimiento",
      "subcategory": "Monitorización",
      "text": "Habilite VM Insights para máquinas virtuales que ejecutan cargas de trabajo de SAP.",
      "guid": "c486ba28-0dc0-4591-af65-de8e1309cccd",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor"
    },
    {
      "category": "Gestión y Seguimiento",
      "subcategory": "Monitorización",
      "text": "El etiquetado de Azure se puede aprovechar para agrupar y realizar un seguimiento lógico de los recursos, automatizar sus implementaciones y, lo que es más importante, proporcionar visibilidad sobre los costos incurridos.",
      "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery"
    },
    {
      "category": "Gestión y Seguimiento",
      "subcategory": "Monitorización",
      "text": "&nbsp",
      "guid": "4919cb1b-3d13-425a-b124-ba34df685edd",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/backup/backup-center-overview"
    },
    {
      "category": "Seguridad, gobernanza y cumplimiento",
      "subcategory": "Secretos",
      "text": "Uso del Almacén de claves de Azure para almacenar sus secretos y credenciales",
      "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/key-vault/general/overview"
    },
    {
      "category": "Seguridad, gobernanza y cumplimiento",
      "subcategory": "Secretos",
      "text": "Se recomienda BLOQUEAR los recursos de Azure después de la implementación correcta para protegerse contra cambios no autorizados",
      "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling"
    },
    {
      "category": "Seguridad, gobernanza y cumplimiento",
      "subcategory": "Secretos",
      "text": "Aprovisione Azure Key Vault con las directivas de eliminación y purga por software habilitadas para permitir la protección de retención de objetos eliminados.",
      "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Seguridad, gobernanza y cumplimiento",
      "subcategory": "Secretos",
      "text": "En función de los requisitos existentes, los controles normativos y de cumplimiento (internos/externos): determine qué directivas de Azure y el rol RBAC de Azure son necesarios",
      "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Seguridad, gobernanza y cumplimiento",
      "subcategory": "Secretos",
      "text": "Cuando habilite Microsoft Defender for Cloud Standard para SAP, asegúrese de excluir los servidores de bases de datos SAP de cualquier directiva que instale endpoint protection.",
      "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Seguridad, gobernanza y cumplimiento",
      "subcategory": "Secretos",
      "text": "Delegue un rol personalizado de administrador de SAP con acceso justo a tiempo.",
      "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Seguridad, gobernanza y cumplimiento",
      "subcategory": "Secretos",
      "text": "cifrar datos en tránsito integrando el producto de seguridad de terceros con comunicaciones de red seguras (SNC) para DIAG (SAP GUI), RFC y SPNEGO para HTTPS",
      "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Seguridad, gobernanza y cumplimiento",
      "subcategory": "Secretos",
      "text": "Azure Active Directory (Azure AD) con SAML 2.0 también puede proporcionar SSO a una amplia gama de aplicaciones y plataformas de SAP como SAP NetWeaver, SAP HANA y SAP Cloud Platform",
      "guid": "55d04c3c-4919-4cb1-a3d1-325ae124ba34",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Seguridad, gobernanza y cumplimiento",
      "subcategory": "Secretos",
      "text": "Asegúrese de reforzar el sistema operativo para erradicar las vulnerabilidades que podrían provocar ataques a la base de datos SAP.",
      "guid": "df685edd-ce9b-4d3b-a0cd-b3b55eb2ec14",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Seguridad, gobernanza y cumplimiento",
      "subcategory": "Secretos",
      "text": "De forma predeterminada, las claves administradas por Microsoft para la funcionalidad de cifrado principal y usar claves administradas por el cliente cuando sea necesario.",
      "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Seguridad, gobernanza y cumplimiento",
      "subcategory": "Secretos",
      "text": "Use un Almacén de claves de Azure por aplicación, por entorno y por región.",
      "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Seguridad, gobernanza y cumplimiento",
      "subcategory": "Secretos",
      "text": "&nbsp",
      "guid": "5833fb4a-e3c2-4df7-9316-5c3acbe05bbe",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Seguridad, gobernanza y cumplimiento",
      "subcategory": "Gobernanza",
      "text": "Personalice los roles de control de acceso basado en roles (RBAC) para sap en suscripciones radiales de Azure para evitar cambios accidentales relacionados con la red",
      "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Seguridad, gobernanza y cumplimiento",
      "subcategory": "Gobernanza",
      "text": "Aísle las DMZ y las NVA del resto del patrimonio de SAP, configure Azure Private Link y administre y controle de forma segura los recursos de SAP en Azure",
      "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Seguridad, gobernanza y cumplimiento",
      "subcategory": "Gobernanza",
      "text": "Para el cifrado del servidor de base de datos SAP, utilice la tecnología de cifrado nativa SAP HANA. Si usa Base de datos SQL de Azure, use cifrado de datos transparente (TDE) ofrecido por el proveedor de DBMS para proteger los datos y los archivos de registro, y asegúrese de que las copias de seguridad también estén cifradas.",
      "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Seguridad, gobernanza y cumplimiento",
      "subcategory": "Gobernanza",
      "text": "El cifrado de Almacenamiento de Azure está habilitado de forma predeterminada",
      "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Seguridad, gobernanza y cumplimiento",
      "subcategory": "Gobernanza",
      "text": "&nbsp",
      "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Seguridad, gobernanza y cumplimiento",
      "subcategory": "Gobernanza",
      "text": "&nbsp",
      "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Continuidad del negocio y recuperación ante desastres",
      "subcategory": "&nbsp",
      "text": "No combine ASCS y clúster de base de datos en una sola o misma máquina virtual",
      "guid": "aff6691b-4935-4ada-9222-3ece81b12318",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports"
    },
    {
      "category": "Continuidad del negocio y recuperación ante desastres",
      "subcategory": "&nbsp",
      "text": "Asegúrese de que la IP flotante esté habilitada en el equilibrador de carga",
      "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-data-export?tabs=portal"
    },
    {
      "category": "Continuidad del negocio y recuperación ante desastres",
      "subcategory": "&nbsp",
      "text": "No mezcle servidores de diferentes roles en el mismo conjunto de disponibilidad. Mantenga las máquinas virtuales de servicios centrales, las máquinas virtuales de bases de datos y las máquinas virtuales de aplicaciones en sus propios conjuntos de disponibilidad",
      "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/security-center/"
    },
    {
      "category": "Continuidad del negocio y recuperación ante desastres",
      "subcategory": "&nbsp",
      "text": "Utilice un grupo de colocación de proximidad por SID de SAP. Los grupos no abarcan zonas de disponibilidad ni regiones de Azure",
      "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/security-center/"
    },
    {
      "category": "Continuidad del negocio y recuperación ante desastres",
      "subcategory": "&nbsp",
      "text": "Azure no admite actualmente la combinación de ASCS y db HA en el mismo clúster de Linux Pacemaker; separarlos en grupos individuales. Sin embargo, puede combinar hasta cinco clústeres de servicios centrales en un par de máquinas virtuales.",
      "guid": "80dc0591-cf65-4de8-b130-9cccd579266b",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "Continuidad del negocio y recuperación ante desastres",
      "subcategory": "&nbsp",
      "text": "Usar una SKU de equilibrador de carga estándar delante de clústeres ASCS y DB",
      "guid": "cca275fa-a1ab-4fe9-b55d-04c3c4919cb1",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response"
    },
    {
      "category": "Continuidad del negocio y recuperación ante desastres",
      "subcategory": "&nbsp",
      "text": "Ambas máquinas virtuales del par de alta disponibilidad deben implementarse en un conjunto de disponibilidad, o las zonas de disponibilidad deben tener el mismo tamaño y la misma configuración de almacenamiento",
      "guid": "b3d1325a-e124-4ba3-9df6-85eddce9bd3b",
      "severity": "Medio",
      "link": "https://www.microsoft.com/itshowcase/implementing-a-zero-trust-security-model-at-microsoft"
    },
    {
      "category": "Continuidad del negocio y recuperación ante desastres",
      "subcategory": "&nbsp",
      "text": "Se debe utilizar la tecnología de replicación de bases de datos nativas para sincronizar la base de datos en un par de alta disponibilidad.",
      "guid": "b0cdb3b5-5eb2-4ec1-9eea-a3592829e2ed",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response"
    },
    {
      "category": "Continuidad del negocio y recuperación ante desastres",
      "subcategory": "&nbsp",
      "text": "Realice una recuperación puntual para sus bases de datos de producción en cualquier momento y en un marco de tiempo que cumpla con su RTO; La recuperación puntual generalmente incluye errores del operador que eliminan datos en la capa DBMS o a través de SAP, incidentalmente",
      "guid": "b2173676-aff6-4691-a493-5ada42223ece",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response"
    },
    {
      "category": "Continuidad del negocio y recuperación ante desastres",
      "subcategory": "&nbsp",
      "text": "El CIDR para la red virtual principal (red virtual) no debe entrar en conflicto ni superponerse con el CIDR de la red virtual del sitio de recuperación ante desastres",
      "guid": "81b12318-1a54-4174-8583-3fb4ae3c2df7"
    },
    {
      "category": "Continuidad del negocio y recuperación ante desastres",
      "subcategory": "&nbsp",
      "text": "Utilice Site Recovery para replicar un servidor de aplicaciones en un sitio de RECUPERACIÓN ante desastres. Site Recovery también puede ayudar a replicar máquinas virtuales de clúster de servicios centrales en el sitio de RECUPERACIÓN ante desastres. Cuando invoque DR, deberá volver a configurar el clúster de Linux Pacemaker en el sitio de DR (por ejemplo, reemplace vip o SBD, ejecute corosync.conf y más).",
      "guid": "43165c3a-cbe0-45bb-b209-d490da477784"
    },
    {
      "category": "Continuidad del negocio y recuperación ante desastres",
      "subcategory": "&nbsp",
      "text": "La replicación nativa de la base de datos se debe usar para sincronizar los datos con el sitio de recuperación ante desastres, en lugar de Azure Site Recovery",
      "guid": "24d11678-5d2f-4a56-a56a-d48408fe7273"
    },
    {
      "category": "Continuidad del negocio y recuperación ante desastres",
      "subcategory": "&nbsp",
      "text": "&nbsp",
      "guid": "4c486ba2-80dc-4059-8cf6-5de8e1309ccc"
    },
    {
      "category": "Almacenamiento",
      "subcategory": "&nbsp",
      "text": "Configuración de disco para Oracle, SQL, HANA",
      "guid": "d579266b-cca2-475f-aa1a-bfe9d55d04c3"
    },
    {
      "category": "Checlistas",
      "subcategory": "&nbsp",
      "text": "&nbsp",
      "guid": "c4919cb1-b3d1-4325-ae12-4ba34df685ed"
    },
    {
      "category": "Calcular",
      "subcategory": "&nbsp",
      "text": "SAVIA ",
      "guid": "dce9bd3b-b0cd-4b3b-95eb-2ec14eeaa359"
    },
    {
      "category": "Calcular",
      "subcategory": "&nbsp",
      "text": "Realizar solicitudes de cuota para SKU y zonas de VM correctas",
      "guid": "2829e2ed-b217-4367-9aff-6691b4935ada",
      "severity": "Medio"
    }
  ],
  "categories": [
    {
      "name": "Identidad y acceso"
    },
    {
      "name": "Topología y conectividad de red"
    },
    {
      "name": "Seguridad, gobernanza y cumplimiento"
    },
    {
      "name": "Gestión y Seguimiento"
    },
    {
      "name": "Grupo de administración y suscripciones"
    }
  ],
  "status": [
    {
      "name": "No verificado"
    },
    {
      "name": "Abrir"
    },
    {
      "name": "Cumplido"
    },
    {
      "name": "N/A"
    }
  ],
  "metadata": {
    "name": "Revisión de la zona de aterrizaje de Azure"
  },
  "severities": [
    {
      "name": "Alto"
    },
    {
      "name": "Medio"
    },
    {
      "name": "Bajo"
    }
  ]
}

checklists/sap_checklist.en.json METASEP
{
  "items": [
    {
      "category": "Identity and Access",
      "subcategory": "Identity",
      "text": "Enforce a RBAC model for management groups, subscriptions, resource groups and resources",
      "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565",
      "severity": "High",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
    },
    {
      "category": "Identity and Access",
      "subcategory": "Identity",
      "text": "Enforce Principle propagation for forwarding the identity from SAP cloud application to SAP on-premises (Including IaaS) through cloud connector",
      "guid": "45911475-e39e-4530-accc-d979366bcda2",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/"
    },
    {
      "category": "Identity and Access",
      "subcategory": "Identity",
      "text": "Implement Single Sign on (SSO) using Azure Active Directory or Active Directory Federation Services (AD FS) for end users to con nect to SAP applications where possible.",
      "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5",
      "severity": "High",
      "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/"
    },
    {
      "category": "Identity and Access",
      "subcategory": "Identity",
      "text": "If SuccessFactor is used as HCM application leverage the automated user provisioning feature to Azure AD.",
      "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
      "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial"
    },
    {
      "category": "Identity and Access",
      "subcategory": "Identity",
      "text": "SSO to SAP Netweaver based web applications like Fiori, webgui etc. can be implemented using SAML",
      "guid": "f7c95f06-e154-4e3a-a359-2829e6e20617",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
      "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure"
    },
    {
      "category": "Identity and Access",
      "subcategory": "Identity",
      "text": "SSO to SAP GUI can be implemented using either SAP SSO or a 3rd party solution",
      "guid": "3686af46-791f-4893-9ada-43324e138115",
      "severity": "High",
      "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
      "link": "https://learn.microsoft.com/azure/active-directory-b2c/user-overview"
    },
    {
      "category": "Identity and Access",
      "subcategory": "Identity",
      "text": "SSO to SAP SaaS applications like SAP Analytics Cloud, SAP Cloud Platform, SAP Cloud Platform IAS and SAP C4C with Azure AD can be implemented using SAML",
      "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
      "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal"
    },
    {
      "category": "Identity and Access",
      "subcategory": "Identity",
      "text": "&nbsp",
      "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access"
    },
    {
      "category": "Identity and Access",
      "subcategory": "Identity",
      "text": "&nbsp",
      "guid": "16785d6f-a96c-496a-b885-18f482734c88",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
      "link": "https://azure.microsoft.com/resources/achieving-compliant-data-residency-and-security-with-azure/"
    },
    {
      "category": "Management Group and Subscriptions",
      "subcategory": "Subscriptions",
      "text": "enforce existing Management Group policies to SAP Subscriptions",
      "guid": "6ba28021-4591-4147-9e39-e5309cccd979",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Management Group and Subscriptions",
      "subcategory": "Subscriptions",
      "text": "enfore closely closely coupled applications into the same SAP Subscription to avoid additional routing and management complexity",
      "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/resource-tagging/?toc=/azure/azure-resource-manager/management/toc.json"
    },
    {
      "category": "Management Group and Subscriptions",
      "subcategory": "Subscriptions",
      "text": "Leverage Subscription as scale unit and scaling our resources, consider deploying subscription per environment eg. Sandbox, non-prod, prod ",
      "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Management Group and Subscriptions",
      "subcategory": "Subscriptions",
      "text": "Ensure quota increase as a part of subscription provisioning (e.g. total available VM cores within a subscription).",
      "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Management Group and Subscriptions",
      "subcategory": "Subscriptions",
      "text": "Ensure required services and features are available within the chosen deployment regions eg. ANF , Zone etc.",
      "guid": "e6e20617-3686-4af4-9791-f8935ada4332",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Management Group and Subscriptions",
      "subcategory": "Subscriptions",
      "text": "Leverage Azure resource tag for cost categorization and resource grouping (: BillTo, Department (or Business Unit), Environment (Production, Stage, Development), Tier (Web Tier, Application Tier), Application Owner, ProjectName)",
      "guid": "4e138115-2318-41aa-9174-26943ff8ae7d",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Management Group and Subscriptions",
      "subcategory": "Subscriptions",
      "text": "&nbsp",
      "guid": "7d474317-6c8b-4cbf-95bb-e609d8a03e97",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Management Group and Subscriptions",
      "subcategory": "Subscriptions",
      "text": "&nbsp",
      "guid": "778424d6-1678-45d6-ba96-c96ad88518f4",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
    },
    {
      "category": "Network Topology and Connectivity",
      "subcategory": "IP plan",
      "text": "Public I.P assignment to VM running SAP Workload is not recommended.",
      "guid": "82734c88-6ba2-4802-8459-11475e39e530",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing"
    },
    {
      "category": "Network Topology and Connectivity",
      "subcategory": "IP plan",
      "text": "Consider reserving I.P address on DR side when configuring ASR",
      "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing"
    },
    {
      "category": "Network Topology and Connectivity",
      "subcategory": "IP plan",
      "text": "Avoid using overlapping IP address ranges for production and DR sites.",
      "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances"
    },
    {
      "category": "Network Topology and Connectivity",
      "subcategory": "IP plan",
      "text": "Ensure Accelerated Networking is enable for all VM where it is applicable.",
      "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
      "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances"
    },
    {
      "category": "Network Topology and Connectivity",
      "subcategory": "Hybrid",
      "text": "Local and global VNet peering provide connectivity and are the preferred approaches to ensure connectivity between landing zones for SAP deployments across multiple Azure regions",
      "guid": "a3592829-e6e2-4061-9368-6af46791f893",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
      "link": "https://learn.microsoft.com/azure/networking/"
    },
    {
      "category": "Network Topology and Connectivity",
      "subcategory": "PaaS",
      "text": "Use a web application firewall to scan your traffic when it's exposed to the internet. Another option is to use it with your load balancer or with resources that have built-in firewall capabilities like Application Gateway or third-party solutions.",
      "guid": "5ada4332-4e13-4811-9231-81aa41742694",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
      "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services"
    },
    {
      "category": "Network Topology and Connectivity",
      "subcategory": "PaaS",
      "text": "Ensure that internal deployments for Azure Load Balancer are set up to use Direct Server Return (DSR) for HA configuration on the DBMS layer",
      "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609",
      "severity": "Medium"
    },
    {
      "category": "Network Topology and Connectivity",
      "subcategory": "Internet",
      "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)",
      "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
      "link": "https://learn.microsoft.com/azure/app-service/networking-features"
    },
    {
      "category": "Network Topology and Connectivity",
      "subcategory": "Internet",
      "text": "Use SAP Web dispatcher or third party service like NetScaler in conjunction with Application gateway if necessary to overcome reverse proxy  limitation for SAP web Apps.",
      "guid": "d88518f4-8273-44c8-a6ba-280214591147",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/firewall/"
    },
    {
      "category": "Network Topology and Connectivity",
      "subcategory": "Internet",
      "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
      "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview"
    },
    {
      "category": "Network Topology and Connectivity",
      "subcategory": "Internet",
      "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.",
      "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview"
    },
    {
      "category": "Network Topology and Connectivity",
      "subcategory": "App delivery",
      "text": "For secure delivery of HTTP/S apps, use Application Gateway v2 and ensure that WAF protection and policies are enabled.",
      "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
      "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview"
    },
    {
      "category": "Network Topology and Connectivity",
      "subcategory": "Segmentation",
      "text": "If Azure NetApp Files is used for SAP deployment , ensure that only one delegate subnet can exist in a Vnet for Azure NetAppFiles",
      "guid": "6e154e3a-a359-4282-ae6e-206173686af4",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/organize-resources?tabs=AzureManagementGroupsAndHierarchy"
    },
    {
      "category": "Network Topology and Connectivity",
      "subcategory": "Segmentation",
      "text": "Use NSGs and application security groups to micro-segment traffic within SAP application layer, like App subnet, DB subnet and Web subnet etc.",
      "guid": "6791f893-5ada-4433-84e1-3811523181aa",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works"
    },
    {
      "category": "Network Topology and Connectivity",
      "subcategory": "Segmentation",
      "text": "It is not supported to deploy any NVA between SAP application and SAP Database server",
      "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
      "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works"
    },
    {
      "category": "Network Topology and Connectivity",
      "subcategory": "Segmentation",
      "text": "Placing of the SAP application layer and SAP DBMS in different Azure VNets that aren't peered isn't supported",
      "guid": "45bbe609-d8a0-43e9-9778-424d616785d6",
      "severity": "Medium"
    },
    {
      "category": "Network Topology and Connectivity",
      "subcategory": "Segmentation",
      "text": "For optimal network latency with SAP applications, consider using Azure proximity placement groups.",
      "guid": "fa96c96a-d885-418f-9827-34c886ba2802",
      "severity": "Medium"
    },
    {
      "category": "Management and Monitoring",
      "subcategory": "Monitoring",
      "text": "Use SAP Solution Manager and Azure Monitor for SAP Solutions to monitor SAP HANA, high-availability SUSE clusters, and SQL systems",
      "guid": "14591147-5e39-4e53-89cc-cd979366bcda",
      "severity": "Medium"
    },
    {
      "category": "Management and Monitoring",
      "subcategory": "Monitoring",
      "text": "Run a VM Extension for SAP check. VM Extension for SAP uses the assigned managed identity of a virtual machine to access VM monitoring and configuration data.",
      "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "Management and Monitoring",
      "subcategory": "Monitoring",
      "text": "Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ",
      "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "Management and Monitoring",
      "subcategory": "Monitoring",
      "text": "Protect your HANA database with Azure Backup service. If you deploy Azure NetApp Files (ANF) for your HANA database, use the Azure Application Consistent Snapshot tool (AzAcSnap) to take application-consistent snapshots",
      "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
      "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create"
    },
    {
      "category": "Management and Monitoring",
      "subcategory": "Monitoring",
      "text": "Perform a quality check for SAP HANA on the provisioned Azure infrastructure to verify that provisioned VMs comply with SAP HANA on Azure best practices.",
      "guid": "73686af4-6791-4f89-95ad-a43324e13811",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
      "link": "https://learn.microsoft.com/azure/automation/update-management/overview"
    },
    {
      "category": "Management and Monitoring",
      "subcategory": "Monitoring",
      "text": "Use Network Watcher Connection Monitor to monitor SAP database and application server latency metrics, or collect and display network latency measurements with Azure Monitor.",
      "guid": "523181aa-4174-4269-93ff-8ae7d7d47431",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
      "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview"
    },
    {
      "category": "Management and Monitoring",
      "subcategory": "Monitoring",
      "text": "Optimize and manage SAP Basis operations by using SAP Landscape Management (LaMa). Use the SAP LaMa connector for Azure to relocate, copy, clone, and refresh SAP systems.",
      "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d",
      "severity": "Medium",
      "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
      "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json"
    },
    {
      "category": "Management and Monitoring",
      "subcategory": "Monitoring",
      "text": "For each Azure subscription, run an Azure Availability Zone latency test before zonal deployment to choose low-latency zones for SAP on Azure deployment.",
      "guid": "616785d6-fa96-4c96-ad88-518f482734c8",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Management and Monitoring",
      "subcategory": "Monitoring",
      "text": "Implement threat protection for SAP with Microsoft Sentinel.",
      "guid": "86ba2802-1459-4114-95e3-9e5309cccd97",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard"
    },
    {
      "category": "Management and Monitoring",
      "subcategory": "Monitoring",
      "text": "Enforcing configuration of update management through policy ensures all VMs are included in the patch management regimen, provides application teams with the ability to manage patch deployment for their VMs, and provides central IT with visibility and enforcement capabilities across all VMs",
      "guid": "4d116785-d2fa-456c-96ad-48408fe72734",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "Management and Monitoring",
      "subcategory": "Monitoring",
      "text": "Enable VM Insights for VM's running SAP Workloads.",
      "guid": "c486ba28-0dc0-4591-af65-de8e1309cccd",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor"
    },
    {
      "category": "Management and Monitoring",
      "subcategory": "Monitoring",
      "text": "Azure tagging can be leveraged to logically group and track resources, automate their deployments, and most importantly, provide visibility on the incurred costs.",
      "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery"
    },
    {
      "category": "Management and Monitoring",
      "subcategory": "Monitoring",
      "text": "&nbsp",
      "guid": "4919cb1b-3d13-425a-b124-ba34df685edd",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/backup/backup-center-overview"
    },
    {
      "category": "Security, Governance and Compliance",
      "subcategory": "Secrets",
      "text": "Use Azure Key Vault to store your secrets and credentials",
      "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/key-vault/general/overview"
    },
    {
      "category": "Security, Governance and Compliance",
      "subcategory": "Secrets",
      "text": "It is recommended to LOCK the Azure Resources post successful deployment to safeguard against unauthorized changes",
      "guid": "829e2edb-2173-4676-aff6-691b4935ada4",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling"
    },
    {
      "category": "Security, Governance and Compliance",
      "subcategory": "Secrets",
      "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
      "guid": "2223ece8-1b12-4318-8a54-17415833fb4a",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Security, Governance and Compliance",
      "subcategory": "Secrets",
      "text": "Based on existing requirements, regulatory and compliance controls (internal/external) - Determine what Azure Policies and Azure RBAC role are needed",
      "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Security, Governance and Compliance",
      "subcategory": "Secrets",
      "text": "When you enable Microsoft Defender for Cloud Standard for SAP, make sure to exclude the SAP database servers from any policy that installs endpoint protection.",
      "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Security, Governance and Compliance",
      "subcategory": "Secrets",
      "text": "Delegate an SAP admin custom role with just-in-time access.",
      "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Security, Governance and Compliance",
      "subcategory": "Secrets",
      "text": "encrypt data in transit by integrating the third-party security product with secure network communications (SNC) for DIAG (SAP GUI), RFC, and SPNEGO for HTTPS",
      "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Security, Governance and Compliance",
      "subcategory": "Secrets",
      "text": "Azure Active Directory (Azure AD) with SAML 2.0 can also provide SSO to a range of SAP applications and platforms like SAP NetWeaver, SAP HANA, and the SAP Cloud Platform",
      "guid": "55d04c3c-4919-4cb1-a3d1-325ae124ba34",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Security, Governance and Compliance",
      "subcategory": "Secrets",
      "text": "Make sure you harden the operating system to eradicate vulnerabilities that could lead to attacks on the SAP database.",
      "guid": "df685edd-ce9b-4d3b-a0cd-b3b55eb2ec14",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Security, Governance and Compliance",
      "subcategory": "Secrets",
      "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.",
      "guid": "eeaa3592-829e-42ed-a217-3676aff6691b",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Security, Governance and Compliance",
      "subcategory": "Secrets",
      "text": "Use an Azure Key Vault per application per environment per region.",
      "guid": "4935ada4-2223-4ece-a1b1-23181a541741",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Security, Governance and Compliance",
      "subcategory": "Secrets",
      "text": "&nbsp",
      "guid": "5833fb4a-e3c2-4df7-9316-5c3acbe05bbe",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
    },
    {
      "category": "Security, Governance and Compliance",
      "subcategory": "Governance",
      "text": "Customize role-based access control (RBAC) roles for SAP on Azure spoke subscriptions to avoid accidental network-related changes",
      "guid": "209d490d-a477-4784-84d1-16785d2fa56c",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Security, Governance and Compliance",
      "subcategory": "Governance",
      "text": "Isolate DMZs and NVAs from the rest of the SAP estate, configure Azure Private Link, and securely manage and control the SAP on Azure resources",
      "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Security, Governance and Compliance",
      "subcategory": "Governance",
      "text": "For SAP database server encryption, use the SAP HANA native encryption technology. If you're using Azure SQL Database, use Transparent Data Encryption (TDE) offered by the DBMS provider to secure your data and log files, and ensure the backups are also encrypted.",
      "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Security, Governance and Compliance",
      "subcategory": "Governance",
      "text": "Azure Storage encryption is enabled by default",
      "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Security, Governance and Compliance",
      "subcategory": "Governance",
      "text": "&nbsp",
      "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Security, Governance and Compliance",
      "subcategory": "Governance",
      "text": "&nbsp",
      "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/governance/policy/overview"
    },
    {
      "category": "Business Continuity and Disaster Recovery",
      "subcategory": "&nbsp",
      "text": "Do not combine ASCS and Database cluster on to single/same VM",
      "guid": "aff6691b-4935-4ada-9222-3ece81b12318",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports"
    },
    {
      "category": "Business Continuity and Disaster Recovery",
      "subcategory": "&nbsp",
      "text": "Make sure the Floating IP is enabled on the Load balancer",
      "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-data-export?tabs=portal"
    },
    {
      "category": "Business Continuity and Disaster Recovery",
      "subcategory": "&nbsp",
      "text": "Do not mix servers of different roles in the same availability set. Keep central services VMs, database VMs, application VMs in their own availability sets",
      "guid": "cbe05bbe-209d-4490-ba47-778424d11678",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/security-center/"
    },
    {
      "category": "Business Continuity and Disaster Recovery",
      "subcategory": "&nbsp",
      "text": "Use one proximity placement group per SAP SID. Groups don't span across Availability Zones or Azure regions",
      "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/security-center/"
    },
    {
      "category": "Business Continuity and Disaster Recovery",
      "subcategory": "&nbsp",
      "text": "Azure doesn't currently support combining ASCS and db HA in the same Linux Pacemaker cluster; separate them into individual clusters. However, you can combine up to five multiple central-services clusters into a pair of VMs.",
      "guid": "80dc0591-cf65-4de8-b130-9cccd579266b",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
    },
    {
      "category": "Business Continuity and Disaster Recovery",
      "subcategory": "&nbsp",
      "text": "Use a Standard Load Balancer SKU in front of ASCS and DB clusters",
      "guid": "cca275fa-a1ab-4fe9-b55d-04c3c4919cb1",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response"
    },
    {
      "category": "Business Continuity and Disaster Recovery",
      "subcategory": "&nbsp",
      "text": "Both VMs in the HA pair should be deployed in an availability set, or Availability Zones should be the same size and have the same storage configuration",
      "guid": "b3d1325a-e124-4ba3-9df6-85eddce9bd3b",
      "severity": "Medium",
      "link": "https://www.microsoft.com/itshowcase/implementing-a-zero-trust-security-model-at-microsoft"
    },
    {
      "category": "Business Continuity and Disaster Recovery",
      "subcategory": "&nbsp",
      "text": "Native database replication technology should be used to synchronize the database in a HA pair.",
      "guid": "b0cdb3b5-5eb2-4ec1-9eea-a3592829e2ed",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response"
    },
    {
      "category": "Business Continuity and Disaster Recovery",
      "subcategory": "&nbsp",
      "text": "Perform a point-in-time recovery for your production databases at any point and in a time frame that meets your RTO; point-in-time recovery typically includes operator errors deleting data either on the DBMS layer or through SAP, incidentally",
      "guid": "b2173676-aff6-4691-a493-5ada42223ece",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response"
    },
    {
      "category": "Business Continuity and Disaster Recovery",
      "subcategory": "&nbsp",
      "text": "The CIDR for the primary virtual network (VNet) shouldn't conflict or overlap with the CIDR of the DR site's Vnet",
      "guid": "81b12318-1a54-4174-8583-3fb4ae3c2df7",
      "severity": "Medium"
    },
    {
      "category": "Business Continuity and Disaster Recovery",
      "subcategory": "&nbsp",
      "text": "Use Site Recovery to replicate an application server to a DR site. Site Recovery can also help with replicating central-services cluster VMs to the DR site. When you invoke DR, you'll need to reconfigure the Linux Pacemaker cluster on the DR site (for example, replace the VIP or SBD, run corosync.conf, and more).",
      "guid": "43165c3a-cbe0-45bb-b209-d490da477784",
      "severity": "Medium"
    },
    {
      "category": "Business Continuity and Disaster Recovery",
      "subcategory": "&nbsp",
      "text": "Native database replication should be used to synchronize data to the DR site, rather than Azure Site Recovery",
      "guid": "24d11678-5d2f-4a56-a56a-d48408fe7273",
      "severity": "Medium"
    },
    {
      "category": "Storage",
      "subcategory": "&nbsp",
      "text": "Disk config for Oracle, SQL, HANA",
      "guid": "d579266b-cca2-475f-aa1a-bfe9d55d04c3",
      "severity": "Medium"
    },
    {
      "category": "Compute",
      "subcategory": "&nbsp",
      "text": "Make quota requests for correct VM SKU and Zones",
      "guid": "2829e2ed-b217-4367-9aff-6691b4935ada",
      "severity": "Medium"
    }
  ],
  "categories": [
    {
      "name": "Identity and Access"
    },
    {
      "name": "Network Topology and Connectivity"
    },
    {
      "name": "Security, Governance and Compliance"
    },
    {
      "name": "Management and Monitoring"
    },
    {
      "name": "Management Group and Subscriptions"
    }
  ],
  "status": [
    {
      "name": "Not verified"
    },
    {
      "name": "Open"
    },
    {
      "name": "Fulfilled"
    },
    {
      "name": "N/A"
    }
  ],
  "severities": [
    {
      "name": "High"
    },
    {
      "name": "Medium"
    },
    {
      "name": "Low"
    }
  ],
  "metadata": {
    "name": "Azure Landing Zone Review",
    "state": "Preview",
    "timestamp": "Feb 13, 2023"
  }
}


checklists/multitenancy_checklist.pt.json METASEP
{
  "metadata": {
    "name": "Arquitetura multitenante"
  },
  "severities": [
    {
      "name": "Alto"
    },
    {
      "name": "Média"
    },
    {
      "name": "Baixo"
    }
  ],
  "status": [
    {
      "name": "Não verificado",
      "description": "Este cheque ainda não foi examinado."
    },
    {
      "name": "Abrir",
      "description": "Há um item de ação associado a este cheque"
    },
    {
      "name": "Cumprido",
      "description": "Esta verificação foi verificada, e não há mais itens de ação associados a ele"
    },
    {
      "name": "Não é necessário",
      "description": "Recomendação compreendida, mas não necessária pelos requisitos atuais"
    },
    {
      "name": "N/A",
      "description": "Não é aplicável para o design atual"
    }
  ],
  "categories": [
    {
      "name": "Negócio"
    },
    {
      "name": "Fiabilidade"
    },
    {
      "name": "Segurança"
    },
    {
      "name": "Otimização de custos"
    },
    {
      "name": "Excelência Operacional"
    },
    {
      "name": "Eficiência de desempenho"
    },
    {
      "name": "Implantação de aplicativos"
    }
  ],
  "items": [
    {
      "category": "Negócio",
      "subcategory": "Negócio",
      "text": "Entenda que tipo de solução você está criando, como business-to-business (B2B), business-to-consumer (B2C), ou seu software corporativo, e como os inquilinos são diferentes dos usuários.",
      "guid": "41177955-fe8f-430b-ae72-20dc5b6880da",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/overview"
    },
    {
      "category": "Negócio",
      "subcategory": "Negócio",
      "text": "Defina seus inquilinos. Entenda quantos inquilinos você apoiará inicialmente e seus planos de crescimento.",
      "guid": "2d33d1b7-697c-49f9-b944-afbeac0b2c8f",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models"
    },
    {
      "category": "Negócio",
      "subcategory": "Negócio",
      "text": "Defina seu modelo de preços e certifique-se de que ele esteja alinhado com o consumo de recursos do Azure de seus inquilinos.",
      "guid": "a2111b8b-cc66-4aa2-9da6-c09fa23851b6",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/pricing-models"
    },
    {
      "category": "Negócio",
      "subcategory": "Negócio",
      "text": "Entenda se você precisa separar seus inquilinos em diferentes níveis. Os níveis podem ter preços, recursos, promessas de desempenho, locais geográficos e assim por diante.",
      "guid": "331e84a6-2d65-4359-92ff-a1870b062995",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/pricing-models"
    },
    {
      "category": "Negócio",
      "subcategory": "Negócio",
      "text": "Com base nas necessidades de seus clientes, decida sobre os modelos de locação apropriados para várias partes da sua solução.",
      "guid": "90516b37-aab1-46ca-95bb-cc14a6a1608b",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models"
    },
    {
      "category": "Negócio",
      "subcategory": "Negócio",
      "text": "Quando estiver pronto, venda sua solução multitenante B2B usando o Microsoft Commercial Marketplace.",
      "guid": "90516b37-aab1-46ca-95bb-cc14a6a1608b",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/marketplace/plan-saas-offer"
    },
    {
      "category": "Fiabilidade",
      "subcategory": "Fiabilidade",
      "text": "Revise a lista de verificação de confiabilidade bem arquitetada do Azure, que é aplicável a todas as cargas de trabalho.",
      "guid": "9e7cedd9-1e05-4aeb-a7b3-01fe695a394c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/design-checklist"
    },
    {
      "category": "Fiabilidade",
      "subcategory": "Fiabilidade",
      "text": "Entenda o antipattern do Vizinho Barulhento. Evite que inquilinos individuais impactem a disponibilidade do sistema para outros inquilinos.",
      "guid": "e9521a55-2a7c-425c-8f3e-c38fd0c4df75",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/antipatterns/noisy-neighbor/noisy-neighbor"
    },
    {
      "category": "Fiabilidade",
      "subcategory": "Fiabilidade",
      "text": "Projete sua solução multitenente para o nível de crescimento que você espera. Mas não seja muito engenheiro para um crescimento irreal.",
      "guid": "2b99cb00-9abb-49b6-b11c-f2af9692f09e",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/overview"
    },
    {
      "category": "Fiabilidade",
      "subcategory": "Fiabilidade",
      "text": "Defina os objetivos de nível de serviço (SLOs) e, opcionalmente, os SLAs (Service-Level Agreements, contratos de nível de serviço) para sua solução. SLAs e SLOs devem ser baseados nos requisitos de seus inquilinos, bem como no SLA composto dos recursos do Azure em sua arquitetura.",
      "guid": "7a634a0e-1c9d-42b1-aac2-5a5378f103f1",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/business-metrics"
    },
    {
      "category": "Fiabilidade",
      "subcategory": "Fiabilidade",
      "text": "Teste a escala da sua solução. Certifique-se de que ele tenha um bom desempenho sob todos os níveis de carga, e que ele dimensione corretamente à medida que o número de inquilinos aumenta.",
      "guid": "45beeeaf-fc59-4079-8fca-65d5724abaa7",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute"
    },
    {
      "category": "Fiabilidade",
      "subcategory": "Fiabilidade",
      "text": "Aplique princípios de engenharia do caos para testar a confiabilidade de sua solução.",
      "guid": "2ff55551-984b-4606-95eb-bfb9c8b36761",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute"
    },
    {
      "category": "Segurança",
      "subcategory": "Segurança",
      "text": "Aplique o Zero Trust e os princípios de menor privilégio em todas as camadas da sua solução.",
      "guid": "8238c038-8eb2-4a02-8bd5-4908c9442c1c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/security/zero-trust"
    },
    {
      "category": "Segurança",
      "subcategory": "Segurança",
      "text": "Certifique-se de que você pode mapear corretamente as solicitações do usuário para os inquilinos. Considere incluir o contexto do inquilino como parte do sistema de identidade, ou usando outros meios, como a autorização de inquilino de nível de aplicativo.",
      "guid": "92160e00-6894-4102-97e0-615d4ed93c01",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/map-requests"
    },
    {
      "category": "Segurança",
      "subcategory": "Segurança",
      "text": "Realize testes contínuos de penetração e revisões de código de segurança.",
      "guid": "3c1538b4-5676-4b85-b451-432befb37b4f",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing"
    },
    {
      "category": "Segurança",
      "subcategory": "Segurança",
      "text": "Entenda os requisitos de conformidade de seus inquilinos, incluindo residência de dados e quaisquer padrões de conformidade ou regulamentação que eles exijam que você cumpra.",
      "guid": "5fca45ce-cf2d-42c0-a62c-aac92ba31498",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/governance-compliance"
    },
    {
      "category": "Segurança",
      "subcategory": "Segurança",
      "text": "Gerencie corretamente nomes de domínio e evite vulnerabilidades como DNS pendentes e ataques de aquisição de subdomínios.",
      "guid": "30adb90d-83d4-4a2e-986e-327ffe04e7a5",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/domain-names"
    },
    {
      "category": "Segurança",
      "subcategory": "Segurança",
      "text": "Siga as orientações específicas do serviço para a multitenência.",
      "guid": "72ded36d-c633-4e0d-bd41-799a29da3481",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/service/overview"
    },
    {
      "category": "Otimização de custos",
      "subcategory": "Otimização de custos",
      "text": "Revise a lista de verificação de Excelência Operacional Bem Arquitetada do Azure, que é aplicável a todas as cargas de trabalho.",
      "guid": "db30a9fc-9b1d-40f3-ab90-01f6a3e87fc8",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/architecture/framework/cost/design-checklist"
    },
    {
      "category": "Otimização de custos",
      "subcategory": "Otimização de custos",
      "text": "Certifique-se de que você pode medir adequadamente o consumo por inquilino e correlacioná-lo com seus custos de infraestrutura.",
      "guid": "8533af39-52f6-45b6-a9c3-81b2a54a31e0",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/measure-consumption"
    },
    {
      "category": "Otimização de custos",
      "subcategory": "Otimização de custos",
      "text": "Evite anti-preços. Os antipatos incluem não rastrear custos, rastrear custos com precisão desnecessária, medição em tempo real e usar ferramentas de monitoramento para faturamento.",
      "guid": "c851fd44-7cf1-459c-95a4-f6455d75a981",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/cost-management-allocation"
    },
    {
      "category": "Excelência Operacional",
      "subcategory": "Excelência Operacional",
      "text": "Revise a lista de verificação de Excelência Operacional Bem Arquitetada do Azure, que é aplicável a todas as cargas de trabalho.",
      "guid": "c851fd44-7cf1-459c-95a4-f6455d75a981",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/checklist/data-ops"
    },
    {
      "category": "Excelência Operacional",
      "subcategory": "Excelência Operacional",
      "text": "Use a automação para gerenciar o ciclo de vida do inquilino, como onboarding, implantação, provisionamento e configuração.",
      "guid": "9f7fa7a9-47fc-4f04-81f6-9f9e87571ed3",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenant-lifecycle"
    },
    {
      "category": "Excelência Operacional",
      "subcategory": "Excelência Operacional",
      "text": "Encontre o saldo certo para a implantação de atualizações de serviço. Considere os requisitos de seus inquilinos e seus próprios requisitos operacionais.",
      "guid": "e0bfceed-4f4e-492d-b9f5-898815faa363",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/updates"
    },
    {
      "category": "Excelência Operacional",
      "subcategory": "Excelência Operacional",
      "text": "Monitore a saúde do sistema geral, bem como de cada inquilino.",
      "guid": "a3f80518-d428-4c02-b2cc-dfaef47db7e2",
      "severity": "Alto"
    },
    {
      "category": "Excelência Operacional",
      "subcategory": "Excelência Operacional",
      "text": "Configure e teste alertas para notificá-lo quando inquilinos específicos estão enfrentando problemas ou estão excedendo seus limites de consumo.",
      "guid": "dfb42da5-f871-4953-9e5c-da6fda3f1411",
      "severity": "Média"
    },
    {
      "category": "Excelência Operacional",
      "subcategory": "Excelência Operacional",
      "text": "Organize seus recursos do Azure para isolamento e escala.",
      "guid": "c0c72a1b-e34d-4b3d-b808-2e49f51ce47e",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/resource-organization"
    },
    {
      "category": "Excelência Operacional",
      "subcategory": "Excelência Operacional",
      "text": "Evite antipadrões de implantação e configuração. Os antipadrões incluem executar versões separadas da solução para cada inquilino, configurações ou lógica específicas do inquilino de codificação dura e implantações manuais.",
      "guid": "c5c5e22d-4b51-4cac-a980-f7aac1a4b427",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/deployment-configuration"
    },
    {
      "category": "Eficiência de desempenho",
      "subcategory": "Eficiência de desempenho",
      "text": "Revise a lista de verificação de eficiência de desempenho bem arquitetada do Azure, que é aplicável a todas as cargas de trabalho.",
      "guid": "f0b1fbd8-689c-4ab3-be1d-ad7607d2fbfd",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/framework/scalability/performance-efficiency"
    },
    {
      "category": "Eficiência de desempenho",
      "subcategory": "Eficiência de desempenho",
      "text": "Se você usar infraestrutura compartilhada, planeje como você mitigará as preocupações do Vizinho Barulhento. Certifique-se de que um inquilino não pode reduzir o desempenho do sistema para outros inquilinos.",
      "guid": "18911c4c-934c-49a8-839a-60c092afce30",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/antipatterns/noisy-neighbor/noisy-neighbor"
    },
    {
      "category": "Eficiência de desempenho",
      "subcategory": "Eficiência de desempenho",
      "text": "Determine como você dimensionará seus recursos de computação, armazenamento, rede e outros recursos do Azure para corresponder às demandas de seus inquilinos.",
      "guid": "6acf7eb5-24a3-47c7-ae87-1196cd96048e",
      "severity": "Média",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute"
    },
    {
      "category": "Eficiência de desempenho",
      "subcategory": "Eficiência de desempenho",
      "text": "Considere os limites de escala de cada recurso do Azure. Organize seus recursos adequadamente, a fim de evitar antipatos de organização de recursos. Por exemplo, não arquitete sua solução para trabalhar dentro de requisitos irrealistas de escala.",
      "guid": "ea55400d-f97d-45aa-b71b-34224bf91ed4",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/resource-organization"
    }
  ]
}

checklists/multitenancy_checklist.ko.json METASEP
{
  "metadata": {
    "name": "다중 테넌트 아키텍처"
  },
  "severities": [
    {
      "name": "높다"
    },
    {
      "name": "보통"
    },
    {
      "name": "낮다"
    }
  ],
  "status": [
    {
      "name": "확인되지 않음",
      "description": "이 검사는 아직 검토되지 않았습니다."
    },
    {
      "name": "열다",
      "description": "이 검사와 연관된 작업 항목이 있습니다."
    },
    {
      "name": "성취",
      "description": "이 검사가 확인되었으며 연관된 추가 작업 항목이 없습니다."
    },
    {
      "name": "필요하지 않음",
      "description": "권장 사항은 이해되었지만 현재 요구 사항에는 필요하지 않습니다."
    },
    {
      "name": "해당 없음",
      "description": "현재 설계에는 적용되지 않음"
    }
  ],
  "categories": [
    {
      "name": "사업"
    },
    {
      "name": "신뢰도"
    },
    {
      "name": "안전"
    },
    {
      "name": "비용 최적화"
    },
    {
      "name": "운영 우수성"
    },
    {
      "name": "성능 효율성"
    },
    {
      "name": "응용 프로그램 배포"
    }
  ],
  "items": [
    {
      "category": "사업",
      "subcategory": "사업",
      "text": "B2B(기업 간), B2C(기업 대 소비자) 또는 엔터프라이즈 소프트웨어와 같이 어떤 종류의 솔루션을 만들고 있는지, 테넌트가 사용자와 어떻게 다른지 이해합니다.",
      "guid": "41177955-fe8f-430b-ae72-20dc5b6880da",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/overview"
    },
    {
      "category": "사업",
      "subcategory": "사업",
      "text": "테넌트를 정의합니다. 처음에 지원할 테넌트 수와 성장 계획을 이해합니다.",
      "guid": "2d33d1b7-697c-49f9-b944-afbeac0b2c8f",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models"
    },
    {
      "category": "사업",
      "subcategory": "사업",
      "text": "가격 책정 모델을 정의하고 테넌트의 Azure 리소스 사용량과 일치하는지 확인합니다.",
      "guid": "a2111b8b-cc66-4aa2-9da6-c09fa23851b6",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/pricing-models"
    },
    {
      "category": "사업",
      "subcategory": "사업",
      "text": "테넌트를 다른 계층으로 분리해야 하는지 여부를 이해합니다. 계층에는 가격, 기능, 성능 약속, 지리적 위치 등이 다를 수 있습니다.",
      "guid": "331e84a6-2d65-4359-92ff-a1870b062995",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/pricing-models"
    },
    {
      "category": "사업",
      "subcategory": "사업",
      "text": "고객의 요구 사항에 따라 솔루션의 다양한 부분에 적합한 테넌시 모델을 결정합니다.",
      "guid": "90516b37-aab1-46ca-95bb-cc14a6a1608b",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models"
    },
    {
      "category": "사업",
      "subcategory": "사업",
      "text": "준비가 되면 Microsoft 상업용 마켓플레이스를 사용하여 B2B 다중 테넌트 솔루션을 판매합니다.",
      "guid": "90516b37-aab1-46ca-95bb-cc14a6a1608b",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/marketplace/plan-saas-offer"
    },
    {
      "category": "신뢰도",
      "subcategory": "신뢰도",
      "text": "모든 워크로드에 적용할 수 있는 Azure 잘 설계된 안정성 검사 목록을 검토합니다.",
      "guid": "9e7cedd9-1e05-4aeb-a7b3-01fe695a394c",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/design-checklist"
    },
    {
      "category": "신뢰도",
      "subcategory": "신뢰도",
      "text": "시끄러운 이웃 안티 패턴을 이해하십시오. 개별 테넌트가 다른 테넌트에 대한 시스템의 가용성에 영향을 주지 않도록 합니다.",
      "guid": "e9521a55-2a7c-425c-8f3e-c38fd0c4df75",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/architecture/antipatterns/noisy-neighbor/noisy-neighbor"
    },
    {
      "category": "신뢰도",
      "subcategory": "신뢰도",
      "text": "예상하는 성장 수준에 맞게 다중 테넌트 솔루션을 설계합니다. 그러나 비현실적인 성장을 위해 지나치게 설계하지 마십시오.",
      "guid": "2b99cb00-9abb-49b6-b11c-f2af9692f09e",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/overview"
    },
    {
      "category": "신뢰도",
      "subcategory": "신뢰도",
      "text": "솔루션에 대한 SLO(서비스 수준 목표) 및 선택적으로 SLA(서비스 수준 계약)를 정의합니다. SLA 및 SLO는 테넌트의 요구 사항과 아키텍처의 Azure 리소스의 복합 SLA를 기반으로 해야 합니다.",
      "guid": "7a634a0e-1c9d-42b1-aac2-5a5378f103f1",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/business-metrics"
    },
    {
      "category": "신뢰도",
      "subcategory": "신뢰도",
      "text": "솔루션의 규모를 테스트합니다. 모든 수준의 부하에서 잘 수행되고 테넌트 수가 증가함에 따라 올바르게 확장되는지 확인하십시오.",
      "guid": "45beeeaf-fc59-4079-8fca-65d5724abaa7",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute"
    },
    {
      "category": "신뢰도",
      "subcategory": "신뢰도",
      "text": "카오스 엔지니어링 원칙을 적용하여 솔루션의 신뢰성을 테스트합니다.",
      "guid": "2ff55551-984b-4606-95eb-bfb9c8b36761",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute"
    },
    {
      "category": "안전",
      "subcategory": "안전",
      "text": "제로 트러스트 및 최소 권한 원칙을 솔루션의 모든 계층에 적용하십시오.",
      "guid": "8238c038-8eb2-4a02-8bd5-4908c9442c1c",
      "severity": "높다",
      "link": "https://learn.microsoft.com/security/zero-trust"
    },
    {
      "category": "안전",
      "subcategory": "안전",
      "text": "사용자 요청을 테넌트에 올바르게 매핑할 수 있는지 확인합니다. 테넌트 컨텍스트를 ID 시스템의 일부로 포함하거나 응용 프로그램 수준 테넌트 권한 부여와 같은 다른 방법을 사용하는 것이 좋습니다.",
      "guid": "92160e00-6894-4102-97e0-615d4ed93c01",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/map-requests"
    },
    {
      "category": "안전",
      "subcategory": "안전",
      "text": "지속적인 침투 테스트 및 보안 코드 검토를 수행합니다.",
      "guid": "3c1538b4-5676-4b85-b451-432befb37b4f",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing"
    },
    {
      "category": "안전",
      "subcategory": "안전",
      "text": "데이터 상주 및 충족해야 하는 규정 준수 또는 규제 표준을 포함하여 테넌트의 규정 준수 요구 사항을 이해합니다.",
      "guid": "5fca45ce-cf2d-42c0-a62c-aac92ba31498",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/governance-compliance"
    },
    {
      "category": "안전",
      "subcategory": "안전",
      "text": "도메인 이름을 올바르게 관리하고 DNS 및 하위 도메인 인수 공격과 같은 취약점을 방지합니다.",
      "guid": "30adb90d-83d4-4a2e-986e-327ffe04e7a5",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/domain-names"
    },
    {
      "category": "안전",
      "subcategory": "안전",
      "text": "다중 테넌시에 대한 서비스별 지침을 따르십시오.",
      "guid": "72ded36d-c633-4e0d-bd41-799a29da3481",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/service/overview"
    },
    {
      "category": "비용 최적화",
      "subcategory": "비용 최적화",
      "text": "모든 워크로드에 적용할 수 있는 Azure Well-Architected Operational Excellence 검사 목록을 검토합니다.",
      "guid": "db30a9fc-9b1d-40f3-ab90-01f6a3e87fc8",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/architecture/framework/cost/design-checklist"
    },
    {
      "category": "비용 최적화",
      "subcategory": "비용 최적화",
      "text": "테넌트당 사용량을 적절하게 측정하고 인프라 비용과 상호 연관시킬 수 있는지 확인합니다.",
      "guid": "8533af39-52f6-45b6-a9c3-81b2a54a31e0",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/measure-consumption"
    },
    {
      "category": "비용 최적화",
      "subcategory": "비용 최적화",
      "text": "안티 패턴을 피하십시오. 안티패턴에는 비용 추적 실패, 불필요한 정밀도로 비용 추적, 실시간 측정, 청구를 위한 모니터링 도구 사용 등이 포함됩니다.",
      "guid": "c851fd44-7cf1-459c-95a4-f6455d75a981",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/cost-management-allocation"
    },
    {
      "category": "운영 우수성",
      "subcategory": "운영 우수성",
      "text": "모든 워크로드에 적용할 수 있는 Azure Well-Architected Operational Excellence 검사 목록을 검토합니다.",
      "guid": "c851fd44-7cf1-459c-95a4-f6455d75a981",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/architecture/checklist/data-ops"
    },
    {
      "category": "운영 우수성",
      "subcategory": "운영 우수성",
      "text": "자동화를 사용하여 온보딩, 배포, 프로비저닝 및 구성과 같은 테넌트 수명 주기를 관리합니다.",
      "guid": "9f7fa7a9-47fc-4f04-81f6-9f9e87571ed3",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenant-lifecycle"
    },
    {
      "category": "운영 우수성",
      "subcategory": "운영 우수성",
      "text": "서비스 업데이트를 배포하기 위한 적절한 균형을 찾습니다. 테넌트의 요구 사항과 자체 운영 요구 사항을 모두 고려하십시오.",
      "guid": "e0bfceed-4f4e-492d-b9f5-898815faa363",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/updates"
    },
    {
      "category": "운영 우수성",
      "subcategory": "운영 우수성",
      "text": "전체 시스템 및 각 테넌트의 상태를 모니터링합니다.",
      "guid": "a3f80518-d428-4c02-b2cc-dfaef47db7e2",
      "severity": "높다"
    },
    {
      "category": "운영 우수성",
      "subcategory": "운영 우수성",
      "text": "특정 테넌트에 문제가 발생하거나 사용 제한을 초과할 때 알리도록 경고를 구성하고 테스트합니다.",
      "guid": "dfb42da5-f871-4953-9e5c-da6fda3f1411",
      "severity": "보통"
    },
    {
      "category": "운영 우수성",
      "subcategory": "운영 우수성",
      "text": "격리 및 크기 조정을 위해 Azure 리소스를 구성합니다.",
      "guid": "c0c72a1b-e34d-4b3d-b808-2e49f51ce47e",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/resource-organization"
    },
    {
      "category": "운영 우수성",
      "subcategory": "운영 우수성",
      "text": "배포 및 구성 안티패턴을 피하십시오. 안티패턴에는 각 테넌트에 대해 별도의 버전의 솔루션 실행, 테넌트별 구성 또는 논리를 하드 코딩, 수동 배포가 포함됩니다.",
      "guid": "c5c5e22d-4b51-4cac-a980-f7aac1a4b427",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/deployment-configuration"
    },
    {
      "category": "성능 효율성",
      "subcategory": "성능 효율성",
      "text": "모든 워크로드에 적용할 수 있는 Azure 잘 설계된 성능 효율성 검사 목록을 검토합니다.",
      "guid": "f0b1fbd8-689c-4ab3-be1d-ad7607d2fbfd",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/architecture/framework/scalability/performance-efficiency"
    },
    {
      "category": "성능 효율성",
      "subcategory": "성능 효율성",
      "text": "공유 인프라를 사용하는 경우 시끄러운 이웃 문제를 완화하는 방법을 계획하십시오. 한 테넌트가 다른 테넌트에 대한 시스템 성능을 저하시킬 수 없는지 확인합니다.",
      "guid": "18911c4c-934c-49a8-839a-60c092afce30",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/architecture/antipatterns/noisy-neighbor/noisy-neighbor"
    },
    {
      "category": "성능 효율성",
      "subcategory": "성능 효율성",
      "text": "테넌트의 요구에 맞게 컴퓨팅, 저장소, 네트워킹 및 기타 Azure 리소스를 확장하는 방법을 결정합니다.",
      "guid": "6acf7eb5-24a3-47c7-ae87-1196cd96048e",
      "severity": "보통",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute"
    },
    {
      "category": "성능 효율성",
      "subcategory": "성능 효율성",
      "text": "각 Azure 리소스의 크기 제한을 고려합니다. 자원 조직 안티 패턴을 피하기 위해 자원을 적절하게 구성하십시오. 예를 들어, 비현실적인 규모 요구 사항 내에서 작동하도록 솔루션을 과도하게 설계하지 마십시오.",
      "guid": "ea55400d-f97d-45aa-b71b-34224bf91ed4",
      "severity": "높다",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/resource-organization"
    }
  ]
}

checklists/multitenancy_checklist.ja.json METASEP
{
  "metadata": {
    "name": "マルチテナントアーキテクチャ"
  },
  "severities": [
    {
      "name": "高い"
    },
    {
      "name": "中程度"
    },
    {
      "name": "低い"
    }
  ],
  "status": [
    {
      "name": "未検証",
      "description": "このチェックはまだ見ていません"
    },
    {
      "name": "開ける",
      "description": "このチェックに関連付けられているアクションアイテムがあります"
    },
    {
      "name": "達成",
      "description": "このチェックは検証済みであり、それに関連付けられたアクションアイテムはこれ以上ありません。"
    },
    {
      "name": "必須ではありません",
      "description": "推奨事項は理解しているが、現在の要件では必要ではない"
    },
    {
      "name": "該当なし",
      "description": "現在の設計には適用されません"
    }
  ],
  "categories": [
    {
      "name": "事"
    },
    {
      "name": "確実"
    },
    {
      "name": "安全"
    },
    {
      "name": "コストの最適化"
    },
    {
      "name": "オペレーショナル・エクセレンス"
    },
    {
      "name": "パフォーマンス効率"
    },
    {
      "name": "アプリケーションの展開"
    }
  ],
  "items": [
    {
      "category": "事",
      "subcategory": "事",
      "text": "企業間 (B2B)、企業間 (B2C)、エンタープライズ ソフトウェアなど、作成しているソリューションの種類と、テナントとユーザーの違いを理解します。",
      "guid": "41177955-fe8f-430b-ae72-20dc5b6880da",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/overview"
    },
    {
      "category": "事",
      "subcategory": "事",
      "text": "テナントを定義します。最初にサポートするテナントの数と、成長計画を理解します。",
      "guid": "2d33d1b7-697c-49f9-b944-afbeac0b2c8f",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models"
    },
    {
      "category": "事",
      "subcategory": "事",
      "text": "価格モデルを定義し、テナントの Azure リソースの消費に合わせて調整します。",
      "guid": "a2111b8b-cc66-4aa2-9da6-c09fa23851b6",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/pricing-models"
    },
    {
      "category": "事",
      "subcategory": "事",
      "text": "テナントを異なる層に分ける必要があるかどうかを理解します。階層には、価格、機能、パフォーマンスの約束、地理的な場所などが異なる場合があります。",
      "guid": "331e84a6-2d65-4359-92ff-a1870b062995",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/pricing-models"
    },
    {
      "category": "事",
      "subcategory": "事",
      "text": "顧客の要件に基づいて、ソリューションのさまざまな部分に適したテナント モデルを決定します。",
      "guid": "90516b37-aab1-46ca-95bb-cc14a6a1608b",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models"
    },
    {
      "category": "事",
      "subcategory": "事",
      "text": "準備ができたら、Microsoft Commercial Marketplace を使用して B2B マルチテナント ソリューションを販売します。",
      "guid": "90516b37-aab1-46ca-95bb-cc14a6a1608b",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/marketplace/plan-saas-offer"
    },
    {
      "category": "確実",
      "subcategory": "確実",
      "text": "すべてのワークロードに適用できる Azure の適切に設計された信頼性チェックリストを確認します。",
      "guid": "9e7cedd9-1e05-4aeb-a7b3-01fe695a394c",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/design-checklist"
    },
    {
      "category": "確実",
      "subcategory": "確実",
      "text": "騒々しいネイバーのアンチパターンを理解する。個々のテナントが他のテナントのシステムの可用性に影響を与えないようにします。",
      "guid": "e9521a55-2a7c-425c-8f3e-c38fd0c4df75",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/architecture/antipatterns/noisy-neighbor/noisy-neighbor"
    },
    {
      "category": "確実",
      "subcategory": "確実",
      "text": "マルチテナント ソリューションを、期待するレベルの成長に合わせて設計します。しかし、非現実的な成長のために過剰にエンジニアリングしないでください。",
      "guid": "2b99cb00-9abb-49b6-b11c-f2af9692f09e",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/overview"
    },
    {
      "category": "確実",
      "subcategory": "確実",
      "text": "ソリューションのサービス レベル目標 (SLO) と、オプションでサービス レベル アグリーメント (SLA) を定義します。SLA と SLO は、テナントの要件と、アーキテクチャ内の Azure リソースの複合 SLA に基づいている必要があります。",
      "guid": "7a634a0e-1c9d-42b1-aac2-5a5378f103f1",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/business-metrics"
    },
    {
      "category": "確実",
      "subcategory": "確実",
      "text": "ソリューションのスケールをテストします。すべてのレベルの負荷の下で適切に動作し、テナントの数が増えるにつれて正しくスケーリングされることを確認します。",
      "guid": "45beeeaf-fc59-4079-8fca-65d5724abaa7",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute"
    },
    {
      "category": "確実",
      "subcategory": "確実",
      "text": "カオスエンジニアリングの原則を適用して、ソリューションの信頼性をテストします。",
      "guid": "2ff55551-984b-4606-95eb-bfb9c8b36761",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute"
    },
    {
      "category": "安全",
      "subcategory": "安全",
      "text": "ゼロ トラストと最小特権の原則をソリューションのすべてのレイヤーに適用します。",
      "guid": "8238c038-8eb2-4a02-8bd5-4908c9442c1c",
      "severity": "高い",
      "link": "https://learn.microsoft.com/security/zero-trust"
    },
    {
      "category": "安全",
      "subcategory": "安全",
      "text": "ユーザー要求をテナントに正しくマップできることを確認します。テナント コンテキストを ID システムの一部として、またはアプリケーション レベルのテナント承認などの別の方法を使用することを検討してください。",
      "guid": "92160e00-6894-4102-97e0-615d4ed93c01",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/map-requests"
    },
    {
      "category": "安全",
      "subcategory": "安全",
      "text": "継続的な侵入テストとセキュリティ コード レビューを実行します。",
      "guid": "3c1538b4-5676-4b85-b451-432befb37b4f",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing"
    },
    {
      "category": "安全",
      "subcategory": "安全",
      "text": "テナントのコンプライアンス要件 (データの常駐、テナントが満たす必要があるコンプライアンスまたは規制基準など) を理解します。",
      "guid": "5fca45ce-cf2d-42c0-a62c-aac92ba31498",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/governance-compliance"
    },
    {
      "category": "安全",
      "subcategory": "安全",
      "text": "ドメイン名を正しく管理し、ぶら下がっているDNSやサブドメインの乗っ取り攻撃などの脆弱性を回避します。",
      "guid": "30adb90d-83d4-4a2e-986e-327ffe04e7a5",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/domain-names"
    },
    {
      "category": "安全",
      "subcategory": "安全",
      "text": "マルチテナントに関するサービス固有のガイダンスに従います。",
      "guid": "72ded36d-c633-4e0d-bd41-799a29da3481",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/service/overview"
    },
    {
      "category": "コストの最適化",
      "subcategory": "コストの最適化",
      "text": "すべてのワークロードに適用できる Azure の適切に設計されたオペレーショナル エクセレンス チェックリストを確認します。",
      "guid": "db30a9fc-9b1d-40f3-ab90-01f6a3e87fc8",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/architecture/framework/cost/design-checklist"
    },
    {
      "category": "コストの最適化",
      "subcategory": "コストの最適化",
      "text": "テナントごとの消費量を適切に測定し、インフラストラクチャ コストと関連付けることができることを確認します。",
      "guid": "8533af39-52f6-45b6-a9c3-81b2a54a31e0",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/measure-consumption"
    },
    {
      "category": "コストの最適化",
      "subcategory": "コストの最適化",
      "text": "アンチパターンは避けてください。アンチパターンには、コストの追跡の失敗、不要な精度でのコストの追跡、リアルタイム測定、請求のための監視ツールの使用などがあります。",
      "guid": "c851fd44-7cf1-459c-95a4-f6455d75a981",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/cost-management-allocation"
    },
    {
      "category": "オペレーショナル・エクセレンス",
      "subcategory": "オペレーショナル・エクセレンス",
      "text": "すべてのワークロードに適用できる Azure の適切に設計されたオペレーショナル エクセレンス チェックリストを確認します。",
      "guid": "c851fd44-7cf1-459c-95a4-f6455d75a981",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/architecture/checklist/data-ops"
    },
    {
      "category": "オペレーショナル・エクセレンス",
      "subcategory": "オペレーショナル・エクセレンス",
      "text": "自動化を使用して、オンボーディング、展開、プロビジョニング、構成などのテナントのライフサイクルを管理します。",
      "guid": "9f7fa7a9-47fc-4f04-81f6-9f9e87571ed3",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenant-lifecycle"
    },
    {
      "category": "オペレーショナル・エクセレンス",
      "subcategory": "オペレーショナル・エクセレンス",
      "text": "サービス更新プログラムを展開するための適切なバランスを見つけます。テナントの要件と独自の運用要件の両方を考慮します。",
      "guid": "e0bfceed-4f4e-492d-b9f5-898815faa363",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/updates"
    },
    {
      "category": "オペレーショナル・エクセレンス",
      "subcategory": "オペレーショナル・エクセレンス",
      "text": "システム全体と各テナントの正常性を監視します。",
      "guid": "a3f80518-d428-4c02-b2cc-dfaef47db7e2",
      "severity": "高い"
    },
    {
      "category": "オペレーショナル・エクセレンス",
      "subcategory": "オペレーショナル・エクセレンス",
      "text": "特定のテナントで問題が発生したとき、または消費制限を超えたときに通知するようにアラートを構成およびテストします。",
      "guid": "dfb42da5-f871-4953-9e5c-da6fda3f1411",
      "severity": "中程度"
    },
    {
      "category": "オペレーショナル・エクセレンス",
      "subcategory": "オペレーショナル・エクセレンス",
      "text": "分離とスケーリングのために Azure リソースを整理します。",
      "guid": "c0c72a1b-e34d-4b3d-b808-2e49f51ce47e",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/resource-organization"
    },
    {
      "category": "オペレーショナル・エクセレンス",
      "subcategory": "オペレーショナル・エクセレンス",
      "text": "展開と構成のアンチパターンは避けてください。アンチパターンには、テナントごとに個別のバージョンのソリューションを実行すること、テナント固有の構成またはロジックをハードコーディングすること、および手動展開が含まれます。",
      "guid": "c5c5e22d-4b51-4cac-a980-f7aac1a4b427",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/deployment-configuration"
    },
    {
      "category": "パフォーマンス効率",
      "subcategory": "パフォーマンス効率",
      "text": "すべてのワークロードに適用される Azure の適切に設計されたパフォーマンス効率チェックリストを確認します。",
      "guid": "f0b1fbd8-689c-4ab3-be1d-ad7607d2fbfd",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/architecture/framework/scalability/performance-efficiency"
    },
    {
      "category": "パフォーマンス効率",
      "subcategory": "パフォーマンス効率",
      "text": "共有インフラストラクチャを使用する場合は、ノイズの多い近隣住民の懸念を軽減する方法を計画します。1 つのテナントが他のテナントのシステムのパフォーマンスを低下させないようにします。",
      "guid": "18911c4c-934c-49a8-839a-60c092afce30",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/architecture/antipatterns/noisy-neighbor/noisy-neighbor"
    },
    {
      "category": "パフォーマンス効率",
      "subcategory": "パフォーマンス効率",
      "text": "テナントの要求に合わせてコンピューティング、ストレージ、ネットワーク、およびその他の Azure リソースをスケーリングする方法を決定します。",
      "guid": "6acf7eb5-24a3-47c7-ae87-1196cd96048e",
      "severity": "中程度",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute"
    },
    {
      "category": "パフォーマンス効率",
      "subcategory": "パフォーマンス効率",
      "text": "各 Azure リソースのスケール制限を考慮してください。リソース編成のアンチパターンを避けるために、リソースを適切に編成します。たとえば、非現実的なスケール要件で動作するようにソリューションを過剰に設計しないでください。",
      "guid": "ea55400d-f97d-45aa-b71b-34224bf91ed4",
      "severity": "高い",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/resource-organization"
    }
  ]
}

checklists/multitenancy_checklist.es.json METASEP
{
  "metadata": {
    "name": "Arquitectura multiinquilino"
  },
  "severities": [
    {
      "name": "Alto"
    },
    {
      "name": "Medio"
    },
    {
      "name": "Bajo"
    }
  ],
  "status": [
    {
      "name": "No verificado",
      "description": "Esta comprobación aún no se ha analizado"
    },
    {
      "name": "Abrir",
      "description": "Hay un elemento de acción asociado a esta comprobación"
    },
    {
      "name": "Cumplido",
      "description": "Esta comprobación se ha verificado y no hay más elementos de acción asociados a ella"
    },
    {
      "name": "No es necesario",
      "description": "Recomendación entendida, pero no necesaria por los requisitos actuales"
    },
    {
      "name": "N/A",
      "description": "No aplicable para el diseño actual"
    }
  ],
  "categories": [
    {
      "name": "Negocio"
    },
    {
      "name": "Fiabilidad"
    },
    {
      "name": "Seguridad"
    },
    {
      "name": "Optimización de costos"
    },
    {
      "name": "Excelencia Operacional"
    },
    {
      "name": "Eficiencia de rendimiento"
    },
    {
      "name": "Implementación de aplicaciones"
    }
  ],
  "items": [
    {
      "category": "Negocio",
      "subcategory": "Negocio",
      "text": "Comprenda qué tipo de solución está creando, como de empresa a empresa (B2B), de empresa a consumidor (B2C) o su software empresarial, y en qué se diferencian los inquilinos de los usuarios.",
      "guid": "41177955-fe8f-430b-ae72-20dc5b6880da",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/overview"
    },
    {
      "category": "Negocio",
      "subcategory": "Negocio",
      "text": "Defina sus inquilinos. Comprenda cuántos inquilinos apoyará inicialmente y sus planes de crecimiento.",
      "guid": "2d33d1b7-697c-49f9-b944-afbeac0b2c8f",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models"
    },
    {
      "category": "Negocio",
      "subcategory": "Negocio",
      "text": "Defina su modelo de precios y asegúrese de que se alinea con el consumo de recursos de Azure de sus inquilinos.",
      "guid": "a2111b8b-cc66-4aa2-9da6-c09fa23851b6",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/pricing-models"
    },
    {
      "category": "Negocio",
      "subcategory": "Negocio",
      "text": "Comprenda si necesita separar a sus inquilinos en diferentes niveles. Los niveles pueden tener diferentes precios, características, promesas de rendimiento, ubicaciones geográficas, etc.",
      "guid": "331e84a6-2d65-4359-92ff-a1870b062995",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/pricing-models"
    },
    {
      "category": "Negocio",
      "subcategory": "Negocio",
      "text": "En función de los requisitos de sus clientes, decida los modelos de arrendamiento que sean apropiados para varias partes de su solución.",
      "guid": "90516b37-aab1-46ca-95bb-cc14a6a1608b",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models"
    },
    {
      "category": "Negocio",
      "subcategory": "Negocio",
      "text": "Cuando esté listo, venda su solución multiinquilino B2B con Microsoft Commercial Marketplace.",
      "guid": "90516b37-aab1-46ca-95bb-cc14a6a1608b",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/marketplace/plan-saas-offer"
    },
    {
      "category": "Fiabilidad",
      "subcategory": "Fiabilidad",
      "text": "Revise la lista de comprobación de confiabilidad bien diseñada de Azure, que se aplica a todas las cargas de trabajo.",
      "guid": "9e7cedd9-1e05-4aeb-a7b3-01fe695a394c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/design-checklist"
    },
    {
      "category": "Fiabilidad",
      "subcategory": "Fiabilidad",
      "text": "Comprenda el antipatrón Noisy Neighbor. Evite que los inquilinos individuales afecten la disponibilidad del sistema para otros inquilinos.",
      "guid": "e9521a55-2a7c-425c-8f3e-c38fd0c4df75",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/antipatterns/noisy-neighbor/noisy-neighbor"
    },
    {
      "category": "Fiabilidad",
      "subcategory": "Fiabilidad",
      "text": "Diseñe su solución multiinquilino para el nivel de crecimiento que espera. Pero no hagas un exceso de ingeniería para un crecimiento poco realista.",
      "guid": "2b99cb00-9abb-49b6-b11c-f2af9692f09e",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/overview"
    },
    {
      "category": "Fiabilidad",
      "subcategory": "Fiabilidad",
      "text": "Defina objetivos de nivel de servicio (SLO) y, opcionalmente, acuerdos de nivel de servicio (SLA) para su solución. Los SLA y los SLO deben basarse en los requisitos de los inquilinos, así como en el SLA compuesto de los recursos de Azure de la arquitectura.",
      "guid": "7a634a0e-1c9d-42b1-aac2-5a5378f103f1",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/business-metrics"
    },
    {
      "category": "Fiabilidad",
      "subcategory": "Fiabilidad",
      "text": "Pruebe la escala de la solución. Asegúrese de que funciona bien en todos los niveles de carga y que se escala correctamente a medida que aumenta el número de inquilinos.",
      "guid": "45beeeaf-fc59-4079-8fca-65d5724abaa7",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute"
    },
    {
      "category": "Fiabilidad",
      "subcategory": "Fiabilidad",
      "text": "Aplique los principios de ingeniería del caos para probar la fiabilidad de su solución.",
      "guid": "2ff55551-984b-4606-95eb-bfb9c8b36761",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute"
    },
    {
      "category": "Seguridad",
      "subcategory": "Seguridad",
      "text": "Aplique los principios de confianza cero y privilegios mínimos en todas las capas de su solución.",
      "guid": "8238c038-8eb2-4a02-8bd5-4908c9442c1c",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/security/zero-trust"
    },
    {
      "category": "Seguridad",
      "subcategory": "Seguridad",
      "text": "Asegúrese de que puede asignar correctamente las solicitudes de los usuarios a los inquilinos. Considere la posibilidad de incluir el contexto del inquilino como parte del sistema de identidad o mediante otro medio, como la autorización del inquilino de nivel de aplicación.",
      "guid": "92160e00-6894-4102-97e0-615d4ed93c01",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/map-requests"
    },
    {
      "category": "Seguridad",
      "subcategory": "Seguridad",
      "text": "Realice pruebas de penetración continuas y revisiones de código de seguridad.",
      "guid": "3c1538b4-5676-4b85-b451-432befb37b4f",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing"
    },
    {
      "category": "Seguridad",
      "subcategory": "Seguridad",
      "text": "Comprenda los requisitos de cumplimiento de sus inquilinos, incluida la residencia de datos y cualquier estándar normativo o de cumplimiento que requieran que cumpla.",
      "guid": "5fca45ce-cf2d-42c0-a62c-aac92ba31498",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/governance-compliance"
    },
    {
      "category": "Seguridad",
      "subcategory": "Seguridad",
      "text": "Administre correctamente los nombres de dominio y evite vulnerabilidades como colgar DNS y ataques de adquisición de subdominios.",
      "guid": "30adb90d-83d4-4a2e-986e-327ffe04e7a5",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/domain-names"
    },
    {
      "category": "Seguridad",
      "subcategory": "Seguridad",
      "text": "Siga las instrucciones específicas del servicio para la multitenencia.",
      "guid": "72ded36d-c633-4e0d-bd41-799a29da3481",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/service/overview"
    },
    {
      "category": "Optimización de costos",
      "subcategory": "Optimización de costos",
      "text": "Revise la lista de comprobación de Excelencia operativa bien diseñada de Azure, que se aplica a todas las cargas de trabajo.",
      "guid": "db30a9fc-9b1d-40f3-ab90-01f6a3e87fc8",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/architecture/framework/cost/design-checklist"
    },
    {
      "category": "Optimización de costos",
      "subcategory": "Optimización de costos",
      "text": "Asegúrese de que puede medir adecuadamente el consumo por inquilino y correlacionarlo con sus costos de infraestructura.",
      "guid": "8533af39-52f6-45b6-a9c3-81b2a54a31e0",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/measure-consumption"
    },
    {
      "category": "Optimización de costos",
      "subcategory": "Optimización de costos",
      "text": "Evite los antipatrones. Los antipatrones incluyen no realizar un seguimiento de los costos, rastrear los costos con precisión innecesaria, medición en tiempo real y usar herramientas de monitoreo para la facturación.",
      "guid": "c851fd44-7cf1-459c-95a4-f6455d75a981",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/cost-management-allocation"
    },
    {
      "category": "Excelencia Operacional",
      "subcategory": "Excelencia Operacional",
      "text": "Revise la lista de comprobación de Excelencia operativa bien diseñada de Azure, que se aplica a todas las cargas de trabajo.",
      "guid": "c851fd44-7cf1-459c-95a4-f6455d75a981",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/checklist/data-ops"
    },
    {
      "category": "Excelencia Operacional",
      "subcategory": "Excelencia Operacional",
      "text": "Use la automatización para administrar el ciclo de vida del inquilino, como la incorporación, la implementación, el aprovisionamiento y la configuración.",
      "guid": "9f7fa7a9-47fc-4f04-81f6-9f9e87571ed3",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenant-lifecycle"
    },
    {
      "category": "Excelencia Operacional",
      "subcategory": "Excelencia Operacional",
      "text": "Encuentre el equilibrio adecuado para implementar actualizaciones de servicio. Considere tanto los requisitos de sus inquilinos como sus propios requisitos operativos.",
      "guid": "e0bfceed-4f4e-492d-b9f5-898815faa363",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/updates"
    },
    {
      "category": "Excelencia Operacional",
      "subcategory": "Excelencia Operacional",
      "text": "Supervise el estado del sistema en general, así como de cada inquilino.",
      "guid": "a3f80518-d428-4c02-b2cc-dfaef47db7e2",
      "severity": "Alto"
    },
    {
      "category": "Excelencia Operacional",
      "subcategory": "Excelencia Operacional",
      "text": "Configure y pruebe alertas para notificarle cuando inquilinos específicos experimenten problemas o superen sus límites de consumo.",
      "guid": "dfb42da5-f871-4953-9e5c-da6fda3f1411",
      "severity": "Medio"
    },
    {
      "category": "Excelencia Operacional",
      "subcategory": "Excelencia Operacional",
      "text": "Organice los recursos de Azure para el aislamiento y la escala.",
      "guid": "c0c72a1b-e34d-4b3d-b808-2e49f51ce47e",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/resource-organization"
    },
    {
      "category": "Excelencia Operacional",
      "subcategory": "Excelencia Operacional",
      "text": "Evite los antipatrones de implementación y configuración. Los antipatrones incluyen la ejecución de versiones independientes de la solución para cada inquilino, la codificación rígida de configuraciones o lógica específicas del inquilino y las implementaciones manuales.",
      "guid": "c5c5e22d-4b51-4cac-a980-f7aac1a4b427",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/deployment-configuration"
    },
    {
      "category": "Eficiencia de rendimiento",
      "subcategory": "Eficiencia de rendimiento",
      "text": "Revise la lista de comprobación de eficiencia del rendimiento bien diseñado de Azure, que se aplica a todas las cargas de trabajo.",
      "guid": "f0b1fbd8-689c-4ab3-be1d-ad7607d2fbfd",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/framework/scalability/performance-efficiency"
    },
    {
      "category": "Eficiencia de rendimiento",
      "subcategory": "Eficiencia de rendimiento",
      "text": "Si usa infraestructura compartida, planifique cómo mitigará las preocupaciones de los vecinos ruidosos. Asegúrese de que un inquilino no pueda reducir el rendimiento del sistema para otros inquilinos.",
      "guid": "18911c4c-934c-49a8-839a-60c092afce30",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/antipatterns/noisy-neighbor/noisy-neighbor"
    },
    {
      "category": "Eficiencia de rendimiento",
      "subcategory": "Eficiencia de rendimiento",
      "text": "Determine cómo escalará el proceso, el almacenamiento, las redes y otros recursos de Azure para que coincidan con las demandas de los inquilinos.",
      "guid": "6acf7eb5-24a3-47c7-ae87-1196cd96048e",
      "severity": "Medio",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute"
    },
    {
      "category": "Eficiencia de rendimiento",
      "subcategory": "Eficiencia de rendimiento",
      "text": "Considere los límites de escala de cada recurso de Azure. Organice sus recursos adecuadamente, con el fin de evitar antipatrones de organización de recursos. Por ejemplo, no sobre-diseñe su solución para trabajar dentro de requisitos de escala poco realistas.",
      "guid": "ea55400d-f97d-45aa-b71b-34224bf91ed4",
      "severity": "Alto",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/resource-organization"
    }
  ]
}

checklists/multitenancy_checklist.en.json METASEP
{
  "$schema": "checklist.schema.json",
  "items": [
    {
      "category": "Business",
      "subcategory": "Business",
      "text": "Understand what kind of solution you're creating, such as business-to-business (B2B), business-to-consumer (B2C), or your enterprise software, and how tenants are different from users.",
      "guid": "41177955-fe8f-430b-ae72-20dc5b6880da",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/overview"
    },
    {
      "category": "Business",
      "subcategory": "Business",
      "text": "Define your tenants. Understand how many tenants you will support initially, and your growth plans.",
      "guid": "2d33d1b7-697c-49f9-b944-afbeac0b2c8f",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models"
    },
    {
      "category": "Business",
      "subcategory": "Business",
      "text": "Define your pricing model and ensure it aligns with your tenants' consumption of Azure resources.",
      "guid": "a2111b8b-cc66-4aa2-9da6-c09fa23851b6",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/pricing-models"
    },
    {
      "category": "Business",
      "subcategory": "Business",
      "text": "Understand whether you need to separate your tenants into different tiers. Tiers might have different pricing, features, performance promises, geographic locations, and so forth.",
      "guid": "331e84a6-2d65-4359-92ff-a1870b062995",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/pricing-models"
    },
    {
      "category": "Business",
      "subcategory": "Business",
      "text": "Based on your customers' requirements, decide on the tenancy models that are appropriate for various parts of your solution.",
      "guid": "90516b37-aab1-46ca-95bb-cc14a6a1608b",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models"
    },
    {
      "category": "Business",
      "subcategory": "Business",
      "text": "When you're ready, sell your B2B multitenant solution using the Microsoft Commercial Marketplace.",
      "guid": "f5d76ae1-7048-4ff5-abba-f1ca799578b9",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/marketplace/plan-saas-offer"
    },
    {
      "category": "Reliability",
      "subcategory": "Reliability",
      "text": "Review the Azure Well-Architected Reliability checklist, which is applicable to all workloads.",
      "guid": "9e7cedd9-1e05-4aeb-a7b3-01fe695a394c",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/design-checklist"
    },
    {
      "category": "Reliability",
      "subcategory": "Reliability",
      "text": "Understand the Noisy Neighbor antipattern. Prevent individual tenants from impacting the system's availability for other tenants.",
      "guid": "e9521a55-2a7c-425c-8f3e-c38fd0c4df75",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/architecture/antipatterns/noisy-neighbor/noisy-neighbor"
    },
    {
      "category": "Reliability",
      "subcategory": "Reliability",
      "text": "Design your multitenant solution for the level of growth that you expect. But don't overengineer for unrealistic growth.",
      "guid": "2b99cb00-9abb-49b6-b11c-f2af9692f09e",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/overview"
    },
    {
      "category": "Reliability",
      "subcategory": "Reliability",
      "text": "Define service-level objectives (SLOs) and optionally service-level agreements (SLAs) for your solution. SLAs and SLOs should be based on the requirements of your tenants, as well as the composite SLA of the Azure resources in your architecture.",
      "guid": "7a634a0e-1c9d-42b1-aac2-5a5378f103f1",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/business-metrics"
    },
    {
      "category": "Reliability",
      "subcategory": "Reliability",
      "text": "Test the scale of your solution. Ensure that it performs well under all levels of load, and that it scales correctly as the number of tenants increases.",
      "guid": "45beeeaf-fc59-4079-8fca-65d5724abaa7",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute"
    },
    {
      "category": "Reliability",
      "subcategory": "Reliability",
      "text": "Apply chaos engineering principles to test the reliability of your solution.",
      "guid": "2ff55551-984b-4606-95eb-bfb9c8b36761",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute"
    },
    {
      "category": "Security",
      "subcategory": "Security",
      "text": "Apply the Zero Trust and least privilege principles in all layers of your solution.",
      "guid": "8238c038-8eb2-4a02-8bd5-4908c9442c1c",
      "severity": "High",
      "link": "https://learn.microsoft.com/security/zero-trust"
    },
    {
      "category": "Security",
      "subcategory": "Security",
      "text": "Ensure that you can correctly map user requests to tenants. Consider including the tenant context as part of the identity system, or by using another means, like application-level tenant authorization.",
      "guid": "92160e00-6894-4102-97e0-615d4ed93c01",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/map-requests"
    },
    {
      "category": "Security",
      "subcategory": "Security",
      "text": "Perform ongoing penetration testing and security code reviews.",
      "guid": "3c1538b4-5676-4b85-b451-432befb37b4f",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing"
    },
    {
      "category": "Security",
      "subcategory": "Security",
      "text": "Understand your tenants' compliance requirements, including data residency and any compliance or regulatory standards that they require you to meet.",
      "guid": "5fca45ce-cf2d-42c0-a62c-aac92ba31498",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/governance-compliance"
    },
    {
      "category": "Security",
      "subcategory": "Security",
      "text": "Correctly manage domain names and avoid vulnerabilities like dangling DNS and subdomain takeover attacks.",
      "guid": "30adb90d-83d4-4a2e-986e-327ffe04e7a5",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/domain-names"
    },
    {
      "category": "Security",
      "subcategory": "Security",
      "text": "Follow service-specific guidance for multitenancy.",
      "guid": "72ded36d-c633-4e0d-bd41-799a29da3481",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/service/overview"
    },
    {
      "category": "Cost Optimization",
      "subcategory": "Cost Optimization",
      "text": "Review the Azure Well-Architected Operational Excellence checklist, which is applicable to all workloads.",
      "guid": "db30a9fc-9b1d-40f3-ab90-01f6a3e87fc8",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/architecture/framework/cost/design-checklist"
    },
    {
      "category": "Cost Optimization",
      "subcategory": "Cost Optimization",
      "text": "Ensure you can adequately measure per-tenant consumption and correlate it with your infrastructure costs.",
      "guid": "8533af39-52f6-45b6-a9c3-81b2a54a31e0",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/measure-consumption"
    },
    {
      "category": "Cost Optimization",
      "subcategory": "Cost Optimization",
      "text": "Avoid antipatterns. Antipatterns include failing to track costs, tracking costs with unnecessary precision, real-time measurement, and using monitoring tools for billing.",
      "guid": "c851fd44-7cf1-459c-95a4-f6455d75a981",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/cost-management-allocation"
    },
    {
      "category": "Operational Excellence",
      "subcategory": "Operational Excellence",
      "text": "Review the Azure Well-Architected Operational Excellence checklist, which is applicable to all workloads.",
      "guid": "0d475a5a-2c0f-47ab-b1e1-701da68d3407",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/architecture/checklist/data-ops"
    },
    {
      "category": "Operational Excellence",
      "subcategory": "Operational Excellence",
      "text": "Use automation to manage the tenant lifecycle, such as onboarding, deployment, provisioning, and configuration.",
      "guid": "9f7fa7a9-47fc-4f04-81f6-9f9e87571ed3",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenant-lifecycle"
    },
    {
      "category": "Operational Excellence",
      "subcategory": "Operational Excellence",
      "text": "Find the right balance for deploying service updates. Consider both your tenants' requirements and your own operational requirements.",
      "guid": "e0bfceed-4f4e-492d-b9f5-898815faa363",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/updates"
    },
    {
      "category": "Operational Excellence",
      "subcategory": "Operational Excellence",
      "text": "Monitor the health of the overall system, as well as each tenant.",
      "guid": "a3f80518-d428-4c02-b2cc-dfaef47db7e2",
      "severity": "High"
    },
    {
      "category": "Operational Excellence",
      "subcategory": "Operational Excellence",
      "text": "Configure and test alerts to notify you when specific tenants are experiencing issues or are exceeding their consumption limits.",
      "guid": "dfb42da5-f871-4953-9e5c-da6fda3f1411",
      "severity": "Medium"
    },
    {
      "category": "Operational Excellence",
      "subcategory": "Operational Excellence",
      "text": "Organize your Azure resources for isolation and scale.",
      "guid": "c0c72a1b-e34d-4b3d-b808-2e49f51ce47e",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/resource-organization"
    },
    {
      "category": "Operational Excellence",
      "subcategory": "Operational Excellence",
      "text": "Avoid deployment and configuration antipatterns. Antipatterns include running separate versions of the solution for each tenant, hardcoding tenant-specific configurations or logic, and manual deployments.",
      "guid": "c5c5e22d-4b51-4cac-a980-f7aac1a4b427",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/deployment-configuration"
    },
    {
      "category": "Performance Efficiency",
      "subcategory": "Performance Efficiency",
      "text": "Review the Azure Well-Architected Performance Efficiency checklist, which is applicable to all workloads.",
      "guid": "f0b1fbd8-689c-4ab3-be1d-ad7607d2fbfd",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/architecture/framework/scalability/performance-efficiency"
    },
    {
      "category": "Performance Efficiency",
      "subcategory": "Performance Efficiency",
      "text": "If you use shared infrastructure, plan for how you'll mitigate Noisy Neighbor concerns. Ensure that one tenant can't reduce the performance of the system for other tenants.",
      "guid": "18911c4c-934c-49a8-839a-60c092afce30",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/architecture/antipatterns/noisy-neighbor/noisy-neighbor"
    },
    {
      "category": "Performance Efficiency",
      "subcategory": "Performance Efficiency",
      "text": "Determine how you'll scale your compute, storage, networking, and other Azure resources to match the demands of your tenants.",
      "guid": "6acf7eb5-24a3-47c7-ae87-1196cd96048e",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute"
    },
    {
      "category": "Performance Efficiency",
      "subcategory": "Performance Efficiency",
      "text": "Consider each Azure resource's scale limits. Organize your resources appropriately, in order to avoid resource organization antipatterns. For example, don't over-architect your solution to work within unrealistic scale requirements.",
      "guid": "ea55400d-f97d-45aa-b71b-34224bf91ed4",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/resource-organization"
    }
  ],
  "categories": [
    {
      "name": "Business"
    },
    {
      "name": "Reliability"
    },
    {
      "name": "Security"
    },
    {
      "name": "Cost Optimization"
    },
    {
      "name": "Operational Excellence"
    },
    {
      "name": "Performance Efficiency"
    },
    {
      "name": "Application Deployment"
    }
  ],
  "status": [
    {
      "name": "Not verified",
      "description": "This check has not been looked at yet"
    },
    {
      "name": "Open",
      "description": "There is an action item associated to this check"
    },
    {
      "name": "Fulfilled",
      "description": "This check has been verified, and there are no further action items associated to it"
    },
    {
      "name": "Not required",
      "description": "Recommendation understood, but not needed by current requirements"
    },
    {
      "name": "N/A",
      "description": "Not applicable for current design"
    }
  ],
  "severities": [
    {
      "name": "High"
    },
    {
      "name": "Medium"
    },
    {
      "name": "Low"
    }
  ],
  "metadata": {
    "name": "Multitenant architecture",
    "state": "GA"
  }
}


checklists/lz_checklist.pt.json METASEP
{
    "categories": [
        {
            "name": "Identidade e Acesso"
        },
        {
            "name": "Topologia e conectividade de rede"
        },
        {
            "name": "Segurança, Governança e Conformidade"
        },
        {
            "name": "Gestão e Monitoramento"
        },
        {
            "name": "Grupo de Gerenciamento e Assinaturas"
        },
        {
            "name": "Operações"
        },
        {
            "name": "Backup e recuperação de desastres"
        }
    ],
    "items": [
        {
            "category": "Backup e recuperação de desastres",
            "guid": "7ea02e1c-7166-45a3-bdf5-098891367fcb",
            "link": "https://learn.microsoft.com/en-us/azure/reliability/cross-region-replication-azure",
            "severity": "Média",
            "subcategory": "Proteção de Dados",
            "text": "Considere a replicação entre regiões no Azure para BCDR com regiões emparelhadas"
        },
        {
            "category": "Backup e recuperação de desastres",
            "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
            "link": "https://learn.microsoft.com/en-us/azure/storage/common/storage-redundancy",
            "severity": "Média",
            "subcategory": "Proteção de Dados",
            "text": "Ao usar o Backup do Azure, considere os diferentes tipos de backup (GRS, ZRS & LRS), pois a configuração padrão é GRS"
        },
        {
            "category": "Identidade e Acesso",
            "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
            "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
            "severity": "Alto",
            "subcategory": "Identidade",
            "text": "Implemente para acesso de emergência ou contas de quebra de vidro para evitar o bloqueio de conta em todo o locatário",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "Identidade e Acesso",
            "guid": "348ef254-c27d-442e-abba-c7571559ab91",
            "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
            "severity": "Alto",
            "subcategory": "Identidade",
            "text": "Impor um modelo RBAC para grupos de gerenciamento, assinaturas, grupos de recursos e recursos",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "Identidade e Acesso",
            "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
            "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
            "severity": "Baixo",
            "subcategory": "Identidade",
            "text": "Impor políticas de acesso condicional do Azure AD para qualquer usuário com direitos para ambientes do Azure",
            "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/"
        },
        {
            "category": "Identidade e Acesso",
            "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
            "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
            "severity": "Alto",
            "subcategory": "Identidade",
            "text": "Impor autenticação multifator para qualquer usuário com direitos para os ambientes do Azure",
            "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/"
        },
        {
            "category": "Identidade e Acesso",
            "guid": "e6a83de5-de32-4c19-a248-1607d5d1e4e6",
            "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
            "severity": "Média",
            "subcategory": "Identidade",
            "text": "Impor responsabilidades centralizadas e delegadas para gerenciar recursos implantados dentro da zona de aterrissagem, com base nos requisitos de função e segurança",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/"
        },
        {
            "category": "Identidade e Acesso",
            "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
            "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
            "severity": "Média",
            "subcategory": "Identidade",
            "text": "Impor o MIM (Gerenciamento de Identidades Privilegiadas) do Azure AD para estabelecer zero acesso permanente e privilégio mínimo",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "Identidade e Acesso",
            "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
            "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
            "severity": "Alto",
            "subcategory": "Identidade",
            "text": "Use apenas o tipo de autenticação Conta corporativa ou de estudante para todos os tipos de conta. Evite usar a conta da Microsoft",
            "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/"
        },
        {
            "category": "Identidade e Acesso",
            "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
            "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
            "severity": "Média",
            "subcategory": "Identidade",
            "text": "Use apenas grupos para atribuir permissões. Adicione grupos locais ao grupo somente do Azure AD se um sistema de gerenciamento de grupo já estiver em vigor.",
            "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/"
        },
        {
            "category": "Identidade e Acesso",
            "guid": "f5664b5e-984a-4859-a773-e7d261623a76",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
            "severity": "Média",
            "subcategory": "Identidade",
            "text": "Considere o uso de funções personalizadas do Azure para as seguintes funções principais: proprietário da plataforma Azure, gerenciamento de rede, operações de segurança, proprietário da assinatura, proprietário do aplicativo",
            "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/"
        },
        {
            "category": "Identidade e Acesso",
            "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
            "link": "https://azure.microsoft.com/resources/achieving-compliant-data-residency-and-security-with-azure/",
            "severity": "Média",
            "subcategory": "Identidade",
            "text": "Se existirem requisitos de soberania de dados, as Políticas do Azure poderão ser implantadas para aplicá-los",
            "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/"
        },
        {
            "category": "Identidade e Acesso",
            "guid": "1559ab91-53e8-4908-ae28-c84c33b6b780",
            "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
            "severity": "Média",
            "subcategory": "Identidade",
            "text": "Se os AADDS (Serviços de Domínios Active Directory) do Azure estiverem em uso, implante AADDS na região primária, pois esse serviço só poderá ser projetado em uma assinatura",
            "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/"
        },
        {
            "category": "Identidade e Acesso",
            "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
            "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
            "severity": "Média",
            "subcategory": "Identidade",
            "text": "Se AADDS em uso, avalie a compatibilidade de todas as cargas de trabalho",
            "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/"
        },
        {
            "category": "Identidade e Acesso",
            "guid": "ac6a9e01-e6a8-43de-9de3-2c1992481607",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
            "severity": "Média",
            "subcategory": "Identidade",
            "text": "Se o AD no servidor Windows estiver em uso, todos os recursos necessários poderão acessar o controlador de domínio correto?",
            "training": "https://learn.microsoft.com/learn/paths/implement-windows-server-iaas-virtual-machine-identity/"
        },
        {
            "category": "Identidade e Acesso",
            "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
            "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
            "severity": "Média",
            "subcategory": "Identidade",
            "text": "Considere o uso do Proxy de Aplicativo do Azure AD como uma substituição de VPN ou proxy reverso para oferecer aos usuários remotos acesso seguro e autenticado a aplicativos internos (hospedados na nuvem ou no local).",
            "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/"
        },
        {
            "category": "Identidade e Acesso",
            "guid": "35037e68-9349-4c15-b371-228514f4cdff",
            "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
            "severity": "Média",
            "subcategory": "Identidade",
            "text": "Evite usar contas sincronizadas locais para atribuições de função do Azure AD.",
            "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/"
        },
        {
            "category": "Grupo de Gerenciamento e Assinaturas",
            "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
            "guid": "2df27ee4-12e7-4f98-9f63-04722dd69c5b",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
            "severity": "Média",
            "subcategory": "Assinaturas",
            "text": "Impor hierarquia de grupo de gerenciamento razoavelmente plana com não mais de três a quatro níveis, idealmente",
            "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/"
        },
        {
            "category": "Grupo de Gerenciamento e Assinaturas",
            "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
            "guid": "5c2622f5-4b69-4bad-93aa-d5e8c68e1d76",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/resource-tagging/?toc=/azure/azure-resource-manager/management/toc.json",
            "severity": "Média",
            "subcategory": "Assinaturas",
            "text": "Impor ou acrescentar marcas de recurso por meio da Política do Azure",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "Grupo de Gerenciamento e Assinaturas",
            "guid": "667313b4-f566-44b5-b984-a859c773e7d2",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
            "severity": "Média",
            "subcategory": "Assinaturas",
            "text": "Impor um grupo de gerenciamento de área restrita para permitir que os usuários experimentem imediatamente o Azure",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/"
        },
        {
            "category": "Grupo de Gerenciamento e Assinaturas",
            "guid": "61623a76-5a91-47e1-b348-ef254c27d42e",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
            "severity": "Média",
            "subcategory": "Assinaturas",
            "text": "Impor um grupo de gerenciamento de plataforma sob o grupo de gerenciamento raiz para dar suporte à política de plataforma comum e à atribuição de função do Azure",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/"
        },
        {
            "category": "Grupo de Gerenciamento e Assinaturas",
            "guid": "8bbac757-1559-4ab9-853e-8908ae28c84c",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
            "severity": "Média",
            "subcategory": "Assinaturas",
            "text": "Imponha uma assinatura de conectividade dedicada no grupo de gerenciamento de Plataforma para hospedar um hub WAN Virtual do Azure, DNS (Sistema de Nomes de Domínio) privado, circuito de Rota Expressa e outros recursos de rede.",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/"
        },
        {
            "category": "Grupo de Gerenciamento e Assinaturas",
            "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant = (array_length(mgmtChain) > 1)",
            "guid": "33b6b780-8b9f-4e5c-9104-9d403a923c34",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---default-management-group",
            "severity": "Média",
            "subcategory": "Assinaturas",
            "text": "Impor que nenhuma assinatura seja colocada sob o grupo de gerenciamento raiz"
        },
        {
            "category": "Grupo de Gerenciamento e Assinaturas",
            "guid": "74d00018-ac6a-49e0-8e6a-83de5de32c19",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization",
            "severity": "Média",
            "subcategory": "Assinaturas",
            "text": "Impor que somente usuários privilegiados possam operar grupos de gerenciamento no locatário habilitando a autorização RBAC do Azure nas configurações de hierarquia do grupo de gerenciamento"
        },
        {
            "category": "Grupo de Gerenciamento e Assinaturas",
            "guid": "92481607-d5d1-4e4e-9146-58d3558fd772",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/overview",
            "severity": "Média",
            "subcategory": "Assinaturas",
            "text": "Aplique grupos de gerenciamento sob o grupo de gerenciamento de nível raiz para representar os tipos de cargas de trabalho, com base em suas necessidades de segurança, conformidade, conectividade e recursos."
        },
        {
            "category": "Grupo de Gerenciamento e Assinaturas",
            "guid": "49b82111-2df2-47ee-912e-7f983f630472",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/overview",
            "severity": "Alto",
            "subcategory": "Assinaturas",
            "text": "Aplique um processo para conscientizar os proprietários de recursos sobre suas funções e responsabilidades, revisão de acesso, revisão de orçamento, conformidade com políticas e correção quando necessário."
        },
        {
            "category": "Grupo de Gerenciamento e Assinaturas",
            "guid": "2dd69c5b-5c26-422f-94b6-9bad33aad5e8",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
            "severity": "Média",
            "subcategory": "Assinaturas",
            "text": "Certifique-se de que todos os proprietários de assinatura e a equipe principal de TI estejam cientes das limitações de recursos de assinatura como parte das sessões de design da carga de trabalho."
        },
        {
            "category": "Grupo de Gerenciamento e Assinaturas",
            "guid": "c68e1d76-6673-413b-9f56-64b5e984a859",
            "link": "https://learn.microsoft.com/azure/cost-management-billing/reservations/save-compute-costs-reservations",
            "severity": "Alto",
            "subcategory": "Assinaturas",
            "text": "Use Instâncias Reservadas, quando apropriado, para otimizar os custos e garantir a capacidade disponível nas regiões de destino. Imponha o uso de SKUs de VM de Instância Reservada adquiridas por meio da Política do Azure.",
            "training": "https://learn.microsoft.com/learn/paths/improve-reliability-modern-operations/"
        },
        {
            "category": "Grupo de Gerenciamento e Assinaturas",
            "guid": "c773e7d2-6162-43a7-95a9-17e1f348ef25",
            "link": "https://learn.microsoft.com/azure/architecture/framework/scalability/design-capacity",
            "severity": "Alto",
            "subcategory": "Assinaturas",
            "text": "Impor um painel, pasta de trabalho ou processo manual para monitorar os níveis de capacidade usados",
            "training": "https://learn.microsoft.com/learn/paths/monitor-usage-performance-availability-resources-azure-monitor/"
        },
        {
            "category": "Grupo de Gerenciamento e Assinaturas",
            "guid": "4c27d42e-8bba-4c75-9155-9ab9153e8908",
            "link": "https://azure.microsoft.com/global-infrastructure/services/",
            "severity": "Média",
            "subcategory": "Assinaturas",
            "text": "Verifique se os serviços e recursos necessários estão disponíveis nas regiões de implantação escolhidas",
            "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/"
        },
        {
            "category": "Grupo de Gerenciamento e Assinaturas",
            "guid": "ae28c84c-33b6-4b78-88b9-fe5c41049d40",
            "link": "https://learn.microsoft.com/azure/cost-management-billing/cost-management-billing-overview",
            "severity": "Alto",
            "subcategory": "Assinaturas",
            "text": "Impor um processo para gerenciamento de custos",
            "training": "https://learn.microsoft.com/learn/paths/control-spending-manage-bills/"
        },
        {
            "category": "Grupo de Gerenciamento e Assinaturas",
            "guid": "3a923c34-74d0-4001-aac6-a9e01e6a83de",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/overview",
            "severity": "Média",
            "subcategory": "Assinaturas",
            "text": "Se o AD estiver no Windows Server, estabeleça uma assinatura de identidade dedicada no grupo Gerenciamento de plataforma para hospedar controladores de domínio do Active Directory do Windows Server",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/"
        },
        {
            "category": "Grupo de Gerenciamento e Assinaturas",
            "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
            "guid": "5de32c19-9248-4160-9d5d-1e4e614658d3",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/track-costs",
            "severity": "Média",
            "subcategory": "Assinaturas",
            "text": "Garantir que as tags sejam usadas para faturamento e gerenciamento de custos",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
            "severity": "Alto",
            "subcategory": "Porta da frente",
            "text": "Adicione configurações de diagnóstico para salvar os logs do WAF do Azure Front Door. Revise regularmente os logs para verificar se há ataques e detecções de falsos positivos."
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
            "severity": "Média",
            "subcategory": "Porta da frente",
            "text": "Envie logs do Azure Front Door para o Microsoft Sentinel. Detecte ataques e integre a telemetria do Front Door ao seu ambiente geral do Azure."
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Use um único espaço de trabalho de logs de monitor para gerenciar plataformas centralmente, exceto onde o controle de acesso baseado em função do Azure (RBAC do Azure), os requisitos de soberania de dados ou as políticas de retenção de dados exigem espaços de trabalho separados.",
            "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "e179b599-de0d-4597-9cd4-cd21b088137f",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "A zona de pouso está documentada?"
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Exporte logs para o Armazenamento do Azure se os requisitos de retenção de logs excederem dois anos. Use o armazenamento imutável com uma política de gravação única e leitura para tornar os dados não apagáveis e não modificáveis para um intervalo especificado pelo usuário.",
            "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/"
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "00f1ce16-ed30-41d6-b872-e52e3611cc58",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Use a Política do Azure para controle de acesso e relatórios de conformidade. A Política do Azure fornece a capacidade de impor configurações em toda a organização para garantir a adesão consistente à política e a detecção rápida de violações. ",
            "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/"
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
            "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Monitore o desvio de configuração da máquina virtual (VM) convidada usando a Política do Azure. Habilitar os recursos de auditoria de configuração de convidado por meio da política ajuda as cargas de trabalho da equipe de aplicativos a consumir imediatamente os recursos de recursos com pouco esforço.",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
            "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Use o Gerenciamento de Atualizações na Automação do Azure como um mecanismo de aplicação de patches de longo prazo para VMs Windows e Linux. ",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/"
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "90483845-c986-4cb2-a131-56a12476e49f",
            "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Usar o Inspetor de Rede para monitorar proativamente os fluxos de tráfego",
            "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/"
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "541acdce-9793-477b-adb3-751ab2ab13ad",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Use bloqueios de recursos para evitar a exclusão acidental de serviços compartilhados críticos.",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "a6e55d7d-8a2a-4db1-87d6-326af625ca44",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "Baixo",
            "subcategory": "Monitorização",
            "text": "Use políticas de negação para complementar as atribuições de função do Azure. A combinação de políticas de negação e atribuições de função do Azure garante que as grades de proteção apropriadas estejam em vigor para impor quem pode implantar e configurar recursos e quais recursos eles podem implantar e configurar."
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "e5695f22-23ac-4e8c-a123-08ca5017f154",
            "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Inclua eventos de integridade de serviços e recursos como parte da solução geral de monitoramento da plataforma. Acompanhar a integridade do serviço e dos recursos da perspectiva da plataforma é um componente importante do gerenciamento de recursos no Azure."
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "d5f345bf-97ab-41a7-819c-6104baa7d48c",
            "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Incluir alertas e grupos de ação como parte da plataforma de Integridade do Serviço do Azure para garantir que alertas ou problemas possam ser acionados"
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "e3ab3693-829e-47e3-8618-3687a0477a20",
            "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Não envie entradas de log brutas de volta para sistemas de monitoramento locais. Em vez disso, adote um princípio de que os dados nascidos no Azure permanecem no Azure. Se a integração do SIEM local for necessária, envie alertas críticos em vez de logs."
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "9945bda4-3334-4f24-a116-34182ba52752",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Use um espaço de trabalho centralizado do Azure Monitor Log Analytics para coletar logs e métricas de recursos de aplicativos IaaS e PaaS e controlar o acesso ao log com o RBAC do Azure."
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Use os Logs do Azure Monitor para obter insights e relatórios."
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "619e8a13-f988-4795-85d6-26886d70ba6c",
            "link": "https://learn.microsoft.com/azure/azure-monitor/agents/diagnostics-extension-overview",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Quando necessário, use contas de armazenamento compartilhado dentro da zona de aterrissagem para o armazenamento de log de extensão de diagnóstico do Azure."
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
            "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Use alertas do Azure Monitor para a geração de alertas operacionais."
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
            "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Use o Azure Site Recovery para cenários de recuperação de desastres de Máquinas Virtuais do Azure para Azure. Isso permite que você replique cargas de trabalho entre regiões."
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "b2ab13ad-a6e5-45d7-b8a2-adb117d6326a",
            "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Certifique-se de usar e testar os recursos nativos de recuperação de desastres do serviço PaaS."
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
            "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Use os recursos de backup nativos do Azure. Verifique se o parceiro/cliente está ciente do Backup do Azure e de todos os novos recursos que podem simplificar muito o gerenciamento de backup"
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "859c3900-4514-41eb-b010-475d695abd74",
            "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Garantir que os requisitos de monitoramento tenham sido avaliados e que as configurações apropriadas de coleta de dados e alertas sejam aplicadas"
        },
        {
            "category": "Gestão e Monitoramento",
            "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
            "link": "https://learn.microsoft.com/en-us/azure/automation/how-to/region-mappings",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Considere as regiões com suporte para contas de espaço de trabalho e automação vinculadas do Log Analytics"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "6138a720-0f1c-4e16-bd30-1d6e872e52e3",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
            "severity": "Média",
            "subcategory": "Entrega de aplicativos",
            "text": "Execute a entrega de aplicativos dentro de zonas de aterrissagem para aplicativos internos (corporativos) e externos (online).",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = (properties.webApplicationFirewallConfiguration.enabled == True and properties.webApplicationFirewallConfiguration.firewallMode == 'Prevention')",
            "guid": "611cc58b-5a4b-4151-8e43-a58a9c2299c4",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-faq",
            "severity": "Média",
            "subcategory": "Entrega de aplicativos",
            "text": "Para a entrega segura de aplicativos HTTP/S, verifique se a proteção e as políticas do WAF estão habilitadas em seus Gateways de Aplicativo",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
            "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
            "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
            "severity": "Média",
            "subcategory": "Entrega de aplicativos",
            "text": "Verifique se você está usando a SKU do Application Gateway v2",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "d7b57d0c-6555-462f-8b3e-4563a4d87397",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/organize-resources?tabs=AzureManagementGroupsAndHierarchy",
            "severity": "Média",
            "subcategory": "Entrega de aplicativos",
            "text": "Use um NVA de parceiro se não puder usar o Application Gateway v2 para a segurança de aplicativos HTTP/S.",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "Média",
            "subcategory": "Entrega de aplicativos",
            "text": "Implante o Gateway de Aplicativo do Azure v2 ou NVAs de parceiros usados para conexões HTTP/S de entrada na rede virtual da zona de aterrissagem e com os aplicativos que eles estão protegendo.",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "Média",
            "subcategory": "Entrega de aplicativos",
            "text": "Use uma rede DDoS ou planos de proteção IP para todos os endereços IP públicos em zonas de aterrissagem de aplicativos.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "Média",
            "subcategory": "Entrega de aplicativos",
            "text": "Use o Azure Front Door com políticas WAF para fornecer e ajudar a proteger aplicativos HTTP/S globais que abrangem regiões do Azure.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
            "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
            "severity": "Média",
            "subcategory": "Entrega de aplicativos",
            "text": "Ao usar o Front Door e o Application Gateway para ajudar a proteger aplicativos HTTP/S, use as políticas do WAF no Front Door. Bloqueie o Application Gateway para receber tráfego somente da Porta da Frente.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "Média",
            "subcategory": "Entrega de aplicativos",
            "text": "Use o Gerenciador de Tráfego para fornecer aplicativos globais que abrangem protocolos diferentes de HTTP/S.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
            "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
            "severity": "Baixo",
            "subcategory": "Entrega de aplicativos",
            "text": "Se os usuários só precisarem de acesso a aplicativos internos, o Proxy de Aplicativo do Azure AD foi considerado uma alternativa ao AVD (Área de Trabalho Virtual do Azure)?",
            "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
            "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
            "severity": "Média",
            "subcategory": "Entrega de aplicativos",
            "text": "Para reduzir o número de portas de firewall abertas para conexões de entrada em sua rede, considere o uso do Proxy de Aplicativo do Azure AD para fornecer aos usuários remotos acesso seguro e autenticado a aplicativos internos.",
            "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "Média",
            "subcategory": "Encriptação",
            "text": "Quando estiver usando o ExpressRoute Direct, configure o MACsec para criptografar o tráfego no nível de camada dois entre os roteadores da organização e o MSEE. O diagrama mostra essa criptografia em fluxo."
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
            "severity": "Média",
            "subcategory": "Encriptação",
            "text": "Para cenários em que o MACsec não é uma opção (por exemplo, não usar o ExpressRoute Direct), use um gateway VPN para estabelecer túneis IPsec sobre o emparelhamento privado da Rota Expressa. ",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
            "guid": "ae248989-b306-4591-9186-de482e3f0f0e",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
            "severity": "Média",
            "subcategory": "Porta da frente",
            "text": "Implante seus perfis WAF para Front Door no modo 'Prevenção'."
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "062d5839-4d36-402f-bfa4-02811eb936e9",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
            "severity": "Alto",
            "subcategory": "Porta da frente",
            "text": "Evite combinar o Azure Traffic Manager e o Azure Front Door."
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
            "severity": "Média",
            "subcategory": "Porta da frente",
            "text": "Use o mesmo nome de domínio no Azure Front Door e sua origem. Nomes de host incompatíveis podem causar bugs sutis."
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
            "severity": "Baixo",
            "subcategory": "Porta da frente",
            "text": "Desative os testes de integridade quando houver apenas uma origem em um grupo de origem do Azure Front Door."
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
            "severity": "Média",
            "subcategory": "Porta da frente",
            "text": "Selecione bons pontos de extremidade de teste de integridade para o Azure Front Door. Considere a criação de pontos de extremidade de integridade que verificam todas as dependências do seu aplicativo."
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
            "severity": "Baixo",
            "subcategory": "Porta da frente",
            "text": "Use as sondas de integridade do HEAD com o Azure Front Door para reduzir o tráfego que o Front Door envia para seu aplicativo."
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
            "severity": "Média",
            "subcategory": "Hub e spoke",
            "text": "Considere um design de rede baseado na topologia de rede hub-and-spoke tradicional para os seguintes cenários: uma arquitetura de rede implantada em uma única região do Azure; uma arquitetura de rede abrange várias regiões do Azure sem necessidade de conectividade transitiva entre redes virtuais para zonas de aterrissagem entre regiões; uma arquitetura de rede que abrange várias regiões do Azure com emparelhamento de rede virtual global usado para conectar redes virtuais entre regiões do Azure; uma arquitetura de rede sem necessidade de conectividade transitiva entre conexões VPN e ExpressRoute; o principal método de conectividade híbrida em vigor é a Rota Expressa, e o número de conexões VPN é inferior a 30 por gateway VPN; há uma dependência de NVAs centralizados e roteamento granular.",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute",
            "severity": "Média",
            "subcategory": "Hub e spoke",
            "text": "Verifique se os serviços compartilhados, incluindo gateways da Rota Expressa, gateways de VPN e Firewall do Azure ou NVAs de parceiros na rede virtual do hub central. Se necessário, implante também controladores de domínio do Active Directory e servidores DNS."
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
            "severity": "Média",
            "subcategory": "Hub e spoke",
            "text": "Ao implantar tecnologias de rede de parceiros ou NVAs, siga as orientações do fornecedor do parceiro"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "44ce3b1a-2808-4b9e-a1bf-1038df03a822",
            "link": "https://azure.microsoft.com/solutions/network-appliances/",
            "severity": "Média",
            "subcategory": "Hub e spoke",
            "text": "Não implante serviços L7 de entrada, como o Gateway de Aplicativo do Azure, como um serviço compartilhado na rede virtual do hub central. Em vez disso, implante-os junto com o aplicativo em suas respectivas zonas de aterrissagem."
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
            "severity": "Média",
            "subcategory": "Hub e spoke",
            "text": "Se você precisar de trânsito entre gateways de Rota Expressa e VPN, use o Servidor de Rota do Azure."
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
            "severity": "Média",
            "subcategory": "Hub e spoke",
            "text": "Para arquiteturas de rede com várias topologias hub-and-spoke em regiões do Azure, use o Emparelhamento de Rede Virtual Global para conectar redes virtuais de zona de aterrissagem quando um pequeno número de zonas de aterrissagem precisar se comunicar entre regiões. ",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "37239b82-1112-4dbd-9eaf-12e6f943e53f",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs",
            "severity": "Média",
            "subcategory": "Hub e spoke",
            "text": "Quando você implanta uma arquitetura de rede hub-and-spoke em duas regiões do Azure e a conectividade de trânsito entre todas as zonas de aterrissagem entre regiões é necessária, use a Rota Expressa com circuitos duplos para fornecer conectividade de trânsito para redes virtuais de zona de aterrissagem em regiões do Azure. ",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
            "severity": "Média",
            "subcategory": "Hub e spoke",
            "text": "Use o Azure Monitor for Networks para monitorar o estado de ponta a ponta das redes no Azure.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
            "severity": "Média",
            "subcategory": "Hub e spoke",
            "text": "Ao conectar redes virtuais spoke à rede virtual do hub central, considere os limites de emparelhamento de rede virtual e o número máximo de prefixos que podem ser anunciados via Rota Expressa"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
            "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
            "severity": "Alto",
            "subcategory": "Hub e spoke",
            "text": "Use a configuração 'Permitir tráfego para rede virtual remota' ao configurar emparelhamentos de rede virtual"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli",
            "severity": "Média",
            "subcategory": "Híbrido",
            "text": "Verifique se você investigou a possibilidade de usar a Rota Expressa como conexão principal com o Azure.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
            "severity": "Média",
            "subcategory": "Híbrido",
            "text": "Ao usar vários circuitos da Rota Expressa ou vários locais locais, certifique-se de otimizar o roteamento com atributos BGP, se determinados caminhos forem preferidos.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
            "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
            "severity": "Média",
            "subcategory": "Híbrido",
            "text": "Verifique se você está usando a SKU correta para os gateways de Rota Expressa/VPN com base nos requisitos de largura de banda e desempenho.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
            "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
            "severity": "Média",
            "subcategory": "Híbrido",
            "text": "Implante um gateway de Rota Expressa com redundância de zona nas regiões do Azure com suporte.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
            "link": "https://learn.microsoft.com/azure/networking/",
            "severity": "Média",
            "subcategory": "Híbrido",
            "text": "Para cenários que exigem largura de banda superior a 10 Gbps ou portas dedicadas de 10/100 Gbps, use o ExpressRoute Direct.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
            "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
            "severity": "Média",
            "subcategory": "Híbrido",
            "text": "Quando for necessária baixa latência ou a taxa de transferência do local para o Azure deve ser superior a 10 Gbps, habilite o FastPath para ignorar o gateway da Rota Expressa do caminho de dados.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
            "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
            "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
            "severity": "Média",
            "subcategory": "Híbrido",
            "text": "Use gateways VPN para conectar filiais ou locais remotos ao Azure. Para maior resiliência, implante gateways com redundância de zona (quando disponíveis).",
            "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "fe237de1-43b1-46c3-8d7a-a9b64704489a",
            "link": "https://learn.microsoft.com/azure/networking/",
            "severity": "Média",
            "subcategory": "Híbrido",
            "text": "Use o Alcance Global da Rota Expressa para conectar grandes escritórios, sedes regionais ou datacenters conectados ao Azure via Rota Expressa.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
            "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
            "severity": "Média",
            "subcategory": "Híbrido",
            "text": "Quando o isolamento de tráfego ou a largura de banda dedicada forem necessários, como para separar ambientes de produção e não produção, use circuitos de Rota Expressa diferentes. Ele ajudará você a garantir domínios de roteamento isolados e aliviar os riscos de vizinhos barulhentos.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
            "severity": "Média",
            "subcategory": "Híbrido",
            "text": "Monitore a disponibilidade e a utilização da Rota Expressa usando métricas internas do Azure Monitor.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
            "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
            "severity": "Média",
            "subcategory": "Híbrido",
            "text": "Use o Monitor de Conexão para monitoramento de conectividade em todo o ambiente.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
            "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#challenges-of-using-multiple-expressroute-circuits",
            "severity": "Média",
            "subcategory": "Híbrido",
            "text": "Não use explicitamente circuitos de Rota Expressa de um único local de emparelhamento. Isso cria um único ponto de falha e torna a organização suscetível a interrupções de local de emparelhamento.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "cd163e39-84a5-4b39-97b7-6973abd70d94",
            "link": "https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-staging-server",
            "severity": "Média",
            "subcategory": "Híbrido",
            "text": "Ao implantar uma VM do AD Connect, considere ter um servidor de preparo para alta disponibilidade / recuperação de desastres"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
            "link": "https://learn.microsoft.com/en-us/azure/bastion/bastion-overview",
            "severity": "Média",
            "subcategory": "Híbrido",
            "text": "Considere usar o Bastion para se conectar com segurança à sua rede."
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
            "severity": "Média",
            "subcategory": "Plano IP",
            "text": "Garantir que não haja sobreposição de espaços de endereço IP em regiões do Azure e locais locais",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)')  | project id, compliant, cidr",
            "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
            "severity": "Média",
            "subcategory": "Plano IP",
            "text": "Certifique-se de usar endereços IP da alocação de endereços para internets privadas (RFC 1918).",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
            "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
            "severity": "Média",
            "subcategory": "Plano IP",
            "text": "Certifique-se de que o espaço de endereço IP não seja desperdiçado, não crie redes virtuais desnecessariamente grandes (por exemplo, /16) ",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "e984a859-c773-4e7d-8616-23a765a917e1",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
            "severity": "Média",
            "subcategory": "Plano IP",
            "text": "Garantir que não haja intervalo de endereços IP públicos (bloco CIDR) para VNETs, especialmente se não pertencerem à sua organização",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
            "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
            "severity": "Média",
            "subcategory": "Plano IP",
            "text": "Evite usar intervalos de endereços IP sobrepostos para sites de produção e DR.",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
            "severity": "Média",
            "subcategory": "Plano IP",
            "text": "Para ambientes em que a resolução de nomes no Azure é tudo o que é necessário, use o DNS Privado do Azure para resolução. Crie uma zona delegada para resolução de nomes (como 'azure.contoso.com').",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
            "severity": "Média",
            "subcategory": "Plano IP",
            "text": "Para ambientes em que a resolução de nomes no Azure e no local é necessária, use a infraestrutura DNS existente (por exemplo, DNS integrado ao Active Directory) implantada em pelo menos duas máquinas virtuais (VMs). Defina as configurações de DNS em redes virtuais para usar esses servidores DNS.",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
            "severity": "Média",
            "subcategory": "Plano IP",
            "text": "Cargas de trabalho especiais que exigem e implantam seu próprio DNS (como o Red Hat OpenShift) devem usar sua solução DNS preferida."
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "614658d3-558f-4d77-849b-821112df27ee",
            "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
            "severity": "Média",
            "subcategory": "Plano IP",
            "text": "Habilite o registro automático para o DNS do Azure para gerenciar automaticamente o ciclo de vida dos registros DNS para as máquinas virtuais implantadas em uma rede virtual.",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "1e43a58a-9c22-499c-9d7b-57d0c655562f",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
            "severity": "Média",
            "subcategory": "Inspeção",
            "text": "Use os pacotes do Network Watcher para capturar, apesar da janela de captura limitada.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "a65498f6-dfe2-437d-b143-b16c31d7aa9b",
            "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
            "severity": "Média",
            "subcategory": "Inspeção",
            "text": "Use soluções de parceiros para cenários que exijam inspeção profunda de pacotes."
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "Média",
            "subcategory": "Internet",
            "text": "Usar o Firewall do Azure para controlar o tráfego de saída do Azure para a Internet, as conexões de entrada não HTTP/S e a filtragem de tráfego Leste/Oeste (se a organização exigir)",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "resources | where type == 'microsoft.network/azurefirewalls' | project id,compliant=isnotnull(properties.firewallPolicy.id)",
            "guid": "0f1ce16e-d301-4d6e-a72e-52e3611cc58b",
            "link": "https://learn.microsoft.com/azure/firewall/",
            "severity": "Média",
            "subcategory": "Internet",
            "text": "Use o Gerenciador de Firewall com WAN Virtual para implantar e gerenciar firewalls do Azure em hubs de WAN Virtual ou em redes virtuais de hub.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
            "link": "https://learn.microsoft.com/azure/firewall/",
            "severity": "Média",
            "subcategory": "Internet",
            "text": "Crie uma política global do Firewall do Azure para controlar a postura de segurança no ambiente de rede global e atribua-a a todas as instâncias do Firewall do Azure. Permita que políticas granulares atendam aos requisitos de regiões específicas delegando políticas de firewall incrementais a equipes de segurança locais por meio do controle de acesso baseado em função do Azure.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
            "link": "https://learn.microsoft.com/azure/firewall/",
            "severity": "Média",
            "subcategory": "Internet",
            "text": "Configure provedores de segurança SaaS de parceiros com suporte no Firewall Manager se a organização quiser usar essas soluções para ajudar a proteger as conexões de saída.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "d15f512a-6549-48f6-bfe2-37de143b16c3",
            "link": "https://learn.microsoft.com/azure/firewall/",
            "severity": "Média",
            "subcategory": "Internet",
            "text": "Use o WAF em uma rede virtual de zona de aterrissagem para proteger o tráfego HTTP/S de entrada da Internet.",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
            "severity": "Média",
            "subcategory": "Internet",
            "text": "Use as políticas do Azure Front Door e do WAF para fornecer proteção global em todas as regiões do Azure para conexões HTTP/S de entrada em uma zona de aterrissagem.",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "Média",
            "subcategory": "Internet",
            "text": "Ao usar o Azure Front Door e o Azure Application Gateway para ajudar a proteger aplicativos HTTP/S, use políticas WAF no Azure Front Door. Bloqueie o Gateway de Aplicativo do Azure para receber tráfego somente do Azure Front Door.",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "Média",
            "subcategory": "Internet",
            "text": "Se os NVAs de parceiros forem necessários para conexões HTTP/S de entrada, implante-os em uma rede virtual de zona de aterrissagem e junto com os aplicativos que eles estão protegendo e expondo à Internet.",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
            "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
            "severity": "Média",
            "subcategory": "Internet",
            "text": "Use os planos de Rede DDoS ou Proteção IP do Azure para ajudar a proteger os pontos de extremidade de Endereços IP Públicos nas redes virtuais.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "e504547c-2447-4ec6-9138-a7200f1ce16e",
            "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
            "severity": "Média",
            "subcategory": "Paas",
            "text": "Se você precisar de comunicação privada com serviços PaaS, considere as diferentes opções disponíveis.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-private-access-to-azure-services/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
            "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
            "severity": "Média",
            "subcategory": "Paas",
            "text": "Os serviços de PaaS do Azure que foram injetados em uma rede virtual ainda executam operações de plano de gerenciamento usando endereços IP públicos. Certifique-se de que esta comunicação não está quebrada",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "e43a58a9-c229-49c4-b7b5-7d0c655562f2",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "Média",
            "subcategory": "Paas",
            "text": "Use o Link Privado, quando disponível, para serviços compartilhados de PaaS do Azure.",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "Média",
            "subcategory": "Paas",
            "text": "Acesse os serviços de PaaS do Azure no local por meio do emparelhamento privado da Rota Expressa. Este método evita o trânsito pela Internet pública.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "65498f6d-fe23-47de-843b-16c31d7aa9b6",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "Média",
            "subcategory": "Paas",
            "text": "Usar pontos de extremidade de serviço de rede virtual quando o Link Privado não estiver disponível",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
            "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "Média",
            "subcategory": "Paas",
            "text": "Não habilite pontos de extremidade de serviço de rede virtual por padrão em todas as sub-redes.",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "Média",
            "subcategory": "Paas",
            "text": "Não use pontos de extremidade de serviço de rede virtual quando houver preocupações de exfiltração de dados, a menos que você use a filtragem NVA.",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "179b599d-e0d5-4973-ad4c-d21b088137f5",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "Média",
            "subcategory": "Paas",
            "text": "Não implemente o túnel forçado para habilitar a comunicação do Azure para os recursos do Azure.",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
            "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
            "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
            "severity": "Média",
            "subcategory": "Segmentação",
            "text": "Não confie nas regras padrão de entrada NSG usando a etiqueta de serviço VirtualNetwork para limitar a conectividade."
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "c2447ec6-6138-4a72-80f1-ce16ed301d6e",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
            "severity": "Média",
            "subcategory": "Segmentação",
            "text": "Delegue a criação de sub-redes ao proprietário da zona de aterrissagem. ",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "Média",
            "subcategory": "Segmentação",
            "text": "Use NSGs para ajudar a proteger o tráfego entre sub-redes, bem como o tráfego leste/oeste através da plataforma (tráfego entre zonas de pouso).",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)",
            "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563",
            "severity": "Média",
            "subcategory": "Segmentação",
            "text": "A equipe de aplicativos deve usar grupos de segurança de aplicativos nos NSGs no nível da sub-rede para ajudar a proteger VMs de várias camadas dentro da zona de aterrissagem.",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "Média",
            "subcategory": "Segmentação",
            "text": "Use NSGs e grupos de segurança de aplicativos para microssegmentar o tráfego dentro da zona de aterrissagem e evite usar um NVA central para filtrar os fluxos de tráfego.",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "Média",
            "subcategory": "Segmentação",
            "text": "Habilite os logs de fluxo do NSG e alimente-os no Traffic Analytics para obter insights sobre os fluxos de tráfego internos e externos.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "a8042d88-e79d-417b-93b2-2a5a67e7a8ed",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "Média",
            "subcategory": "Segmentação",
            "text": "Use NSGs para permitir seletivamente a conectividade entre zonas de aterrissagem.",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "4b30e38c-3f29-4812-a236-3cefe179b599",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "Média",
            "subcategory": "Segmentação",
            "text": "Para topologias de WAN Virtual, roteie o tráfego entre zonas de aterrissagem por meio do Firewall do Azure se a organização exigir recursos de filtragem e log para o tráfego que flui entre zonas de aterrissagem.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
            "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
            "severity": "Média",
            "subcategory": "Virtual WAN",
            "text": "Considere a WAN Virtual para gerenciamento simplificado de rede do Azure e verifique se o cenário está explicitamente descrito na lista de designs de roteamento da WAN Virtual",
            "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "Média",
            "subcategory": "Virtual WAN",
            "text": "Use um hub WAN Virtual por região do Azure para conectar várias zonas de aterrissagem entre regiões do Azure por meio de uma WAN Virtual do Azure global comum."
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "4f5664b5-e984-4a85-ac77-3e7d261623a7",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "Média",
            "subcategory": "Virtual WAN",
            "text": "Use os recursos de Roteamento de Hub Virtual para segmentar ainda mais o tráfego entre redes virtuais e ramificações."
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "65a917e1-f348-4ef2-94c2-7d42e8bbac75",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "Média",
            "subcategory": "Virtual WAN",
            "text": "Conectar hubs WAN virtuais a datacenters locais usando a Rota Expressa",
            "training": "https://learn.microsoft.com/learn/modules/configure-expressroute-virtual-wan/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "71559ab9-153e-4890-aae2-8c84c33b6b78",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "Média",
            "subcategory": "Virtual WAN",
            "text": "Conecte filiais e locais remotos ao hub WAN Virtual mais próximo por meio de VPN Site a Site ou habilite a conectividade de filiais com a WAN Virtual por meio de uma solução de parceiro SD-WAN.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-hybrid-networking/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "08b9fe5c-4104-49d4-83a9-23c3474d0001",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "Média",
            "subcategory": "Virtual WAN",
            "text": "Conecte os usuários ao hub WAN Virtual por meio de uma VPN Ponto a Site.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-hybrid-networking/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "Média",
            "subcategory": "Virtual WAN",
            "text": "Siga o princípio \"o tráfego no Azure permanece no Azure\" para que a comunicação entre recursos no Azure ocorra por meio da rede de backbone da Microsoft"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "Média",
            "subcategory": "Virtual WAN",
            "text": "Para proteção e filtragem do tráfego de saída da Internet, implante o Firewall do Azure",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "12df27ee-412e-47f9-a3f6-304722dd69c5",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "Média",
            "subcategory": "Virtual WAN",
            "text": "Ao implantar tecnologias de rede de parceiros e NVAs na VWAN, verifique a configuração com as diretrizes do fornecedor do parceiro para garantir que não haja configurações conflitantes"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "b5c2622f-54b6-49ba-b33a-ad5e8c68e1d7",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "Média",
            "subcategory": "Virtual WAN",
            "text": "Verifique se os recursos da WAN Virtual do Azure e do Firewall do Azure são criados na assinatura de conectividade."
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
            "severity": "Média",
            "subcategory": "Virtual WAN",
            "text": "Verifique se a arquitetura de rede está dentro dos limites da WAN Virtual do Azure."
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
            "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
            "severity": "Média",
            "subcategory": "Virtual WAN",
            "text": "Use o Azure Monitor Insights para WAN Virtual para monitorar a topologia de ponta a ponta da WAN Virtual, o status e as principais métricas."
        },
        {
            "category": "Topologia e conectividade de rede ",
            "guid": "2df4930f-6a43-49a3-926b-309f02c302f0",
            "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/identity/adds-extend-domain#vm-recommendations",
            "severity": "Alto",
            "subcategory": "Híbrido",
            "text": "Se você estiver implantando pelo menos duas VMs que executam o AD DS como controladores de domínio, adicione-as a diferentes zonas de disponibilidade. Se não estiver disponível na região, implante em um Conjunto de Disponibilidade."
        },
        {
            "category": "Operações",
            "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
            "severity": "Alto",
            "subcategory": "Porta da frente",
            "text": "Use certificados TLS gerenciados com o Azure Front Door. Reduza o custo operacional e o risco de interrupções devido a renovações de certificados."
        },
        {
            "category": "Operações",
            "guid": "f00a69de-7076-4734-a734-6e4552cad9e1",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
            "severity": "Média",
            "subcategory": "Porta da frente",
            "text": "Se você usar certificados TLS gerenciados pelo cliente com o Azure Front Door, use a versão de certificado 'Mais recente'. Reduza o risco de paralisações causadas pela renovação manual de certificados."
        },
        {
            "category": "Operações",
            "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code",
            "severity": "Média",
            "subcategory": "Porta da frente",
            "text": "Defina sua configuração do WAF do Azure Front Door como código. Usando o código, você pode adotar mais facilmente novas versões de conjunto de regras e obter proteção adicional."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls",
            "severity": "Alto",
            "subcategory": "Porta da frente",
            "text": "Use TLS de ponta a ponta com o Azure Front Door. Use o TLS para conexões de seus clientes com a Front Door e da Front Door até sua origem."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection",
            "severity": "Média",
            "subcategory": "Porta da frente",
            "text": "Use o redirecionamento HTTP para HTTPS com o Azure Front Door. Ofereça suporte a clientes mais antigos redirecionando-os para uma solicitação HTTPS automaticamente."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf",
            "severity": "Alto",
            "subcategory": "Porta da frente",
            "text": "Habilite o WAF da Porta da Frente do Azure. Proteja seu aplicativo contra uma variedade de ataques."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf",
            "severity": "Alto",
            "subcategory": "Porta da frente",
            "text": "Ajuste o WAF do Azure Front Door para sua carga de trabalho. Reduza as detecções de falsos positivos."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-prevention-mode",
            "severity": "Alto",
            "subcategory": "Porta da frente",
            "text": "Use o modo de prevenção com o WAF do Azure Front Door. O modo de prevenção garante que o WAF bloqueie solicitações maliciosas."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets",
            "severity": "Alto",
            "subcategory": "Porta da frente",
            "text": "Habilite os conjuntos de regras padrão WAF do Azure Front Door. Os conjuntos de regras padrão detectam e bloqueiam ataques comuns."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "147a13d4-2a2f-4824-a524-f5855b52b946",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules",
            "severity": "Alto",
            "subcategory": "Porta da frente",
            "text": "Habilite as regras de gerenciamento de bot WAF do Azure Front Door. As regras do bot detectam bots bons e ruins."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions",
            "severity": "Média",
            "subcategory": "Porta da frente",
            "text": "Use as versões mais recentes do conjunto de regras WAF do Azure Front Door. As atualizações do conjunto de regras são atualizadas regularmente para levar em conta o cenário atual de ameaças."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "b9620385-1cde-418f-914b-a84a06982ffc",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting",
            "severity": "Média",
            "subcategory": "Porta da frente",
            "text": "Adicione limitação de taxa ao WAF do Azure Front Door. A limitação de taxa bloqueia clientes acidentalmente ou intencionalmente enviando grandes quantidades de tráfego em um curto período de tempo."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits",
            "severity": "Média",
            "subcategory": "Porta da frente",
            "text": "Use um limite alto para limites de taxa WAF do Azure Front Door. Limites de limite de taxa altos evitam bloquear o tráfego legítimo, ao mesmo tempo em que fornecem proteção contra um número extremamente alto de solicitações que podem sobrecarregar sua infraestrutura. "
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic",
            "severity": "Baixo",
            "subcategory": "Porta da frente",
            "text": "Filtre geograficamente o tráfego usando o WAF do Azure Front Door. Permita o tráfego somente de regiões esperadas e bloqueie o tráfego de outras regiões."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "00acd8a9-6975-414f-8491-2be6309893b8",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location",
            "severity": "Média",
            "subcategory": "Porta da frente",
            "text": "Especifique o local desconhecido (ZZ) ao filtrar geograficamente o tráfego com o WAF do Azure Front Door. Evite bloquear acidentalmente solicitações legítimas quando os endereços IP não puderem ser correspondidos geograficamente."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "Alto",
            "subcategory": "Governança",
            "text": "Aproveite a Política do Azure"
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "e979377b-cdb3-4751-ab2a-b13ada6e55d7",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/naming-and-tagging",
            "severity": "Média",
            "subcategory": "Governança",
            "text": "Identifique as marcas necessárias do Azure e use o modo de política de acréscimo para impor o uso."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "Média",
            "subcategory": "Governança",
            "text": "Mapeie os requisitos regulatórios e de conformidade para as definições de Política do Azure e as atribuições de função do Azure."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "Média",
            "subcategory": "Governança",
            "text": "Estabelecer definições de Política do Azure no grupo de gerenciamento raiz de nível superior para que elas possam ser atribuídas em escopos herdados"
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "Média",
            "subcategory": "Governança",
            "text": "Gerenciar atribuições de políticas no nível mais alto apropriado com exclusões nos níveis inferiores, se necessário"
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "43334f24-9116-4341-a2ba-527526944008",
            "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
            "severity": "Baixo",
            "subcategory": "Governança",
            "text": "Usar a Política do Azure para controlar quais serviços os usuários podem provisionar no nível de assinatura/grupo de gerenciamento"
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "Média",
            "subcategory": "Governança",
            "text": "Use políticas internas sempre que possível para minimizar a sobrecarga operacional."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "Média",
            "subcategory": "Governança",
            "text": "Atribua a função interna de Colaborador de Política em um escopo específico para habilitar a governança no nível do aplicativo."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "19048384-5c98-46cb-8913-156a12476e49",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "Média",
            "subcategory": "Governança",
            "text": "Limite o número de atribuições de Política do Azure feitas no escopo do grupo de gerenciamento raiz para evitar o gerenciamento por meio de exclusões em escopos herdados."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
            "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
            "severity": "Média",
            "subcategory": "Governança",
            "text": "Use as políticas do Azure para implantar automaticamente configurações de software por meio de extensões de VM e impor uma configuração de VM de linha de base compatível."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "9b5e2a28-9823-4faf-ab7e-afa5f6c57221",
            "link": "Configure Azure Automation Start/Stop VMs during off-hours | Microsoft Learn",
            "severity": "Média",
            "subcategory": "Governança",
            "text": "Considere o uso de tags de automação para iniciar/parar VMs em seu ambiente para economizar custos."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
            "severity": "Média",
            "subcategory": "Governança",
            "text": "Monitore o desvio da configuração de segurança da VM por meio da Política do Azure."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "5017f154-e3ab-4369-9829-e7e316183687",
            "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
            "severity": "Alto",
            "subcategory": "Segredos",
            "text": "Usar o Cofre da Chave do Azure para armazenar seus segredos e credenciais"
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
            "guid": "a0477a20-9945-4bda-9333-4f2491163418",
            "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
            "severity": "Média",
            "subcategory": "Segredos",
            "text": "Use diferentes Cofres de Chaves do Azure para diferentes aplicativos e regiões para evitar limites de escala de transação e restringir o acesso a segredos."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "Média",
            "subcategory": "Segredos",
            "text": "Provisione o Cofre da Chave do Azure com as políticas de exclusão e limpeza suaves habilitadas para permitir a proteção de retenção para objetos excluídos."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "Média",
            "subcategory": "Segredos",
            "text": "Siga um modelo de privilégios mínimos limitando a autorização para excluir permanentemente chaves, segredos e certificados para funções personalizadas especializadas do Azure Active Directory (Azure AD)."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "Média",
            "subcategory": "Segredos",
            "text": "Automatize o processo de gerenciamento e renovação de certificados com autoridades de certificação públicas para facilitar a administração."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "913156a1-2476-4e49-b541-acdce979377b",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "Média",
            "subcategory": "Segredos",
            "text": "Estabeleça um processo automatizado para a rotação de chaves e certificados."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "Média",
            "subcategory": "Segredos",
            "text": "Habilite o firewall e o ponto de extremidade do serviço de rede virtual ou o ponto de extremidade privado no cofre para controlar o acesso ao cofre de chaves."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
            "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
            "severity": "Média",
            "subcategory": "Segredos",
            "text": "Use o espaço de trabalho Azure Monitor Log Analytics central da plataforma para auditar o uso de chave, certificado e segredo em cada instância do Cofre da Chave."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "Média",
            "subcategory": "Segredos",
            "text": "Delegue a instanciação do Cofre da Chave e o acesso privilegiado e use a Política do Azure para impor uma configuração consistente e compatível."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "16183687-a047-47a2-8994-5bda43334f24",
            "link": "https://learn.microsoft.com/azure/security/fundamentals/encryption-atrest",
            "severity": "Média",
            "subcategory": "Segredos",
            "text": "Padrão para chaves gerenciadas pela Microsoft para a funcionalidade de criptografia principal e use chaves gerenciadas pelo cliente quando necessário."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "Média",
            "subcategory": "Segredos",
            "text": "Use um Cofre da Chave do Azure por aplicativo por ambiente por região."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "Média",
            "subcategory": "Segredos",
            "text": "Se você quiser trazer suas próprias chaves, isso pode não ser suportado em todos os serviços considerados. Implemente a mitigação relevante para que as inconsistências não prejudiquem os resultados desejados. Escolha pares de regiões e regiões de recuperação de desastres apropriados que minimizem a latência."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
            "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
            "severity": "Média",
            "subcategory": "Segurança",
            "text": "Use os recursos de relatório do Azure AD para gerar relatórios de auditoria de controle de acesso."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "4e3ab369-3829-4e7e-9161-83687a0477a2",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-data-export?tabs=portal",
            "severity": "Média",
            "subcategory": "Segurança",
            "text": "Exporte os logs de atividade do Azure para os Logs do Azure Monitor para retenção de dados a longo prazo. Exporte para o Armazenamento do Azure para armazenamento de longo prazo além de dois anos, se necessário."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "09945bda-4333-44f2-9911-634182ba5275",
            "link": "https://learn.microsoft.com/azure/security-center/",
            "severity": "Média",
            "subcategory": "Segurança",
            "text": "Habilite o Defender for Cloud Standard para todas as assinaturas."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
            "link": "https://learn.microsoft.com/azure/security-center/",
            "severity": "Média",
            "subcategory": "Segurança",
            "text": "Monitore o desvio de patches do sistema operacional base por meio do Azure Monitor Logs e do Defender for Cloud."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "Média",
            "subcategory": "Segurança",
            "text": "Conecte as configurações de recursos padrão a um espaço de trabalho centralizado do Azure Monitor Log Analytics."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "b86ad884-08e3-4727-94b8-75ba18f20459",
            "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response",
            "severity": "Média",
            "subcategory": "Segurança",
            "text": "Determine o plano de resposta a incidentes para os serviços do Azure antes de permitir que ele entre em produção."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "01365d38-e43f-49cc-ad86-8266abca264f",
            "link": "https://www.microsoft.com/security/business/zero-trust",
            "severity": "Média",
            "subcategory": "Segurança",
            "text": "Implemente uma abordagem de confiança zero para acesso à plataforma Azure, quando apropriado."
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "9a19bf39-c95d-444c-9c89-19ca1f6d5215",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework",
            "severity": "Média",
            "subcategory": "Segurança",
            "text": "Planejar como os novos serviços do azure serão implementados"
        },
        {
            "category": "Segurança, Governança e Conformidade",
            "guid": "ae514b93-3d45-485e-8112-9bd7ba012f7b",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework",
            "severity": "Média",
            "subcategory": "Segurança",
            "text": "Planejar como a solicitação de serviço será atendida para os serviços do Azure"
        },
        {
            "category": "Segurança, Governança e Conformidade ",
            "guid": "cacf55bc-e4e4-46be-96bc-57a5f23a269a",
            "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/resource-naming",
            "severity": "Alto",
            "subcategory": "Governança",
            "text": "É recomendável seguir os Padrões de Nomenclatura de Práticas Recomendadas da Microsoft"
        },
        {
            "category": "Segurança, Governança e Conformidade ",
            "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
            "link": "https://learn.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer",
            "severity": "Alto",
            "subcategory": "Segurança",
            "text": "A transferência segura para contas de armazenamento deve ser habilitada"
        },
        {
            "category": "Segurança, Governança e Conformidade ",
            "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
            "link": "https://learn.microsoft.com/en-us/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
            "severity": "Alto",
            "subcategory": "Segurança",
            "text": "Habilite a exclusão flexível de contêiner para a conta de armazenamento para recuperar um contêiner excluído e seu conteúdo."
        }
    ],
    "metadata": {
        "name": "Azure Landing Zone Review",
        "state": "GA",
        "timestamp": "March 16, 2023"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Média"
        },
        {
            "name": "Baixo"
        }
    ],
    "status": [
        {
            "description": "Esta verificação ainda não foi analisada",
            "name": "Não verificado"
        },
        {
            "description": "Há um item de ação associado a essa verificação",
            "name": "Abrir"
        },
        {
            "description": "Essa verificação foi verificada e não há mais itens de ação associados a ela",
            "name": "Cumprido"
        },
        {
            "description": "Recomendação entendida, mas não necessária pelos requisitos atuais",
            "name": "Não é necessário"
        },
        {
            "description": "Não aplicável ao projeto atual",
            "name": "N/A"
        }
    ]
}
checklists/lz_checklist.ko.json METASEP
{
    "categories": [
        {
            "name": "ID 및 액세스"
        },
        {
            "name": "네트워크 토폴로지 및 연결"
        },
        {
            "name": "보안, 거버넌스 및 규정 준수"
        },
        {
            "name": "관리 및 모니터링"
        },
        {
            "name": "관리 그룹 및 구독"
        },
        {
            "name": "작업"
        },
        {
            "name": "백업 및 재해 복구"
        }
    ],
    "items": [
        {
            "category": "백업 및 재해 복구",
            "guid": "7ea02e1c-7166-45a3-bdf5-098891367fcb",
            "link": "https://learn.microsoft.com/en-us/azure/reliability/cross-region-replication-azure",
            "severity": "보통",
            "subcategory": "데이터 보호",
            "text": "쌍을 이루는 지역이 있는 BCDR용 Azure에서 지역 간 복제를 고려합니다."
        },
        {
            "category": "백업 및 재해 복구",
            "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
            "link": "https://learn.microsoft.com/en-us/azure/storage/common/storage-redundancy",
            "severity": "보통",
            "subcategory": "데이터 보호",
            "text": "Azure 백업을 사용하는 경우 기본 설정이 GRS이므로 다양한 백업 유형(GRS, ZRS 및 LRS)을 고려합니다."
        },
        {
            "category": "ID 및 액세스",
            "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
            "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
            "severity": "높다",
            "subcategory": "신원",
            "text": "테넌트 전체 계정 잠금을 방지하기 위해 비상 액세스 또는 비상 계정에 대해 구현",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "ID 및 액세스",
            "guid": "348ef254-c27d-442e-abba-c7571559ab91",
            "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
            "severity": "높다",
            "subcategory": "신원",
            "text": "관리 그룹, 구독, 리소스 그룹 및 리소스에 대한 RBAC 모델 적용",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "ID 및 액세스",
            "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
            "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
            "severity": "낮다",
            "subcategory": "신원",
            "text": "Azure 환경에 대한 권한이 있는 모든 사용자에 대해 Azure AD 조건부 액세스 정책 적용",
            "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/"
        },
        {
            "category": "ID 및 액세스",
            "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
            "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
            "severity": "높다",
            "subcategory": "신원",
            "text": "Azure 환경에 대한 권한이 있는 모든 사용자에 대해 다단계 인증 적용",
            "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/"
        },
        {
            "category": "ID 및 액세스",
            "guid": "e6a83de5-de32-4c19-a248-1607d5d1e4e6",
            "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
            "severity": "보통",
            "subcategory": "신원",
            "text": "역할 및 보안 요구 사항에 따라 랜딩 존 내부에 배포된 리소스를 관리하기 위해 중앙 집중화되고 위임된 책임을 적용합니다.",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/"
        },
        {
            "category": "ID 및 액세스",
            "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
            "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
            "severity": "보통",
            "subcategory": "신원",
            "text": "Azure AD PIM(권한 있는 ID 관리)을 적용하여 제로 스탠딩 액세스 및 최소 권한 설정",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "ID 및 액세스",
            "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
            "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
            "severity": "높다",
            "subcategory": "신원",
            "text": "모든 계정 유형에 대해 인증 유형 회사 또는 학교 계정만 사용합니다. 마이크로소프트 계정 사용 금지",
            "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/"
        },
        {
            "category": "ID 및 액세스",
            "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
            "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
            "severity": "보통",
            "subcategory": "신원",
            "text": "그룹만 사용하여 권한을 할당합니다. 그룹 관리 시스템이 이미 있는 경우 Azure-AD 전용 그룹에 온-프레미스 그룹을 추가합니다.",
            "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/"
        },
        {
            "category": "ID 및 액세스",
            "guid": "f5664b5e-984a-4859-a773-e7d261623a76",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
            "severity": "보통",
            "subcategory": "신원",
            "text": "Azure 플랫폼 소유자, 네트워크 관리, 보안 작업, 구독 소유자, 애플리케이션 소유자와 같은 주요 역할에 대해 Azure 사용자 지정 역할을 사용하는 것이 좋습니다.",
            "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/"
        },
        {
            "category": "ID 및 액세스",
            "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
            "link": "https://azure.microsoft.com/resources/achieving-compliant-data-residency-and-security-with-azure/",
            "severity": "보통",
            "subcategory": "신원",
            "text": "데이터 주권 요구 사항이 있는 경우 Azure 정책을 배포하여 이를 적용할 수 있습니다.",
            "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/"
        },
        {
            "category": "ID 및 액세스",
            "guid": "1559ab91-53e8-4908-ae28-c84c33b6b780",
            "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
            "severity": "보통",
            "subcategory": "신원",
            "text": "AADDS(Azure Active Directory 도메인 서비스)를 사용 중인 경우 이 서비스는 하나의 구독에만 프로젝션될 수 있으므로 주 지역 내에 AAADDS를 배포합니다.",
            "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/"
        },
        {
            "category": "ID 및 액세스",
            "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
            "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
            "severity": "보통",
            "subcategory": "신원",
            "text": "AADD를 사용 중인 경우 모든 워크로드의 호환성을 평가합니다.",
            "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/"
        },
        {
            "category": "ID 및 액세스",
            "guid": "ac6a9e01-e6a8-43de-9de3-2c1992481607",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
            "severity": "보통",
            "subcategory": "신원",
            "text": "Windows 서버의 AD가 사용 중인 경우 필요한 모든 리소스가 올바른 도메인 컨트롤러에 액세스할 수 있습니까?",
            "training": "https://learn.microsoft.com/learn/paths/implement-windows-server-iaas-virtual-machine-identity/"
        },
        {
            "category": "ID 및 액세스",
            "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
            "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
            "severity": "보통",
            "subcategory": "신원",
            "text": "Azure AD 애플리케이션 프록시를 VPN 또는 역방향 프록시 대체로 사용하여 원격 사용자에게 내부 애플리케이션(클라우드 또는 온-프레미스에서 호스트됨)에 대한 안전하고 인증된 액세스를 제공하는 것이 좋습니다.",
            "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/"
        },
        {
            "category": "ID 및 액세스",
            "guid": "35037e68-9349-4c15-b371-228514f4cdff",
            "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
            "severity": "보통",
            "subcategory": "신원",
            "text": "Azure AD 역할 할당에 온-프레미스 동기화 계정을 사용하지 마세요.",
            "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/"
        },
        {
            "category": "관리 그룹 및 구독",
            "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
            "guid": "2df27ee4-12e7-4f98-9f63-04722dd69c5b",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
            "severity": "보통",
            "subcategory": "구독",
            "text": "합리적으로 수평적인 관리 그룹 계층 구조를 3-4개 이하로 적용합니다.",
            "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/"
        },
        {
            "category": "관리 그룹 및 구독",
            "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
            "guid": "5c2622f5-4b69-4bad-93aa-d5e8c68e1d76",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/resource-tagging/?toc=/azure/azure-resource-manager/management/toc.json",
            "severity": "보통",
            "subcategory": "구독",
            "text": "Azure 정책을 통해 리소스 태그 적용 또는 추가",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "관리 그룹 및 구독",
            "guid": "667313b4-f566-44b5-b984-a859c773e7d2",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
            "severity": "보통",
            "subcategory": "구독",
            "text": "사용자가 Azure를 즉시 실험할 수 있도록 샌드박스 관리 그룹 적용",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/"
        },
        {
            "category": "관리 그룹 및 구독",
            "guid": "61623a76-5a91-47e1-b348-ef254c27d42e",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
            "severity": "보통",
            "subcategory": "구독",
            "text": "루트 관리 그룹 아래에 플랫폼 관리 그룹을 적용하여 공통 플랫폼 정책 및 Azure 역할 할당을 지원합니다.",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/"
        },
        {
            "category": "관리 그룹 및 구독",
            "guid": "8bbac757-1559-4ab9-853e-8908ae28c84c",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
            "severity": "보통",
            "subcategory": "구독",
            "text": "플랫폼 관리 그룹에서 전용 연결 구독을 적용하여 Azure 가상 WAN 허브, 프라이빗 DNS(도메인 이름 시스템), Express 경로 회로 및 기타 네트워킹 리소스를 호스트합니다.",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/"
        },
        {
            "category": "관리 그룹 및 구독",
            "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant = (array_length(mgmtChain) > 1)",
            "guid": "33b6b780-8b9f-4e5c-9104-9d403a923c34",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---default-management-group",
            "severity": "보통",
            "subcategory": "구독",
            "text": "루트 관리 그룹에 구독이 배치되지 않도록 적용"
        },
        {
            "category": "관리 그룹 및 구독",
            "guid": "74d00018-ac6a-49e0-8e6a-83de5de32c19",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization",
            "severity": "보통",
            "subcategory": "구독",
            "text": "관리 그룹 계층 설정에서 Azure RBAC 권한 부여를 사용하도록 설정하여 권한 있는 사용자만 테넌트에서 관리 그룹을 작동할 수 있도록 적용"
        },
        {
            "category": "관리 그룹 및 구독",
            "guid": "92481607-d5d1-4e4e-9146-58d3558fd772",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/overview",
            "severity": "보통",
            "subcategory": "구독",
            "text": "루트 수준 관리 그룹 아래에 관리 그룹을 적용하여 보안, 규정 준수, 연결 및 기능 요구 사항에 따라 워크로드 유형을 나타냅니다."
        },
        {
            "category": "관리 그룹 및 구독",
            "guid": "49b82111-2df2-47ee-912e-7f983f630472",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/overview",
            "severity": "높다",
            "subcategory": "구독",
            "text": "리소스 소유자가 자신의 역할과 책임을 인식하고, 검토, 예산 검토, 정책 준수에 액세스하고, 필요한 경우 수정할 수 있도록 프로세스를 적용합니다."
        },
        {
            "category": "관리 그룹 및 구독",
            "guid": "2dd69c5b-5c26-422f-94b6-9bad33aad5e8",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
            "severity": "보통",
            "subcategory": "구독",
            "text": "모든 구독 소유자와 IT 핵심 팀이 워크로드 디자인 세션의 일부로 구독 리소스 제한 사항을 알고 있는지 확인합니다."
        },
        {
            "category": "관리 그룹 및 구독",
            "guid": "c68e1d76-6673-413b-9f56-64b5e984a859",
            "link": "https://learn.microsoft.com/azure/cost-management-billing/reservations/save-compute-costs-reservations",
            "severity": "높다",
            "subcategory": "구독",
            "text": "적절한 경우 예약 인스턴스를 사용하여 비용을 최적화하고 대상 리전에서 사용 가능한 용량을 보장합니다. Azure 정책을 통해 구매한 예약 인스턴스 VM SKU의 사용을 적용합니다.",
            "training": "https://learn.microsoft.com/learn/paths/improve-reliability-modern-operations/"
        },
        {
            "category": "관리 그룹 및 구독",
            "guid": "c773e7d2-6162-43a7-95a9-17e1f348ef25",
            "link": "https://learn.microsoft.com/azure/architecture/framework/scalability/design-capacity",
            "severity": "높다",
            "subcategory": "구독",
            "text": "대시보드, 통합 문서 또는 수동 프로세스를 적용하여 사용된 용량 수준 모니터링",
            "training": "https://learn.microsoft.com/learn/paths/monitor-usage-performance-availability-resources-azure-monitor/"
        },
        {
            "category": "관리 그룹 및 구독",
            "guid": "4c27d42e-8bba-4c75-9155-9ab9153e8908",
            "link": "https://azure.microsoft.com/global-infrastructure/services/",
            "severity": "보통",
            "subcategory": "구독",
            "text": "선택한 배포 지역 내에서 필요한 서비스 및 기능을 사용할 수 있는지 확인",
            "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/"
        },
        {
            "category": "관리 그룹 및 구독",
            "guid": "ae28c84c-33b6-4b78-88b9-fe5c41049d40",
            "link": "https://learn.microsoft.com/azure/cost-management-billing/cost-management-billing-overview",
            "severity": "높다",
            "subcategory": "구독",
            "text": "비용 관리 프로세스 적용",
            "training": "https://learn.microsoft.com/learn/paths/control-spending-manage-bills/"
        },
        {
            "category": "관리 그룹 및 구독",
            "guid": "3a923c34-74d0-4001-aac6-a9e01e6a83de",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/overview",
            "severity": "보통",
            "subcategory": "구독",
            "text": "AD가 Windows Server에 있는 경우 플랫폼 관리 그룹에서 전용 ID 구독을 설정하여 Windows Server Active Directory 도메인 컨트롤러를 호스트합니다.",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/"
        },
        {
            "category": "관리 그룹 및 구독",
            "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
            "guid": "5de32c19-9248-4160-9d5d-1e4e614658d3",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/track-costs",
            "severity": "보통",
            "subcategory": "구독",
            "text": "청구 및 비용 관리에 태그가 사용되는지 확인",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "관리 및 모니터링",
            "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
            "severity": "높다",
            "subcategory": "정문",
            "text": "진단 설정을 추가하여 Azure 프런트 도어 WAF의 로그를 저장합니다. 로그를 정기적으로 검토하여 공격 및 가양성 탐지를 확인합니다."
        },
        {
            "category": "관리 및 모니터링",
            "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
            "severity": "보통",
            "subcategory": "정문",
            "text": "Azure Front Door 로그를 Microsoft Sentinel로 보냅니다. 공격을 감지하고 Front Door 원격 분석을 전체 Azure 환경에 통합합니다."
        },
        {
            "category": "관리 및 모니터링",
            "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "단일 모니터 로그 작업 영역을 사용하여 Azure RBAC(Azure 역할 기반 액세스 제어), 데이터 주권 요구 사항 또는 데이터 보존 정책에서 별도의 작업 영역을 요구하는 경우를 제외하고 중앙에서 플랫폼을 관리합니다.",
            "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
        },
        {
            "category": "관리 및 모니터링",
            "guid": "e179b599-de0d-4597-9cd4-cd21b088137f",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "랜딩 존이 문서화되어 있습니까?"
        },
        {
            "category": "관리 및 모니터링",
            "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "로그 보존 요구 사항이 2년을 초과하는 경우 Azure 저장소로 로그를 내보냅니다. 변경 불가능한 스토리지를 한 번 쓰기, 여러 번 읽기 정책과 함께 사용하여 사용자가 지정한 간격 동안 데이터를 지울 수 없고 수정할 수 없도록 합니다.",
            "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/"
        },
        {
            "category": "관리 및 모니터링",
            "guid": "00f1ce16-ed30-41d6-b872-e52e3611cc58",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "액세스 제어 및 규정 준수 보고를 위해 Azure Policy를 사용합니다. Azure Policy는 일관된 정책 준수 및 빠른 위반 검색을 보장하기 위해 조직 전체 설정을 적용하는 기능을 제공합니다. ",
            "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/"
        },
        {
            "category": "관리 및 모니터링",
            "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
            "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "Azure 정책을 사용하여 게스트 내 VM(가상 머신) 구성 드리프트를 모니터링합니다. 정책을 통해 게스트 구성 감사 기능을 사용하도록 설정하면 애플리케이션 팀 워크로드가 적은 노력으로 기능 기능을 즉시 사용할 수 있습니다.",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "관리 및 모니터링",
            "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
            "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "Azure 자동화의 업데이트 관리를 Windows 및 Linux VM 모두에 대한 장기 패치 메커니즘으로 사용합니다. ",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/"
        },
        {
            "category": "관리 및 모니터링",
            "guid": "90483845-c986-4cb2-a131-56a12476e49f",
            "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "네트워크 감시자를 사용하여 트래픽 흐름을 사전에 모니터링",
            "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/"
        },
        {
            "category": "관리 및 모니터링",
            "guid": "541acdce-9793-477b-adb3-751ab2ab13ad",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "리소스 잠금을 사용하여 중요한 공유 서비스가 실수로 삭제되는 것을 방지합니다.",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "관리 및 모니터링",
            "guid": "a6e55d7d-8a2a-4db1-87d6-326af625ca44",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "낮다",
            "subcategory": "모니터링",
            "text": "거부 정책을 사용하여 Azure 역할 할당을 보완합니다. 거부 정책과 Azure 역할 할당의 조합은 리소스를 배포 및 구성할 수 있는 사용자와 배포 및 구성할 수 있는 리소스를 적용할 수 있는 적절한 가드레일이 있는지 확인합니다."
        },
        {
            "category": "관리 및 모니터링",
            "guid": "e5695f22-23ac-4e8c-a123-08ca5017f154",
            "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "서비스 및 리소스 상태 이벤트를 전체 플랫폼 모니터링 솔루션의 일부로 포함합니다. 플랫폼 관점에서 서비스 및 리소스 상태를 추적하는 것은 Azure에서 리소스 관리의 중요한 구성 요소입니다."
        },
        {
            "category": "관리 및 모니터링",
            "guid": "d5f345bf-97ab-41a7-819c-6104baa7d48c",
            "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "경고 및 작업 그룹을 Azure 서비스 상태 플랫폼의 일부로 포함하여 경고 또는 문제를 해결할 수 있도록 합니다."
        },
        {
            "category": "관리 및 모니터링",
            "guid": "e3ab3693-829e-47e3-8618-3687a0477a20",
            "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "원시 로그 항목을 온-프레미스 모니터링 시스템으로 다시 보내지 마세요. 대신 Azure에서 생성된 데이터가 Azure에 유지된다는 원칙을 채택합니다. 온-프레미스 SIEM 통합이 필요한 경우 로그 대신 중요한 경고를 보냅니다."
        },
        {
            "category": "관리 및 모니터링",
            "guid": "9945bda4-3334-4f24-a116-34182ba52752",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "중앙 집중식 Azure 모니터 로그 분석 작업 영역을 사용하여 IaaS 및 PaaS 애플리케이션 리소스에서 로그 및 메트릭을 수집하고 Azure RBAC를 통해 로그 액세스를 제어합니다."
        },
        {
            "category": "관리 및 모니터링",
            "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "인사이트 및 보고를 위해 Azure 모니터 로그를 사용합니다."
        },
        {
            "category": "관리 및 모니터링",
            "guid": "619e8a13-f988-4795-85d6-26886d70ba6c",
            "link": "https://learn.microsoft.com/azure/azure-monitor/agents/diagnostics-extension-overview",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "필요한 경우 Azure 진단 확장 로그 스토리지에 대한 랜딩 존 내의 공유 스토리지 계정을 사용합니다."
        },
        {
            "category": "관리 및 모니터링",
            "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
            "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "Azure 모니터 경고를 사용하여 작업 경고를 생성합니다."
        },
        {
            "category": "관리 및 모니터링",
            "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
            "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "Azure 간 가상 컴퓨터 재해 복구 시나리오에 Azure 사이트 복구를 사용합니다. 이렇게 하면 지역 간에 워크로드를 복제할 수 있습니다."
        },
        {
            "category": "관리 및 모니터링",
            "guid": "b2ab13ad-a6e5-45d7-b8a2-adb117d6326a",
            "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "기본 PaaS 서비스 재해 복구 기능을 사용하고 테스트해야 합니다."
        },
        {
            "category": "관리 및 모니터링",
            "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
            "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "Azure 네이티브 백업 기능을 사용합니다. 파트너/고객이 Azure Backup 및 백업 관리를 크게 간소화할 수 있는 모든 새로운 기능을 알고 있는지 확인합니다."
        },
        {
            "category": "관리 및 모니터링",
            "guid": "859c3900-4514-41eb-b010-475d695abd74",
            "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "모니터링 요구 사항이 평가되고 적절한 데이터 수집 및 경고 구성이 적용되었는지 확인"
        },
        {
            "category": "관리 및 모니터링",
            "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
            "link": "https://learn.microsoft.com/en-us/azure/automation/how-to/region-mappings",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "연결된 Log Analytics 작업 영역 및 자동화 계정에 대해 지원되는 지역 고려"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "6138a720-0f1c-4e16-bd30-1d6e872e52e3",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
            "severity": "보통",
            "subcategory": "앱 게재",
            "text": "내부 연결(회사) 및 외부 연결 앱(온라인) 모두에 대해 랜딩 존 내에서 앱 제공을 수행합니다.",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = (properties.webApplicationFirewallConfiguration.enabled == True and properties.webApplicationFirewallConfiguration.firewallMode == 'Prevention')",
            "guid": "611cc58b-5a4b-4151-8e43-a58a9c2299c4",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-faq",
            "severity": "보통",
            "subcategory": "앱 게재",
            "text": "HTTP/S 앱을 안전하게 제공하려면 애플리케이션 게이트웨이에서 WAF 보호 및 정책을 사용하도록 설정해야 합니다.",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
            "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
            "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
            "severity": "보통",
            "subcategory": "앱 게재",
            "text": "응용 프로그램 게이트웨이 v2 SKU를 사용하고 있는지 확인",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "d7b57d0c-6555-462f-8b3e-4563a4d87397",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/organize-resources?tabs=AzureManagementGroupsAndHierarchy",
            "severity": "보통",
            "subcategory": "앱 게재",
            "text": "HTTP/S 앱의 보안을 위해 응용 프로그램 게이트웨이 v2를 사용할 수 없는 경우 파트너 NVA를 사용합니다.",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "보통",
            "subcategory": "앱 게재",
            "text": "랜딩 존 가상 네트워크 내의 인바운드 HTTP/S 연결에 사용되는 Azure 응용 프로그램 게이트웨이 v2 또는 파트너 NVA를 배포하고 보안 중인 앱을 사용합니다.",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "보통",
            "subcategory": "앱 게재",
            "text": "애플리케이션 랜딩 존의 모든 공용 IP 주소에 대해 DDoS 네트워크 또는 IP 보호 계획을 사용합니다.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "보통",
            "subcategory": "앱 게재",
            "text": "WAF 정책과 함께 Azure 전면 도어를 사용하여 Azure 지역에 걸쳐 있는 글로벌 HTTP/S 앱을 제공하고 보호합니다.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
            "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
            "severity": "보통",
            "subcategory": "앱 게재",
            "text": "프런트 도어 및 애플리케이션 게이트웨이를 사용하여 HTTP/S 앱을 보호하는 경우 프런트 도어에서 WAF 정책을 사용합니다. Front Door에서만 트래픽을 수신하도록 응용 프로그램 게이트웨이를 잠급니다.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "보통",
            "subcategory": "앱 게재",
            "text": "트래픽 관리자를 사용하여 HTTP/S 이외의 프로토콜에 걸쳐 있는 전역 앱을 제공합니다.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
            "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
            "severity": "낮다",
            "subcategory": "앱 게재",
            "text": "사용자가 내부 응용 프로그램에만 액세스해야 하는 경우 Azure AD 응용 프로그램 프록시가 Azure AVD(가상 데스크톱)의 대안으로 간주되었나요?",
            "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
            "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
            "severity": "보통",
            "subcategory": "앱 게재",
            "text": "네트워크에서 들어오는 연결에 대해 열려 있는 방화벽 포트 수를 줄이려면 Azure AD 애플리케이션 프록시를 사용하여 원격 사용자에게 내부 애플리케이션에 대한 안전하고 인증된 액세스를 제공하는 것이 좋습니다.",
            "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "보통",
            "subcategory": "암호화",
            "text": "Express 경로 다이렉트를 사용하는 경우 조직의 라우터와 MSEE 간의 계층 2 수준에서 트래픽을 암호화하도록 MACsec을 구성합니다. 다이어그램은 흐름에서 이 암호화를 보여 줍니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
            "severity": "보통",
            "subcategory": "암호화",
            "text": "MACsec이 옵션이 아닌 시나리오(예: Express 경로 다이렉트를 사용하지 않음)의 경우 VPN 게이트웨이를 사용하여 Express 경로 프라이빗 피어링을 통해 IPsec 터널을 설정합니다. ",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
            "guid": "ae248989-b306-4591-9186-de482e3f0f0e",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
            "severity": "보통",
            "subcategory": "정문",
            "text": "'방지' 모드에서 Front Door에 대한 WAF 프로필을 배포합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "062d5839-4d36-402f-bfa4-02811eb936e9",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
            "severity": "높다",
            "subcategory": "정문",
            "text": "Azure 트래픽 관리자와 Azure Front Door를 결합하지 마세요."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
            "severity": "보통",
            "subcategory": "정문",
            "text": "Azure Front Door와 원본에서 동일한 도메인 이름을 사용합니다. 호스트 이름이 일치하지 않으면 미묘한 버그가 발생할 수 있습니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
            "severity": "낮다",
            "subcategory": "정문",
            "text": "Azure Front Door 원본 그룹에 원본이 하나만 있는 경우 상태 프로브를 사용하지 않도록 설정합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
            "severity": "보통",
            "subcategory": "정문",
            "text": "Azure Front Door에 대한 양호한 상태 프로브 엔드포인트를 선택합니다. 애플리케이션의 모든 종속성을 확인하는 상태 엔드포인트를 빌드하는 것이 좋습니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
            "severity": "낮다",
            "subcategory": "정문",
            "text": "Azure 정문과 함께 HEAD 상태 프로브를 사용하여 정문에서 애플리케이션으로 보내는 트래픽을 줄입니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
            "severity": "보통",
            "subcategory": "허브 앤 스포크",
            "text": "다음 시나리오에 대한 기존 허브 및 스포크 네트워크 토폴로지를 기반으로 하는 네트워크 설계를 고려합니다: 단일 Azure 지역 내에 배포된 네트워크 아키텍처; 네트워크 아키텍처는 여러 Azure 지역에 걸쳐 있으며 지역 간 랜딩 영역에 대한 가상 네트워크 간의 전이적 연결이 필요하지 않습니다. Azure 지역에서 가상 네트워크를 연결하는 데 사용되는 글로벌 VNet 피어링을 사용하여 여러 Azure 지역에 걸쳐 있는 네트워크 아키텍처입니다. VPN과 Express 경로 연결 간의 전이적 연결이 필요하지 않은 네트워크 아키텍처; 기본 하이브리드 연결 방법은 Express 경로이며 VPN 연결 수는 VPN 게이트웨이당 30개 미만입니다. 중앙 집중식 NVA 및 세분화된 라우팅에 대한 종속성이 있습니다.",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute",
            "severity": "보통",
            "subcategory": "허브 앤 스포크",
            "text": "Express 경로 게이트웨이, VPN 게이트웨이 및 Azure 방화벽 또는 중앙 허브 가상 네트워크의 파트너 NVA를 포함한 공유 서비스를 확인합니다. 필요한 경우 Active Directory 도메인 컨트롤러 및 DNS 서버도 배포합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
            "severity": "보통",
            "subcategory": "허브 앤 스포크",
            "text": "파트너 네트워킹 기술 또는 NVA를 배포할 때 파트너 공급업체의 지침을 따르세요."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "44ce3b1a-2808-4b9e-a1bf-1038df03a822",
            "link": "https://azure.microsoft.com/solutions/network-appliances/",
            "severity": "보통",
            "subcategory": "허브 앤 스포크",
            "text": "Azure 응용 프로그램 게이트웨이와 같은 인바운드 L7 서비스를 중앙 허브 가상 네트워크의 공유 서비스로 배포하지 마세요. 대신 앱과 함께 해당 랜딩 존에 배포합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
            "severity": "보통",
            "subcategory": "허브 앤 스포크",
            "text": "Express 경로와 VPN 게이트웨이 간의 전송이 필요한 경우 Azure 경로 서버를 사용합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
            "severity": "보통",
            "subcategory": "허브 앤 스포크",
            "text": "Azure 지역에 걸쳐 여러 허브 및 스포크 토폴로지가 있는 네트워크 아키텍처의 경우 적은 수의 랜딩 영역이 지역 간에 통신해야 하는 경우 글로벌 가상 네트워크 피어링을 사용하여 랜딩 존 가상 네트워크를 연결합니다. ",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "37239b82-1112-4dbd-9eaf-12e6f943e53f",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs",
            "severity": "보통",
            "subcategory": "허브 앤 스포크",
            "text": "두 Azure 지역에 허브 및 스포크 네트워크 아키텍처를 배포하고 지역 전체의 모든 랜딩 존 간의 전송 연결이 필요한 경우 이중 회로가 있는 Express 경로를 사용하여 Azure 지역 전체의 랜딩 존 가상 네트워크에 대한 전송 연결을 제공합니다. ",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
            "severity": "보통",
            "subcategory": "허브 앤 스포크",
            "text": "네트워크용 Azure 모니터를 사용하여 Azure에서 네트워크의 엔드투엔드 상태를 모니터링합니다.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
            "severity": "보통",
            "subcategory": "허브 앤 스포크",
            "text": "스포크 가상 네트워크를 중앙 허브 가상 네트워크에 연결할 때 VNet 피어링 제한 및 Express 경로를 통해 보급할 수 있는 최대 접두사 수를 고려합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
            "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
            "severity": "높다",
            "subcategory": "허브 앤 스포크",
            "text": "VNet 피어링을 구성할 때 '원격 가상 네트워크에 대한 트래픽 허용' 설정 사용"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli",
            "severity": "보통",
            "subcategory": "잡종",
            "text": "Express 경로를 Azure에 대한 기본 연결로 사용할 가능성을 조사했는지 확인합니다.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
            "severity": "보통",
            "subcategory": "잡종",
            "text": "여러 Express 경로 회로 또는 여러 온-프레미스 위치를 사용하는 경우 특정 경로가 선호되는 경우 BGP 특성을 사용하여 라우팅을 최적화해야 합니다.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
            "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
            "severity": "보통",
            "subcategory": "잡종",
            "text": "대역폭 및 성능 요구 사항에 따라 Express 경로/VPN 게이트웨이에 올바른 SKU를 사용하고 있는지 확인합니다.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
            "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
            "severity": "보통",
            "subcategory": "잡종",
            "text": "지원되는 Azure 지역에 영역 중복 Express 경로 게이트웨이를 배포합니다.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
            "link": "https://learn.microsoft.com/azure/networking/",
            "severity": "보통",
            "subcategory": "잡종",
            "text": "10Gbps보다 높은 대역폭 또는 전용 10/100Gbps 포트가 필요한 시나리오의 경우 Express 경로 다이렉트를 사용합니다.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
            "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
            "severity": "보통",
            "subcategory": "잡종",
            "text": "짧은 대기 시간이 필요하거나 온-프레미스에서 Azure로의 처리량이 10Gbps보다 커야 하는 경우 FastPath가 데이터 경로에서 Express 경로 게이트웨이를 우회하도록 설정합니다.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
            "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
            "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
            "severity": "보통",
            "subcategory": "잡종",
            "text": "VPN 게이트웨이를 사용하여 분기 또는 원격 위치를 Azure에 연결합니다. 복원력을 높이려면 영역 중복 게이트웨이(사용 가능한 경우)를 배포합니다.",
            "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "fe237de1-43b1-46c3-8d7a-a9b64704489a",
            "link": "https://learn.microsoft.com/azure/networking/",
            "severity": "보통",
            "subcategory": "잡종",
            "text": "Express 경로 글로벌 도달을 사용하여 Express 경로를 통해 Azure에 연결된 대규모 사무실, 지역 본사 또는 데이터 센터를 연결합니다.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
            "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
            "severity": "보통",
            "subcategory": "잡종",
            "text": "프로덕션 환경과 비프로덕션 환경을 분리하는 경우와 같이 트래픽 격리 또는 전용 대역폭이 필요한 경우 다른 ExpressRoute 회로를 사용합니다. 격리된 라우팅 도메인을 보장하고 시끄러운 이웃 위험을 완화하는 데 도움이 됩니다.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
            "severity": "보통",
            "subcategory": "잡종",
            "text": "기본 제공 Azure 모니터 메트릭을 사용하여 Express 경로 가용성 및 사용률을 모니터링합니다.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
            "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
            "severity": "보통",
            "subcategory": "잡종",
            "text": "환경 전반의 연결 모니터링을 위해 연결 모니터를 사용합니다.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
            "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#challenges-of-using-multiple-expressroute-circuits",
            "severity": "보통",
            "subcategory": "잡종",
            "text": "단일 피어링 위치에서 Express 경로 회로를 명시적으로 사용하지 마세요. 이렇게 하면 단일 실패 지점이 만들어지고 조직이 피어링 위치 중단에 취약해집니다.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "cd163e39-84a5-4b39-97b7-6973abd70d94",
            "link": "https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-staging-server",
            "severity": "보통",
            "subcategory": "잡종",
            "text": "AD Connect VM을 배포할 때 고가용성/재해 복구를 위한 스테이징 서버를 사용하는 것이 좋습니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
            "link": "https://learn.microsoft.com/en-us/azure/bastion/bastion-overview",
            "severity": "보통",
            "subcategory": "잡종",
            "text": "Bastion을 사용하여 네트워크에 안전하게 연결하는 것이 좋습니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
            "severity": "보통",
            "subcategory": "IP 플랜",
            "text": "Azure 지역 및 온-프레미스 위치에서 IP 주소 공간이 겹치지 않도록 합니다.",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)')  | project id, compliant, cidr",
            "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
            "severity": "보통",
            "subcategory": "IP 플랜",
            "text": "개인 인터넷에 대한 주소 할당의 IP 주소를 사용해야 합니다(RFC 1918).",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
            "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
            "severity": "보통",
            "subcategory": "IP 플랜",
            "text": "IP 주소 공간이 낭비되지 않도록 하고 불필요하게 큰 가상 네트워크(예: /16)를 만들지 마세요. ",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "e984a859-c773-4e7d-8616-23a765a917e1",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
            "severity": "보통",
            "subcategory": "IP 플랜",
            "text": "VNET에 대한 CIDR 블록(공용 IP 주소 범위)이 없는지 확인합니다(특히 조직에서 소유하지 않은 경우).",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
            "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
            "severity": "보통",
            "subcategory": "IP 플랜",
            "text": "프로덕션 및 DR 사이트에 대해 겹치는 IP 주소 범위를 사용하지 마십시오.",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
            "severity": "보통",
            "subcategory": "IP 플랜",
            "text": "Azure에서 이름 확인만 필요한 환경의 경우 확인을 위해 Azure 프라이빗 DNS를 사용합니다. 이름 확인을 위해 위임된 영역(예: 'azure.contoso.com')을 만듭니다.",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
            "severity": "보통",
            "subcategory": "IP 플랜",
            "text": "Azure 및 온-프레미스에서 이름 확인이 필요한 환경의 경우 두 개 이상의 VM(가상 머신)에 배포된 기존 DNS 인프라(예: Active Directory 통합 DNS)를 사용합니다. 해당 DNS 서버를 사용하도록 가상 네트워크에서 DNS 설정을 구성합니다.",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
            "severity": "보통",
            "subcategory": "IP 플랜",
            "text": "자체 DNS가 필요하고 배포하는 특수 워크로드(예: Red Hat OpenShift)는 선호하는 DNS 솔루션을 사용해야 합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "614658d3-558f-4d77-849b-821112df27ee",
            "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
            "severity": "보통",
            "subcategory": "IP 플랜",
            "text": "Azure DNS에 대한 자동 등록을 사용하도록 설정하여 가상 네트워크 내에 배포된 가상 머신에 대한 DNS 레코드의 수명 주기를 자동으로 관리합니다.",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "1e43a58a-9c22-499c-9d7b-57d0c655562f",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
            "severity": "보통",
            "subcategory": "시찰",
            "text": "Network Watcher 패킷을 사용하여 제한된 캡처 창에도 불구하고 캡처합니다.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "a65498f6-dfe2-437d-b143-b16c31d7aa9b",
            "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
            "severity": "보통",
            "subcategory": "시찰",
            "text": "심층 패킷 검사가 필요한 시나리오에 파트너 솔루션을 사용합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "보통",
            "subcategory": "인터넷",
            "text": "Azure 방화벽을 사용하여 인터넷에 대한 Azure 아웃바운드 트래픽, HTTP/S가 아닌 인바운드 연결 및 동/서 트래픽 필터링(조직에서 요구하는 경우)을 제어합니다.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "resources | where type == 'microsoft.network/azurefirewalls' | project id,compliant=isnotnull(properties.firewallPolicy.id)",
            "guid": "0f1ce16e-d301-4d6e-a72e-52e3611cc58b",
            "link": "https://learn.microsoft.com/azure/firewall/",
            "severity": "보통",
            "subcategory": "인터넷",
            "text": "방화벽 관리자를 Virtual WAN과 함께 사용하여 Virtual WAN 허브 또는 허브 가상 네트워크에서 Azure 방화벽을 배포하고 관리합니다.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
            "link": "https://learn.microsoft.com/azure/firewall/",
            "severity": "보통",
            "subcategory": "인터넷",
            "text": "글로벌 Azure 방화벽 정책을 만들어 글로벌 네트워크 환경에서 보안 상태를 제어하고 모든 Azure 방화벽 인스턴스에 할당합니다. Azure 역할 기반 액세스 제어를 통해 로컬 보안 팀에 증분 방화벽 정책을 위임하여 특정 지역의 요구 사항을 충족하는 세분화된 정책을 허용합니다.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
            "link": "https://learn.microsoft.com/azure/firewall/",
            "severity": "보통",
            "subcategory": "인터넷",
            "text": "조직이 아웃바운드 연결을 보호하기 위해 이러한 솔루션을 사용하려는 경우 방화벽 관리자 내에서 지원되는 파트너 SaaS 보안 공급자를 구성합니다.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "d15f512a-6549-48f6-bfe2-37de143b16c3",
            "link": "https://learn.microsoft.com/azure/firewall/",
            "severity": "보통",
            "subcategory": "인터넷",
            "text": "랜딩 존 가상 네트워크 내에서 WAF를 사용하여 인터넷에서 인바운드 HTTP/S 트래픽을 보호합니다.",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
            "severity": "보통",
            "subcategory": "인터넷",
            "text": "Azure 정문 및 WAF 정책을 사용하여 랜딩 존에 대한 인바운드 HTTP/S 연결에 대해 Azure 지역 전체에서 전역 보호를 제공합니다.",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "보통",
            "subcategory": "인터넷",
            "text": "Azure Front Door 및 Azure 응용 프로그램 게이트웨이를 사용하여 HTTP/S 앱을 보호하는 경우 Azure Front Door에서 WAF 정책을 사용합니다. Azure 정문에서만 트래픽을 수신하도록 Azure 응용 프로그램 게이트웨이를 잠급니다.",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "보통",
            "subcategory": "인터넷",
            "text": "인바운드 HTTP/S 연결에 파트너 NVA가 필요한 경우 랜딩 존 가상 네트워크 내에 보호하고 인터넷에 노출하는 앱과 함께 배포합니다.",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
            "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
            "severity": "보통",
            "subcategory": "인터넷",
            "text": "Azure DDoS 네트워크 또는 IP 보호 계획을 사용하여 가상 네트워크 내의 공용 IP 주소 엔드포인트를 보호합니다.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "e504547c-2447-4ec6-9138-a7200f1ce16e",
            "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
            "severity": "보통",
            "subcategory": "파스",
            "text": "PaaS 서비스에 대한 개인 통신이 필요한 경우 사용 가능한 다른 옵션을 고려합니다.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-private-access-to-azure-services/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
            "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
            "severity": "보통",
            "subcategory": "파스",
            "text": "가상 네트워크에 삽입된 Azure PaaS 서비스는 여전히 공용 IP 주소를 사용하여 관리 평면 작업을 수행합니다. 이 통신이 끊어지지 않았는지 확인",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "e43a58a9-c229-49c4-b7b5-7d0c655562f2",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "보통",
            "subcategory": "파스",
            "text": "사용 가능한 경우 공유 Azure PaaS 서비스에 프라이빗 링크를 사용합니다.",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "보통",
            "subcategory": "파스",
            "text": "Express 경로 프라이빗 피어링을 통해 온-프레미스에서 Azure PaaS 서비스에 액세스합니다. 이 방법을 사용하면 공용 인터넷을 통한 전송을 방지할 수 있습니다.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "65498f6d-fe23-47de-843b-16c31d7aa9b6",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "보통",
            "subcategory": "파스",
            "text": "Private Link를 사용할 수 없는 경우 가상 네트워크 서비스 엔드포인트 사용",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
            "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "보통",
            "subcategory": "파스",
            "text": "기본적으로 모든 서브넷에서 가상 네트워크 서비스 엔드포인트를 사용하도록 설정하지 마세요.",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "보통",
            "subcategory": "파스",
            "text": "NVA 필터링을 사용하지 않는 한 데이터 반출 문제가 있는 경우 가상 네트워크 서비스 엔드포인트를 사용하지 마세요.",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "179b599d-e0d5-4973-ad4c-d21b088137f5",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "보통",
            "subcategory": "파스",
            "text": "Azure에서 Azure 리소스로의 통신을 사용하도록 강제 터널링을 구현하지 마세요.",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
            "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
            "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
            "severity": "보통",
            "subcategory": "세분화",
            "text": "연결을 제한하기 위해 VirtualNetwork 서비스 태그를 사용하는 NSG 인바운드 기본 규칙을 사용하지 마세요."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "c2447ec6-6138-4a72-80f1-ce16ed301d6e",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
            "severity": "보통",
            "subcategory": "세분화",
            "text": "서브넷 생성을 랜딩 존 소유자에게 위임합니다. ",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "보통",
            "subcategory": "세분화",
            "text": "NSG를 사용하여 서브넷 전체의 트래픽과 플랫폼 전체의 동/서 트래픽(랜딩 존 간의 트래픽)을 보호할 수 있습니다.",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)",
            "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563",
            "severity": "보통",
            "subcategory": "세분화",
            "text": "애플리케이션 팀은 서브넷 수준 NSG에서 애플리케이션 보안 그룹을 사용하여 랜딩 존 내의 다중 계층 VM을 보호해야 합니다.",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "보통",
            "subcategory": "세분화",
            "text": "NSG 및 애플리케이션 보안 그룹을 사용하여 랜딩 존 내에서 트래픽을 마이크로 분할하고 중앙 NVA를 사용하여 트래픽 흐름을 필터링하지 않도록 합니다.",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "보통",
            "subcategory": "세분화",
            "text": "NSG 흐름 로그를 사용하도록 설정하고 트래픽 분석에 피드하여 내부 및 외부 트래픽 흐름에 대한 인사이트를 얻습니다.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "a8042d88-e79d-417b-93b2-2a5a67e7a8ed",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "보통",
            "subcategory": "세분화",
            "text": "NSG를 사용하여 랜딩 존 간의 연결을 선택적으로 허용합니다.",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "4b30e38c-3f29-4812-a236-3cefe179b599",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "보통",
            "subcategory": "세분화",
            "text": "Virtual WAN 토폴로지의 경우 조직에서 랜딩 존을 통과하는 트래픽에 대한 필터링 및 로깅 기능이 필요한 경우 Azure Firewall을 통해 랜딩 존 간에 트래픽을 라우팅합니다.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
            "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
            "severity": "보통",
            "subcategory": "가상 WAN",
            "text": "간소화된 Azure 네트워킹 관리를 위해 가상 WAN을 고려하고 시나리오가 Virtual WAN 라우팅 디자인 목록에 명시적으로 설명되어 있는지 확인합니다.",
            "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "보통",
            "subcategory": "가상 WAN",
            "text": "Azure 지역당 가상 WAN 허브를 사용하여 공통 글로벌 Azure 가상 WAN을 통해 Azure 지역에서 여러 랜딩 존을 함께 연결합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "4f5664b5-e984-4a85-ac77-3e7d261623a7",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "보통",
            "subcategory": "가상 WAN",
            "text": "가상 허브 라우팅 기능을 사용하여 VNet과 분기 간의 트래픽을 추가로 분할합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "65a917e1-f348-4ef2-94c2-7d42e8bbac75",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "보통",
            "subcategory": "가상 WAN",
            "text": "Express 경로를 사용하여 가상 WAN 허브를 온-프레미스 데이터 센터에 연결",
            "training": "https://learn.microsoft.com/learn/modules/configure-expressroute-virtual-wan/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "71559ab9-153e-4890-aae2-8c84c33b6b78",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "보통",
            "subcategory": "가상 WAN",
            "text": "사이트 간 VPN을 통해 분기 및 원격 위치를 가장 가까운 가상 WAN 허브에 연결하거나 SD-WAN 파트너 솔루션을 통해 가상 WAN에 대한 분기 연결을 사용하도록 설정합니다.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-hybrid-networking/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "08b9fe5c-4104-49d4-83a9-23c3474d0001",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "보통",
            "subcategory": "가상 WAN",
            "text": "지점 및 사이트 간 VPN을 통해 사용자를 가상 WAN 허브에 연결합니다.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-hybrid-networking/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "보통",
            "subcategory": "가상 WAN",
            "text": "Azure의 리소스 간 통신이 Microsoft 백본 네트워크를 통해 발생하도록 'Azure의 트래픽은 Azure에 유지됨' 원칙을 따릅니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "보통",
            "subcategory": "가상 WAN",
            "text": "아웃바운드 인터넷 트래픽 보호 및 필터링을 위해 Azure 방화벽을 배포합니다.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "12df27ee-412e-47f9-a3f6-304722dd69c5",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "보통",
            "subcategory": "가상 WAN",
            "text": "VWAN에서 파트너 네트워킹 기술 및 NVA를 배포할 때 파트너 공급업체의 지침에 따라 구성을 확인하여 충돌하는 구성이 없는지 확인합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "b5c2622f-54b6-49ba-b33a-ad5e8c68e1d7",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "보통",
            "subcategory": "가상 WAN",
            "text": "Azure 가상 WAN 및 Azure 방화벽 리소스가 연결 구독에 만들어졌는지 확인합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
            "severity": "보통",
            "subcategory": "가상 WAN",
            "text": "네트워크 아키텍처가 Azure 가상 WAN 제한 내에 있는지 확인합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
            "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
            "severity": "보통",
            "subcategory": "가상 WAN",
            "text": "가상 WAN용 Azure 모니터 인사이트를 사용하여 가상 WAN의 엔드투엔드 토폴로지, 상태 및 주요 메트릭을 모니터링합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결 ",
            "guid": "2df4930f-6a43-49a3-926b-309f02c302f0",
            "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/identity/adds-extend-domain#vm-recommendations",
            "severity": "높다",
            "subcategory": "잡종",
            "text": "AD DS를 실행하는 VM을 두 개 이상 도메인 컨트롤러로 배포하는 경우 서로 다른 가용성 영역에 추가합니다. 지역에서 사용할 수 없는 경우 가용성 집합에 배포합니다."
        },
        {
            "category": "작업",
            "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
            "severity": "높다",
            "subcategory": "정문",
            "text": "Azure 정문에서 관리되는 TLS 인증서를 사용합니다. 운영 비용과 인증서 갱신으로 인한 중단 위험을 줄입니다."
        },
        {
            "category": "작업",
            "guid": "f00a69de-7076-4734-a734-6e4552cad9e1",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
            "severity": "보통",
            "subcategory": "정문",
            "text": "Azure 정문에서 고객 관리형 TLS 인증서를 사용하는 경우 '최신' 인증서 버전을 사용합니다. 수동 인증서 갱신으로 인한 중단 위험을 줄입니다."
        },
        {
            "category": "작업",
            "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code",
            "severity": "보통",
            "subcategory": "정문",
            "text": "Azure 프런트 도어 WAF 구성을 코드로 정의합니다. 코드를 사용하면 새 규칙 집합 버전을 보다 쉽게 채택하고 추가 보호를 얻을 수 있습니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls",
            "severity": "높다",
            "subcategory": "정문",
            "text": "Azure 전면 도어와 함께 종단 간 TLS를 사용합니다. 클라이언트에서 Front Door로, Front Door에서 원본으로 연결하는 데 TLS를 사용합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection",
            "severity": "보통",
            "subcategory": "정문",
            "text": "Azure Front Door에서 HTTP-HTTPS 리디렉션을 사용합니다. 이전 클라이언트를 HTTPS 요청으로 자동으로 리디렉션하여 지원합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf",
            "severity": "높다",
            "subcategory": "정문",
            "text": "Azure 프런트 도어 WAF를 사용하도록 설정합니다. 다양한 공격으로부터 애플리케이션을 보호합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf",
            "severity": "높다",
            "subcategory": "정문",
            "text": "워크로드에 맞게 Azure 프런트 도어 WAF를 조정합니다. 가양성 탐지를 줄입니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-prevention-mode",
            "severity": "높다",
            "subcategory": "정문",
            "text": "Azure 전면 도어 WAF에서 방지 모드를 사용합니다. 방지 모드는 WAF가 악의적인 요청을 차단하도록 합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets",
            "severity": "높다",
            "subcategory": "정문",
            "text": "Azure 프런트 도어 WAF 기본 규칙 집합을 사용하도록 설정합니다. 기본 규칙 집합은 일반적인 공격을 탐지하고 차단합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "147a13d4-2a2f-4824-a524-f5855b52b946",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules",
            "severity": "높다",
            "subcategory": "정문",
            "text": "Azure 프런트 도어 WAF 봇 관리 규칙을 사용하도록 설정합니다. 봇 규칙은 좋은 봇과 나쁜 봇을 감지합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions",
            "severity": "보통",
            "subcategory": "정문",
            "text": "최신 Azure Front Door WAF 규칙 집합 버전을 사용합니다. 규칙 집합 업데이트는 현재 위협 환경을 고려하여 정기적으로 업데이트됩니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "b9620385-1cde-418f-914b-a84a06982ffc",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting",
            "severity": "보통",
            "subcategory": "정문",
            "text": "Azure Front Door WAF에 속도 제한을 추가합니다. 속도 제한은 클라이언트가 실수로 또는 의도적으로 단기간에 많은 양의 트래픽을 보내는 것을 차단합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits",
            "severity": "보통",
            "subcategory": "정문",
            "text": "Azure 전면 도어 WAF 속도 제한에 대해 높은 임계값을 사용합니다. 높은 속도 제한 임계값은 합법적인 트래픽 차단을 방지하는 동시에 인프라를 압도할 수 있는 매우 많은 수의 요청에 대한 보호를 제공합니다. "
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic",
            "severity": "낮다",
            "subcategory": "정문",
            "text": "Azure 프런트 도어 WAF를 사용하여 트래픽을 지오 필터링합니다. 예상 지역의 트래픽만 허용하고 다른 지역의 트래픽은 차단합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "00acd8a9-6975-414f-8491-2be6309893b8",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location",
            "severity": "보통",
            "subcategory": "정문",
            "text": "Azure Front Door WAF를 사용하여 트래픽을 지리적으로 필터링할 때 알 수 없는(ZZ) 위치를 지정합니다. IP 주소를 지리적으로 일치시킬 수 없는 경우 합법적인 요청을 실수로 차단하지 마세요."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "높다",
            "subcategory": "거버넌스",
            "text": "Azure 정책 활용"
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "e979377b-cdb3-4751-ab2a-b13ada6e55d7",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/naming-and-tagging",
            "severity": "보통",
            "subcategory": "거버넌스",
            "text": "필요한 Azure 태그를 식별하고 추가 정책 모드를 사용하여 사용량을 적용합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "보통",
            "subcategory": "거버넌스",
            "text": "규정 및 규정 준수 요구 사항을 Azure 정책 정의 및 Azure 역할 할당에 매핑합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "보통",
            "subcategory": "거버넌스",
            "text": "상속된 범위에서 할당할 수 있도록 최상위 루트 관리 그룹에서 Azure Policy 정의 설정"
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "보통",
            "subcategory": "거버넌스",
            "text": "필요한 경우 하위 수준에서 제외를 사용하여 가장 높은 적절한 수준에서 정책 할당을 관리합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "43334f24-9116-4341-a2ba-527526944008",
            "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
            "severity": "낮다",
            "subcategory": "거버넌스",
            "text": "Azure Policy를 사용하여 사용자가 구독/관리 그룹 수준에서 프로비전할 수 있는 서비스 제어"
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "보통",
            "subcategory": "거버넌스",
            "text": "가능한 경우 기본 제공 정책을 사용하여 운영 오버헤드를 최소화합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "보통",
            "subcategory": "거버넌스",
            "text": "특정 범위에서 기본 제공 정책 기여자 역할을 할당하여 응용 프로그램 수준 관리를 사용하도록 설정합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "19048384-5c98-46cb-8913-156a12476e49",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "보통",
            "subcategory": "거버넌스",
            "text": "루트 관리 그룹 범위에서 수행된 Azure Policy 할당 수를 제한하여 상속된 범위에서 제외를 통해 관리하지 않도록 합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
            "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
            "severity": "보통",
            "subcategory": "거버넌스",
            "text": "Azure 정책을 사용하여 VM 확장을 통해 소프트웨어 구성을 자동으로 배포하고 규격 기준 VM 구성을 적용합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "9b5e2a28-9823-4faf-ab7e-afa5f6c57221",
            "link": "Configure Azure Automation Start/Stop VMs during off-hours | Microsoft Learn",
            "severity": "보통",
            "subcategory": "거버넌스",
            "text": "비용을 절감하기 위해 자동화 태그를 사용하여 사용자 환경에서 VM을 시작/중지하는 것이 좋습니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
            "severity": "보통",
            "subcategory": "거버넌스",
            "text": "Azure 정책을 통해 VM 보안 구성 드리프트를 모니터링합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "5017f154-e3ab-4369-9829-e7e316183687",
            "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
            "severity": "높다",
            "subcategory": "비밀",
            "text": "Azure 키 자격 증명 모음을 사용하여 비밀 및 자격 증명 저장"
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
            "guid": "a0477a20-9945-4bda-9333-4f2491163418",
            "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
            "severity": "보통",
            "subcategory": "비밀",
            "text": "애플리케이션 및 지역마다 다른 Azure Key Vault를 사용하여 트랜잭션 규모 제한을 방지하고 비밀에 대한 액세스를 제한합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "보통",
            "subcategory": "비밀",
            "text": "삭제된 개체에 대한 보존 보호를 허용하도록 일시 삭제 및 제거 정책을 사용하도록 설정하여 Azure Key Vault를 프로비전합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "보통",
            "subcategory": "비밀",
            "text": "키, 비밀 및 인증서를 특수 사용자 지정 Azure AD(Active Directory) 역할로 영구적으로 삭제할 수 있는 권한 부여를 제한하여 최소 권한 모델을 따릅니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "보통",
            "subcategory": "비밀",
            "text": "공용 인증 기관을 통해 인증서 관리 및 갱신 프로세스를 자동화하여 관리를 용이하게 합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "913156a1-2476-4e49-b541-acdce979377b",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "보통",
            "subcategory": "비밀",
            "text": "키 및 인증서 순환을 위한 자동화된 프로세스를 설정합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "보통",
            "subcategory": "비밀",
            "text": "자격 증명 모음에서 방화벽 및 가상 네트워크 서비스 엔드포인트 또는 프라이빗 엔드포인트를 사용하도록 설정하여 키 자격 증명 모음에 대한 액세스를 제어합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
            "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
            "severity": "보통",
            "subcategory": "비밀",
            "text": "플랫폼 중앙 Azure Monitor 로그 분석 작업 영역을 사용하여 Key Vault의 각 인스턴스 내에서 키, 인증서 및 비밀 사용을 감사합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "보통",
            "subcategory": "비밀",
            "text": "Key Vault 인스턴스화 및 권한 있는 액세스를 위임하고 Azure Policy를 사용하여 일관된 규정 준수 구성을 적용합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "16183687-a047-47a2-8994-5bda43334f24",
            "link": "https://learn.microsoft.com/azure/security/fundamentals/encryption-atrest",
            "severity": "보통",
            "subcategory": "비밀",
            "text": "주체 암호화 기능을 위해 Microsoft 관리형 키를 기본값으로 설정하고 필요한 경우 고객 관리형 키를 사용합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "보통",
            "subcategory": "비밀",
            "text": "지역별 환경당 애플리케이션당 Azure 키 자격 증명 모음을 사용합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "보통",
            "subcategory": "비밀",
            "text": "사용자 고유의 키를 가져오려는 경우 고려된 모든 서비스에서 지원되지 않을 수 있습니다. 불일치가 원하는 결과를 방해하지 않도록 관련 완화를 구현합니다. 대기 시간을 최소화하는 적절한 지역 쌍과 재해 복구 지역을 선택합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
            "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
            "severity": "보통",
            "subcategory": "안전",
            "text": "Azure AD 보고 기능을 사용하여 액세스 제어 감사 보고서를 생성합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "4e3ab369-3829-4e7e-9161-83687a0477a2",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-data-export?tabs=portal",
            "severity": "보통",
            "subcategory": "안전",
            "text": "장기 데이터 보존을 위해 Azure 활동 로그를 Azure 모니터 로그로 내보냅니다. 필요한 경우 2년 이상의 장기 저장을 위해 Azure 저장소로 내보냅니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "09945bda-4333-44f2-9911-634182ba5275",
            "link": "https://learn.microsoft.com/azure/security-center/",
            "severity": "보통",
            "subcategory": "안전",
            "text": "모든 구독에 대해 클라우드용 Defender 표준을 사용하도록 설정합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
            "link": "https://learn.microsoft.com/azure/security-center/",
            "severity": "보통",
            "subcategory": "안전",
            "text": "Azure Monitor 로그 및 클라우드용 Defender를 통해 기본 운영 체제 패치 드리프트를 모니터링합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "보통",
            "subcategory": "안전",
            "text": "기본 리소스 구성을 중앙 집중식 Azure 모니터 로그 분석 작업 영역에 연결합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "b86ad884-08e3-4727-94b8-75ba18f20459",
            "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response",
            "severity": "보통",
            "subcategory": "안전",
            "text": "프로덕션 환경에 허용하기 전에 Azure 서비스에 대한 인시던트 대응 계획을 결정합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "01365d38-e43f-49cc-ad86-8266abca264f",
            "link": "https://www.microsoft.com/security/business/zero-trust",
            "severity": "보통",
            "subcategory": "안전",
            "text": "적절한 경우 Azure 플랫폼에 액세스하기 위한 제로 트러스트 접근 방식을 구현합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "9a19bf39-c95d-444c-9c89-19ca1f6d5215",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework",
            "severity": "보통",
            "subcategory": "안전",
            "text": "새 Azure 서비스 구현 방법 계획"
        },
        {
            "category": "보안, 거버넌스 및 규정 준수",
            "guid": "ae514b93-3d45-485e-8112-9bd7ba012f7b",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework",
            "severity": "보통",
            "subcategory": "안전",
            "text": "Azure 서비스에 대한 서비스 요청 이행 방법 계획"
        },
        {
            "category": "보안, 거버넌스 및 규정 준수 ",
            "guid": "cacf55bc-e4e4-46be-96bc-57a5f23a269a",
            "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/resource-naming",
            "severity": "높다",
            "subcategory": "거버넌스",
            "text": "Microsoft 모범 사례 명명 표준을 따르는 것이 좋습니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수 ",
            "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
            "link": "https://learn.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer",
            "severity": "높다",
            "subcategory": "안전",
            "text": "저장소 계정으로의 보안 전송을 사용하도록 설정해야 합니다."
        },
        {
            "category": "보안, 거버넌스 및 규정 준수 ",
            "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
            "link": "https://learn.microsoft.com/en-us/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
            "severity": "높다",
            "subcategory": "안전",
            "text": "스토리지 계정에 대해 컨테이너 일시 삭제를 사용하도록 설정하여 삭제된 컨테이너 및 해당 콘텐츠를 복구합니다."
        }
    ],
    "metadata": {
        "name": "Azure Landing Zone Review",
        "state": "GA",
        "timestamp": "March 16, 2023"
    },
    "severities": [
        {
            "name": "높다"
        },
        {
            "name": "보통"
        },
        {
            "name": "낮다"
        }
    ],
    "status": [
        {
            "description": "이 검사는 아직 검토되지 않았습니다.",
            "name": "확인되지 않음"
        },
        {
            "description": "이 검사와 연결된 작업 항목이 있습니다.",
            "name": "열다"
        },
        {
            "description": "이 검사가 확인되었으며 연결된 추가 작업 항목이 없습니다.",
            "name": "성취"
        },
        {
            "description": "권장 사항을 이해했지만 현재 요구 사항에서 필요하지 않음",
            "name": "필요하지 않음"
        },
        {
            "description": "현재 디자인에는 적용되지 않음",
            "name": "해당 없음"
        }
    ]
}
checklists/lz_checklist.ja.json METASEP
{
    "categories": [
        {
            "name": "ID とアクセス"
        },
        {
            "name": "ネットワーク トポロジと接続性"
        },
        {
            "name": "セキュリティ、ガバナンス、コンプライアンス"
        },
        {
            "name": "管理と監視"
        },
        {
            "name": "管理グループとサブスクリプション"
        },
        {
            "name": "オペレーションズ"
        },
        {
            "name": "バックアップと災害復旧"
        }
    ],
    "items": [
        {
            "category": "バックアップと災害復旧",
            "guid": "7ea02e1c-7166-45a3-bdf5-098891367fcb",
            "link": "https://learn.microsoft.com/en-us/azure/reliability/cross-region-replication-azure",
            "severity": "中程度",
            "subcategory": "データ保護",
            "text": "ペアのリージョンを持つ BCDR の Azure でのリージョン間レプリケーションを検討する"
        },
        {
            "category": "バックアップと災害復旧",
            "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
            "link": "https://learn.microsoft.com/en-us/azure/storage/common/storage-redundancy",
            "severity": "中程度",
            "subcategory": "データ保護",
            "text": "Azure Backup を使用する場合は、既定の設定が GRS であるため、さまざまなバックアップの種類 (GRS、ZRS、LRS) を考慮してください。"
        },
        {
            "category": "ID とアクセス",
            "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
            "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
            "severity": "高い",
            "subcategory": "同一性",
            "text": "テナント全体のアカウントのロックアウトを防ぐために、緊急アクセスまたは非常用アカウントを実装する",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "ID とアクセス",
            "guid": "348ef254-c27d-442e-abba-c7571559ab91",
            "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
            "severity": "高い",
            "subcategory": "同一性",
            "text": "管理グループ、サブスクリプション、リソース グループ、およびリソースに RBAC モデルを適用する",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "ID とアクセス",
            "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
            "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
            "severity": "低い",
            "subcategory": "同一性",
            "text": "Azure 環境に対する権限を持つすべてのユーザーに Azure AD 条件付きアクセス ポリシーを適用する",
            "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/"
        },
        {
            "category": "ID とアクセス",
            "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
            "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
            "severity": "高い",
            "subcategory": "同一性",
            "text": "Azure 環境に対する権限を持つすべてのユーザーに多要素認証を適用する",
            "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/"
        },
        {
            "category": "ID とアクセス",
            "guid": "e6a83de5-de32-4c19-a248-1607d5d1e4e6",
            "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
            "severity": "中程度",
            "subcategory": "同一性",
            "text": "役割とセキュリティの要件に基づいて、ランディング ゾーン内にデプロイされたリソースを管理するための一元化された委任された責任を適用する",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/"
        },
        {
            "category": "ID とアクセス",
            "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
            "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
            "severity": "中程度",
            "subcategory": "同一性",
            "text": "Azure AD 特権 ID 管理 (PIM) を適用して、ゼロ スタンディング アクセスと最小特権を確立する",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "ID とアクセス",
            "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
            "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
            "severity": "高い",
            "subcategory": "同一性",
            "text": "すべてのアカウントの種類に対して、認証の種類として [職場または学校アカウント] のみを使用します。マイクロソフトのアカウントの使用を避ける",
            "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/"
        },
        {
            "category": "ID とアクセス",
            "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
            "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
            "severity": "中程度",
            "subcategory": "同一性",
            "text": "グループを使用してアクセス許可を割り当てるだけです。グループ管理システムが既に導入されている場合は、オンプレミスのグループを Azure-AD 専用グループに追加します。",
            "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/"
        },
        {
            "category": "ID とアクセス",
            "guid": "f5664b5e-984a-4859-a773-e7d261623a76",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
            "severity": "中程度",
            "subcategory": "同一性",
            "text": "Azure プラットフォーム所有者、ネットワーク管理、セキュリティ運用、サブスクリプション所有者、アプリケーション所有者の主要なロールに Azure カスタム ロールを使用することを検討してください。",
            "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/"
        },
        {
            "category": "ID とアクセス",
            "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
            "link": "https://azure.microsoft.com/resources/achieving-compliant-data-residency-and-security-with-azure/",
            "severity": "中程度",
            "subcategory": "同一性",
            "text": "データ主権の要件が存在する場合は、Azure ポリシーをデプロイして適用できます",
            "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/"
        },
        {
            "category": "ID とアクセス",
            "guid": "1559ab91-53e8-4908-ae28-c84c33b6b780",
            "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
            "severity": "中程度",
            "subcategory": "同一性",
            "text": "Azure Active Directory ドメイン サービス (AADDS) が使用されている場合は、このサービスは 1 つのサブスクリプションにのみ投影できるため、プライマリ リージョン内に AADDS をデプロイします。",
            "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/"
        },
        {
            "category": "ID とアクセス",
            "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
            "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
            "severity": "中程度",
            "subcategory": "同一性",
            "text": "AADDS が使用されている場合は、すべてのワークロードの互換性を評価します。",
            "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/"
        },
        {
            "category": "ID とアクセス",
            "guid": "ac6a9e01-e6a8-43de-9de3-2c1992481607",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
            "severity": "中程度",
            "subcategory": "同一性",
            "text": "Windows サーバー上の AD が使用されている場合、必要なすべてのリソースが正しいドメイン コントローラーにアクセスできますか。",
            "training": "https://learn.microsoft.com/learn/paths/implement-windows-server-iaas-virtual-machine-identity/"
        },
        {
            "category": "ID とアクセス",
            "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
            "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
            "severity": "中程度",
            "subcategory": "同一性",
            "text": "Azure AD アプリケーション プロキシを VPN またはリバース プロキシの代わりとして使用して、リモート ユーザーに内部アプリケーション (クラウドまたはオンプレミスでホストされている) へのセキュリティで保護された認証されたアクセスを提供することを検討してください。",
            "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/"
        },
        {
            "category": "ID とアクセス",
            "guid": "35037e68-9349-4c15-b371-228514f4cdff",
            "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
            "severity": "中程度",
            "subcategory": "同一性",
            "text": "オンプレミスの同期済みアカウントを Azure AD ロールの割り当てに使用しないでください。",
            "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/"
        },
        {
            "category": "管理グループとサブスクリプション",
            "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
            "guid": "2df27ee4-12e7-4f98-9f63-04722dd69c5b",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
            "severity": "中程度",
            "subcategory": "サブスクリプション",
            "text": "理想的には、3 つから 4 レベル以下の適度にフラットな管理グループ階層を適用します。",
            "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/"
        },
        {
            "category": "管理グループとサブスクリプション",
            "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
            "guid": "5c2622f5-4b69-4bad-93aa-d5e8c68e1d76",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/resource-tagging/?toc=/azure/azure-resource-manager/management/toc.json",
            "severity": "中程度",
            "subcategory": "サブスクリプション",
            "text": "Azure Policy を使用してリソース タグを適用または追加する",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "管理グループとサブスクリプション",
            "guid": "667313b4-f566-44b5-b984-a859c773e7d2",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
            "severity": "中程度",
            "subcategory": "サブスクリプション",
            "text": "サンドボックス管理グループを適用して、ユーザーがすぐに Azure を試せるようにする",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/"
        },
        {
            "category": "管理グループとサブスクリプション",
            "guid": "61623a76-5a91-47e1-b348-ef254c27d42e",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
            "severity": "中程度",
            "subcategory": "サブスクリプション",
            "text": "ルート管理グループの下にプラットフォーム管理グループを適用して、共通のプラットフォーム ポリシーと Azure ロールの割り当てをサポートする",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/"
        },
        {
            "category": "管理グループとサブスクリプション",
            "guid": "8bbac757-1559-4ab9-853e-8908ae28c84c",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
            "severity": "中程度",
            "subcategory": "サブスクリプション",
            "text": "プラットフォーム管理グループで専用の接続サブスクリプションを適用して、Azure Virtual WAN ハブ、プライベート ドメイン ネーム システム (DNS)、ExpressRoute 回線、およびその他のネットワーク リソースをホストします。",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/"
        },
        {
            "category": "管理グループとサブスクリプション",
            "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant = (array_length(mgmtChain) > 1)",
            "guid": "33b6b780-8b9f-4e5c-9104-9d403a923c34",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---default-management-group",
            "severity": "中程度",
            "subcategory": "サブスクリプション",
            "text": "ルート管理グループの下にサブスクリプションを配置しないように強制する"
        },
        {
            "category": "管理グループとサブスクリプション",
            "guid": "74d00018-ac6a-49e0-8e6a-83de5de32c19",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization",
            "severity": "中程度",
            "subcategory": "サブスクリプション",
            "text": "管理グループ階層設定で Azure RBAC 承認を有効にすることで、特権ユーザーのみがテナント内の管理グループを操作できるように強制します。"
        },
        {
            "category": "管理グループとサブスクリプション",
            "guid": "92481607-d5d1-4e4e-9146-58d3558fd772",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/overview",
            "severity": "中程度",
            "subcategory": "サブスクリプション",
            "text": "ルート レベルの管理グループの下に管理グループを適用して、セキュリティ、コンプライアンス、接続、機能のニーズに基づいてワークロードの種類を表します。"
        },
        {
            "category": "管理グループとサブスクリプション",
            "guid": "49b82111-2df2-47ee-912e-7f983f630472",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/overview",
            "severity": "高い",
            "subcategory": "サブスクリプション",
            "text": "リソース所有者に自分の役割と責任を認識させ、レビュー、予算レビュー、ポリシーコンプライアンスにアクセスし、必要に応じて修復するプロセスを適用します。"
        },
        {
            "category": "管理グループとサブスクリプション",
            "guid": "2dd69c5b-5c26-422f-94b6-9bad33aad5e8",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
            "severity": "中程度",
            "subcategory": "サブスクリプション",
            "text": "すべてのサブスクリプション所有者と IT コア チームが、ワークロード設計セッションの一環としてサブスクリプション リソースの制限を認識していることを確認します。"
        },
        {
            "category": "管理グループとサブスクリプション",
            "guid": "c68e1d76-6673-413b-9f56-64b5e984a859",
            "link": "https://learn.microsoft.com/azure/cost-management-billing/reservations/save-compute-costs-reservations",
            "severity": "高い",
            "subcategory": "サブスクリプション",
            "text": "必要に応じてリザーブドインスタンス を使用して、コストを最適化し、ターゲットリージョンで使用可能な容量を確保します。Azure ポリシーを使用して、購入した予約インスタンス VM SKU の使用を強制します。",
            "training": "https://learn.microsoft.com/learn/paths/improve-reliability-modern-operations/"
        },
        {
            "category": "管理グループとサブスクリプション",
            "guid": "c773e7d2-6162-43a7-95a9-17e1f348ef25",
            "link": "https://learn.microsoft.com/azure/architecture/framework/scalability/design-capacity",
            "severity": "高い",
            "subcategory": "サブスクリプション",
            "text": "ダッシュボード、ワークブック、または手動プロセスを適用して、使用されている容量レベルを監視する",
            "training": "https://learn.microsoft.com/learn/paths/monitor-usage-performance-availability-resources-azure-monitor/"
        },
        {
            "category": "管理グループとサブスクリプション",
            "guid": "4c27d42e-8bba-4c75-9155-9ab9153e8908",
            "link": "https://azure.microsoft.com/global-infrastructure/services/",
            "severity": "中程度",
            "subcategory": "サブスクリプション",
            "text": "選択した展開リージョン内で必要なサービスと機能を利用できることを確認する",
            "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/"
        },
        {
            "category": "管理グループとサブスクリプション",
            "guid": "ae28c84c-33b6-4b78-88b9-fe5c41049d40",
            "link": "https://learn.microsoft.com/azure/cost-management-billing/cost-management-billing-overview",
            "severity": "高い",
            "subcategory": "サブスクリプション",
            "text": "コスト管理のプロセスを適用する",
            "training": "https://learn.microsoft.com/learn/paths/control-spending-manage-bills/"
        },
        {
            "category": "管理グループとサブスクリプション",
            "guid": "3a923c34-74d0-4001-aac6-a9e01e6a83de",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/overview",
            "severity": "中程度",
            "subcategory": "サブスクリプション",
            "text": "AD が Windows Server 上にある場合は、プラットフォーム管理グループに専用の ID サブスクリプションを確立して、Windows Server Active Directory ドメイン コントローラーをホストします。",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/"
        },
        {
            "category": "管理グループとサブスクリプション",
            "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
            "guid": "5de32c19-9248-4160-9d5d-1e4e614658d3",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/track-costs",
            "severity": "中程度",
            "subcategory": "サブスクリプション",
            "text": "タグが請求とコスト管理に使用されていることを確認する",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "管理と監視",
            "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
            "severity": "高い",
            "subcategory": "フロントドア",
            "text": "診断設定を追加して、Azure Front Door WAF のログを保存します。ログを定期的に確認して、攻撃や誤検知がないか確認してください。"
        },
        {
            "category": "管理と監視",
            "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
            "severity": "中程度",
            "subcategory": "フロントドア",
            "text": "Azure Front Door のログを Microsoft Sentinel に送信します。攻撃を検出し、フロント ドア テレメトリを Azure 環境全体に統合します。"
        },
        {
            "category": "管理と監視",
            "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "Azure ロールベースのアクセス制御 (Azure RBAC)、データ主権要件、またはデータ保持ポリシーによって個別のワークスペースが義務付けられている場合を除き、1 つのモニター ログ ワークスペースを使用してプラットフォームを一元的に管理します。",
            "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
        },
        {
            "category": "管理と監視",
            "guid": "e179b599-de0d-4597-9cd4-cd21b088137f",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "ランディング ゾーンは文書化されていますか?"
        },
        {
            "category": "管理と監視",
            "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "ログの保有要件が 2 年を超える場合は、ログを Azure Storage にエクスポートします。ライトワンス、リードメニーポリシーで不変ストレージを使用して、ユーザーが指定した間隔でデータを消去および変更できないようにします。",
            "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/"
        },
        {
            "category": "管理と監視",
            "guid": "00f1ce16-ed30-41d6-b872-e52e3611cc58",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "アクセス制御とコンプライアンス レポートに Azure Policy を使用します。Azure Policy には、組織全体の設定を適用して、一貫したポリシー遵守と迅速な違反検出を保証する機能が用意されています。",
            "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/"
        },
        {
            "category": "管理と監視",
            "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
            "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "Azure Policy を使用して、ゲスト内仮想マシン (VM) の構成ドリフトを監視します。ポリシーを使用してゲスト構成監査機能を有効にすると、アプリケーション チームのワークロードは、わずかな労力で機能機能をすぐに使用できます。",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "管理と監視",
            "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
            "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "Azure Automation の更新管理は、Windows VM と Linux VM の両方の長期的な修正プログラム適用メカニズムとして使用します。",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/"
        },
        {
            "category": "管理と監視",
            "guid": "90483845-c986-4cb2-a131-56a12476e49f",
            "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "ネットワーク ウォッチャーを使用してトラフィック フローをプロアクティブに監視する",
            "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/"
        },
        {
            "category": "管理と監視",
            "guid": "541acdce-9793-477b-adb3-751ab2ab13ad",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "リソース ロックを使用して、重要な共有サービスが誤って削除されないようにします。",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "管理と監視",
            "guid": "a6e55d7d-8a2a-4db1-87d6-326af625ca44",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "低い",
            "subcategory": "モニタリング",
            "text": "拒否ポリシーを使用して、Azure ロールの割り当てを補完します。拒否ポリシーと Azure ロールの割り当てを組み合わせることで、リソースをデプロイおよび構成できるユーザーと、デプロイおよび構成できるリソースを適用するための適切なガードレールが確実に配置されます。"
        },
        {
            "category": "管理と監視",
            "guid": "e5695f22-23ac-4e8c-a123-08ca5017f154",
            "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "サービスとリソースの正常性イベントを、プラットフォーム監視ソリューション全体の一部として含めます。プラットフォームの観点からサービスとリソースの正常性を追跡することは、Azure のリソース管理の重要な要素です。"
        },
        {
            "category": "管理と監視",
            "guid": "d5f345bf-97ab-41a7-819c-6104baa7d48c",
            "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "アラートとアクション グループを Azure Service Health プラットフォームの一部として含めて、アラートまたは問題に対処できるようにする"
        },
        {
            "category": "管理と監視",
            "guid": "e3ab3693-829e-47e3-8618-3687a0477a20",
            "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "生のログ エントリをオンプレミスの監視システムに送り返さないでください。代わりに、Azure で生まれたデータは Azure にとどまるという原則を採用します。オンプレミスの SIEM 統合が必要な場合は、ログではなく重要なアラートを送信します。"
        },
        {
            "category": "管理と監視",
            "guid": "9945bda4-3334-4f24-a116-34182ba52752",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "一元化された Azure Monitor ログ分析ワークスペースを使用して、IaaS および PaaS アプリケーション リソースからログとメトリックを収集し、Azure RBAC を使用してログ アクセスを制御します。"
        },
        {
            "category": "管理と監視",
            "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "分析情報とレポートには Azure Monitor ログを使用します。"
        },
        {
            "category": "管理と監視",
            "guid": "619e8a13-f988-4795-85d6-26886d70ba6c",
            "link": "https://learn.microsoft.com/azure/azure-monitor/agents/diagnostics-extension-overview",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "必要に応じて、Azure 診断拡張機能ログ ストレージのランディング ゾーン内の共有ストレージ アカウントを使用します。"
        },
        {
            "category": "管理と監視",
            "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
            "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "運用アラートの生成には、Azure Monitor アラートを使用します。"
        },
        {
            "category": "管理と監視",
            "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
            "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "Azure 間の仮想マシンのディザスター リカバリー シナリオには、Azure Site Recovery を使用します。これにより、リージョン間でワークロードをレプリケートできます。"
        },
        {
            "category": "管理と監視",
            "guid": "b2ab13ad-a6e5-45d7-b8a2-adb117d6326a",
            "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "ネイティブの PaaS サービスのディザスター リカバリー機能を使用してテストしてください。"
        },
        {
            "category": "管理と監視",
            "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
            "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "Azure ネイティブのバックアップ機能を使用します。パートナー/顧客が Azure Backup と、バックアップ管理を大幅に簡素化できるすべての新機能を認識していることを確認します。"
        },
        {
            "category": "管理と監視",
            "guid": "859c3900-4514-41eb-b010-475d695abd74",
            "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "監視要件が評価され、適切なデータ収集とアラートの構成が適用されていることを確認します"
        },
        {
            "category": "管理と監視",
            "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
            "link": "https://learn.microsoft.com/en-us/azure/automation/how-to/region-mappings",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "リンクされた Log Analytics ワークスペースと自動化アカウントでサポートされているリージョンを検討する"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "6138a720-0f1c-4e16-bd30-1d6e872e52e3",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
            "severity": "中程度",
            "subcategory": "アプリ配信",
            "text": "内部向けアプリ (企業) と外部向けアプリ (オンライン) の両方のランディング ゾーン内でアプリ配信を実行します。",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = (properties.webApplicationFirewallConfiguration.enabled == True and properties.webApplicationFirewallConfiguration.firewallMode == 'Prevention')",
            "guid": "611cc58b-5a4b-4151-8e43-a58a9c2299c4",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-faq",
            "severity": "中程度",
            "subcategory": "アプリ配信",
            "text": "HTTP/S アプリを安全に配信するには、アプリケーション ゲートウェイで WAF 保護とポリシーが有効になっていることを確認します。",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
            "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
            "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
            "severity": "中程度",
            "subcategory": "アプリ配信",
            "text": "アプリケーション ゲートウェイ v2 SKU を使用していることを確認する",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "d7b57d0c-6555-462f-8b3e-4563a4d87397",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/organize-resources?tabs=AzureManagementGroupsAndHierarchy",
            "severity": "中程度",
            "subcategory": "アプリ配信",
            "text": "HTTP/S アプリのセキュリティにアプリケーション ゲートウェイ v2 を使用できない場合は、パートナー NVA を使用します。",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "中程度",
            "subcategory": "アプリ配信",
            "text": "ランディング ゾーン仮想ネットワーク内の受信 HTTP/S 接続に使用される Azure アプリケーション ゲートウェイ v2 またはパートナー NVA を、セキュリティで保護されているアプリと共にデプロイします。",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "中程度",
            "subcategory": "アプリ配信",
            "text": "アプリケーション ランディング ゾーン内のすべてのパブリック IP アドレスに対して DDoS ネットワークまたは IP 保護プランを使用します。",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "中程度",
            "subcategory": "アプリ配信",
            "text": "Azure Front Door with WAF ポリシーを使用して、Azure リージョンにまたがるグローバル HTTP/S アプリを配信し、保護します。",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
            "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
            "severity": "中程度",
            "subcategory": "アプリ配信",
            "text": "Front Door とアプリケーション ゲートウェイを使用して HTTP/S アプリを保護する場合は、Front Door で WAF ポリシーを使用します。アプリケーション ゲートウェイをロックダウンして、Front Door からのトラフィックのみを受信します。",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "中程度",
            "subcategory": "アプリ配信",
            "text": "トラフィック マネージャーを使用して、HTTP/S 以外のプロトコルにまたがるグローバル アプリを配信します。",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
            "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
            "severity": "低い",
            "subcategory": "アプリ配信",
            "text": "ユーザーが内部アプリケーションにのみアクセスする必要がある場合、Azure AD アプリケーション プロキシは Azure 仮想デスクトップ (AVD) の代替と見なされていますか?",
            "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
            "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
            "severity": "中程度",
            "subcategory": "アプリ配信",
            "text": "ネットワーク内の着信接続用に開かれるファイアウォール ポートの数を減らすには、Azure AD アプリケーション プロキシを使用して、リモート ユーザーに内部アプリケーションへのセキュリティで保護された認証されたアクセスを提供することを検討してください。",
            "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "中程度",
            "subcategory": "暗号化",
            "text": "ExpressRoute Direct を使用している場合は、組織のルーターと MSEE の間のレイヤー 2 レベルでトラフィックを暗号化するために MACsec を構成します。この図は、この暗号化をフローで示しています。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
            "severity": "中程度",
            "subcategory": "暗号化",
            "text": "MACsec がオプションではないシナリオ (たとえば、ExpressRoute Direct を使用しないシナリオ) の場合は、VPN ゲートウェイを使用して、ExpressRoute プライベート ピアリング経由で IPsec トンネルを確立します。",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
            "guid": "ae248989-b306-4591-9186-de482e3f0f0e",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
            "severity": "中程度",
            "subcategory": "フロントドア",
            "text": "Front Door の WAF プロファイルを \"防止\" モードでデプロイします。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "062d5839-4d36-402f-bfa4-02811eb936e9",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
            "severity": "高い",
            "subcategory": "フロントドア",
            "text": "Azure Traffic Manager と Azure Front Door の組み合わせは避けてください。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
            "severity": "中程度",
            "subcategory": "フロントドア",
            "text": "Azure Front Door と配信元で同じドメイン名を使用します。ホスト名が一致しないと、微妙なバグが発生する可能性があります。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
            "severity": "低い",
            "subcategory": "フロントドア",
            "text": "Azure Front Door 配信元グループに配信元が 1 つしかない場合は、正常性プローブを無効にします。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
            "severity": "中程度",
            "subcategory": "フロントドア",
            "text": "Azure Front Door の適切な正常性プローブ エンドポイントを選択します。アプリケーションのすべての依存関係をチェックする正常性エンドポイントを構築することを検討してください。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
            "severity": "低い",
            "subcategory": "フロントドア",
            "text": "Azure Front Door で HEAD 正常性プローブを使用して、Front Door がアプリケーションに送信するトラフィックを減らします。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
            "severity": "中程度",
            "subcategory": "ハブ アンド スポーク",
            "text": "次のシナリオでは、従来のハブアンドスポーク ネットワーク トポロジに基づくネットワーク設計を検討してください。ネットワーク アーキテクチャは複数の Azure リージョンにまたがっており、リージョン間のランディング ゾーンの仮想ネットワーク間の推移的な接続は必要ありません。Azure リージョン間で仮想ネットワークを接続するために使用されるグローバル VNet ピアリングを使用して、複数の Azure リージョンにまたがるネットワーク アーキテクチャ。VPN と ExpressRoute 接続の間の推移的な接続を必要としないネットワーク アーキテクチャ。実施されている主なハイブリッド接続方法は ExpressRoute であり、VPN 接続の数は VPN ゲートウェイあたり 30 未満です。一元化された NVA と詳細なルーティングに依存しています。",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute",
            "severity": "中程度",
            "subcategory": "ハブ アンド スポーク",
            "text": "ExpressRoute ゲートウェイ、VPN ゲートウェイ、Azure ファイアウォールなどの共有サービス、または中央ハブ仮想ネットワーク内のパートナー NVA があることを確認します。必要に応じて、Active Directory ドメイン コントローラーと DNS サーバーも展開します。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
            "severity": "中程度",
            "subcategory": "ハブ アンド スポーク",
            "text": "パートナーのネットワーク テクノロジまたは NVA をデプロイする場合は、パートナー ベンダーのガイダンスに従ってください"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "44ce3b1a-2808-4b9e-a1bf-1038df03a822",
            "link": "https://azure.microsoft.com/solutions/network-appliances/",
            "severity": "中程度",
            "subcategory": "ハブ アンド スポーク",
            "text": "Azure アプリケーション ゲートウェイなどの受信 L7 サービスを、中央ハブ仮想ネットワークの共有サービスとしてデプロイしないでください。代わりに、それぞれのランディング ゾーンにアプリと共にデプロイします。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
            "severity": "中程度",
            "subcategory": "ハブ アンド スポーク",
            "text": "ExpressRoute ゲートウェイと VPN ゲートウェイ間のトランジットが必要な場合は、Azure Route Server を使用します。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
            "severity": "中程度",
            "subcategory": "ハブ アンド スポーク",
            "text": "Azure リージョン間で複数のハブ アンド スポーク トポロジを持つネットワーク アーキテクチャの場合、少数のランディング ゾーンがリージョン間で通信する必要がある場合は、グローバル仮想ネットワーク ピアリングを使用してランディング ゾーン仮想ネットワークを接続します。",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "37239b82-1112-4dbd-9eaf-12e6f943e53f",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs",
            "severity": "中程度",
            "subcategory": "ハブ アンド スポーク",
            "text": "ハブ アンド スポーク ネットワーク アーキテクチャを 2 つの Azure リージョンにデプロイし、リージョン間のすべてのランディング ゾーン間のトランジット接続が必要な場合は、デュアル回線で ExpressRoute を使用して、Azure リージョン間のランディング ゾーン仮想ネットワークにトランジット接続を提供します。",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
            "severity": "中程度",
            "subcategory": "ハブ アンド スポーク",
            "text": "Azure モニターを使用して、Azure 上のネットワークのエンド ツー エンドの状態を監視します。",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
            "severity": "中程度",
            "subcategory": "ハブ アンド スポーク",
            "text": "スポーク仮想ネットワークを中央ハブ仮想ネットワークに接続する場合は、VNet ピアリングの制限と、ExpressRoute 経由でアドバタイズできるプレフィックスの最大数を考慮してください。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
            "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
            "severity": "高い",
            "subcategory": "ハブ アンド スポーク",
            "text": "VNet ピアリングを構成するときに [リモート仮想ネットワークへのトラフィックを許可する] 設定を使用する"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli",
            "severity": "中程度",
            "subcategory": "ハイブリッド",
            "text": "Azure へのプライマリ接続として ExpressRoute を使用する可能性を調査したことを確認します。",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
            "severity": "中程度",
            "subcategory": "ハイブリッド",
            "text": "複数の ExpressRoute 回線または複数のオンプレミスの場所を使用する場合、特定のパスが優先される場合は、BGP 属性を使用してルーティングを最適化してください。",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
            "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
            "severity": "中程度",
            "subcategory": "ハイブリッド",
            "text": "帯域幅とパフォーマンスの要件に基づいて、ExpressRoute/VPN ゲートウェイに適切な SKU を使用していることを確認します。",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
            "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
            "severity": "中程度",
            "subcategory": "ハイブリッド",
            "text": "サポートされている Azure リージョンにゾーン冗長 ExpressRoute ゲートウェイをデプロイします。",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
            "link": "https://learn.microsoft.com/azure/networking/",
            "severity": "中程度",
            "subcategory": "ハイブリッド",
            "text": "10 Gbps を超える帯域幅または専用の 10/100 Gbps ポートを必要とするシナリオでは、ExpressRoute ダイレクトを使用します。",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
            "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
            "severity": "中程度",
            "subcategory": "ハイブリッド",
            "text": "低待機時間が必要な場合、またはオンプレミスから Azure へのスループットを 10 Gbps より大きくする必要がある場合は、FastPath を有効にして、データ パスから ExpressRoute ゲートウェイをバイパスします。",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
            "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
            "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
            "severity": "中程度",
            "subcategory": "ハイブリッド",
            "text": "VPN ゲートウェイを使用して、ブランチまたはリモートの場所を Azure に接続します。回復性を高めるには、ゾーン冗長ゲートウェイ (使用可能な場合) を展開します。",
            "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "fe237de1-43b1-46c3-8d7a-a9b64704489a",
            "link": "https://learn.microsoft.com/azure/networking/",
            "severity": "中程度",
            "subcategory": "ハイブリッド",
            "text": "ExpressRoute グローバル リーチを使用して、ExpressRoute 経由で Azure に接続されている大規模なオフィス、地域本社、またはデータセンターを接続します。",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
            "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
            "severity": "中程度",
            "subcategory": "ハイブリッド",
            "text": "運用環境と非運用環境の分離など、トラフィックの分離または専用の帯域幅が必要な場合は、異なる ExpressRoute 回線を使用します。これは、分離されたルーティングドメインを確保し、ノイズの多い隣人のリスクを軽減するのに役立ちます。",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
            "severity": "中程度",
            "subcategory": "ハイブリッド",
            "text": "組み込みの Azure Monitor メトリックを使用して、ExpressRoute の可用性と使用率を監視します。",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
            "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
            "severity": "中程度",
            "subcategory": "ハイブリッド",
            "text": "接続モニターを使用して、環境全体の接続を監視します。",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
            "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#challenges-of-using-multiple-expressroute-circuits",
            "severity": "中程度",
            "subcategory": "ハイブリッド",
            "text": "1 つのピアリングの場所から ExpressRoute 回線を明示的に使用しないでください。これを行うと、単一障害点が作成され、組織はピアリングの場所の停止の影響を受けやすくなります。",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "cd163e39-84a5-4b39-97b7-6973abd70d94",
            "link": "https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-staging-server",
            "severity": "中程度",
            "subcategory": "ハイブリッド",
            "text": "AD Connect VM をデプロイする場合は、高可用性/ディザスター リカバリーのためにステージング サーバーを使用することを検討してください"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
            "link": "https://learn.microsoft.com/en-us/azure/bastion/bastion-overview",
            "severity": "中程度",
            "subcategory": "ハイブリッド",
            "text": "Bastion を使用してネットワークに安全に接続することを検討します。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
            "severity": "中程度",
            "subcategory": "知財プラン",
            "text": "Azure リージョンとオンプレミスの場所で IP アドレス空間が重複しないようにする",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)')  | project id, compliant, cidr",
            "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
            "severity": "中程度",
            "subcategory": "知財プラン",
            "text": "プライベート インターネットのアドレス割り当て (RFC 1918) の IP アドレスを使用してください。",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
            "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
            "severity": "中程度",
            "subcategory": "知財プラン",
            "text": "IP アドレス空間が無駄にならないようにし、不必要に大きな仮想ネットワーク (/16 など) を作成しない",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "e984a859-c773-4e7d-8616-23a765a917e1",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
            "severity": "中程度",
            "subcategory": "知財プラン",
            "text": "VNET のパブリック IP アドレス範囲 (CIDR ブロック) がないことを確認する (特に、組織によって所有されていない場合)",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
            "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
            "severity": "中程度",
            "subcategory": "知財プラン",
            "text": "運用サイトと DR サイトで重複する IP アドレス範囲を使用しないでください。",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
            "severity": "中程度",
            "subcategory": "知財プラン",
            "text": "Azure での名前解決が必要なだけの場合は、解決に Azure プライベート DNS を使用します。名前解決用の委任ゾーン (\"azure.contoso.com\" など) を作成します。",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
            "severity": "中程度",
            "subcategory": "知財プラン",
            "text": "Azure とオンプレミスでの名前解決が必要な環境では、少なくとも 2 つの仮想マシン (VM) にデプロイされた既存の DNS インフラストラクチャ (Active Directory 統合 DNS など) を使用します。これらの DNS サーバーを使用するように仮想ネットワークの DNS 設定を構成します。",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
            "severity": "中程度",
            "subcategory": "知財プラン",
            "text": "独自の DNS を必要とし、デプロイする特別なワークロード (Red Hat OpenShift など) では、好みの DNS ソリューションを使用する必要があります。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "614658d3-558f-4d77-849b-821112df27ee",
            "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
            "severity": "中程度",
            "subcategory": "知財プラン",
            "text": "Azure DNS の自動登録を有効にして、仮想ネットワーク内にデプロイされた仮想マシンの DNS レコードのライフサイクルを自動的に管理します。",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "1e43a58a-9c22-499c-9d7b-57d0c655562f",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
            "severity": "中程度",
            "subcategory": "検査",
            "text": "ネットワーク ウォッチャー パケットを使用して、キャプチャ ウィンドウが限られているにもかかわらずキャプチャします。",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "a65498f6-dfe2-437d-b143-b16c31d7aa9b",
            "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
            "severity": "中程度",
            "subcategory": "検査",
            "text": "ディープ パケット検査を必要とするシナリオには、パートナー ソリューションを使用します。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "中程度",
            "subcategory": "インターネット",
            "text": "Azure Firewall を使用して、インターネットへの Azure 送信トラフィック、HTTP/S 以外の受信接続、および East/West トラフィック フィルター処理 (組織で必要な場合) を管理します。",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "resources | where type == 'microsoft.network/azurefirewalls' | project id,compliant=isnotnull(properties.firewallPolicy.id)",
            "guid": "0f1ce16e-d301-4d6e-a72e-52e3611cc58b",
            "link": "https://learn.microsoft.com/azure/firewall/",
            "severity": "中程度",
            "subcategory": "インターネット",
            "text": "Virtual WAN でファイアウォール マネージャーを使用して、仮想 WAN ハブ全体またはハブ仮想ネットワーク内の Azure ファイアウォールをデプロイおよび管理します。",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
            "link": "https://learn.microsoft.com/azure/firewall/",
            "severity": "中程度",
            "subcategory": "インターネット",
            "text": "グローバル Azure ファイアウォール ポリシーを作成して、グローバル ネットワーク環境全体のセキュリティ体制を管理し、すべての Azure ファイアウォール インスタンスに割り当てます。Azure ロールベースのアクセス制御を介して増分ファイアウォール ポリシーをローカル セキュリティ チームに委任することで、特定のリージョンの要件を満たす詳細なポリシーを許可します。",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
            "link": "https://learn.microsoft.com/azure/firewall/",
            "severity": "中程度",
            "subcategory": "インターネット",
            "text": "組織が送信接続を保護するためにそのようなソリューションを使用する場合は、Firewall Manager 内でサポートされているパートナー SaaS セキュリティ プロバイダーを構成します。",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "d15f512a-6549-48f6-bfe2-37de143b16c3",
            "link": "https://learn.microsoft.com/azure/firewall/",
            "severity": "中程度",
            "subcategory": "インターネット",
            "text": "ランディング ゾーン仮想ネットワーク内で WAF を使用して、インターネットからの受信 HTTP/S トラフィックを保護します。",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
            "severity": "中程度",
            "subcategory": "インターネット",
            "text": "Azure フロント ドアと WAF ポリシーを使用して、ランディング ゾーンへの受信 HTTP/S 接続に対して Azure リージョン間でグローバル保護を提供します。",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "中程度",
            "subcategory": "インターネット",
            "text": "Azure Front Door と Azure Application Gateway を使用して HTTP/S アプリを保護する場合は、Azure Front Door で WAF ポリシーを使用します。Azure アプリケーション ゲートウェイをロックダウンして、Azure Front Door からのトラフィックのみを受信します。",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "中程度",
            "subcategory": "インターネット",
            "text": "受信 HTTP/S 接続にパートナー NVA が必要な場合は、ランディング ゾーン仮想ネットワーク内にデプロイし、保護してインターネットに公開しているアプリと共にデプロイします。",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
            "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
            "severity": "中程度",
            "subcategory": "インターネット",
            "text": "Azure DDoS ネットワークまたは IP 保護プランを使用して、仮想ネットワーク内のパブリック IP アドレス エンドポイントを保護します。",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "e504547c-2447-4ec6-9138-a7200f1ce16e",
            "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
            "severity": "中程度",
            "subcategory": "PaaS",
            "text": "PaaS サービスへのプライベート通信が必要な場合は、使用可能なさまざまなオプションを検討してください。",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-private-access-to-azure-services/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
            "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
            "severity": "中程度",
            "subcategory": "PaaS",
            "text": "仮想ネットワークに挿入された Azure PaaS サービスは、引き続きパブリック IP アドレスを使用して管理プレーン操作を実行します。この通信が壊れていないことを確認してください",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "e43a58a9-c229-49c4-b7b5-7d0c655562f2",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "中程度",
            "subcategory": "PaaS",
            "text": "共有 Azure PaaS サービスには、可能な場合はプライベート リンクを使用します。",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "中程度",
            "subcategory": "PaaS",
            "text": "オンプレミスから ExpressRoute プライベート ピアリング経由で Azure PaaS サービスにアクセスします。このメソッドは、パブリック インターネット経由の通過を回避します。",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "65498f6d-fe23-47de-843b-16c31d7aa9b6",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "中程度",
            "subcategory": "PaaS",
            "text": "Private Link が使用できないときに仮想ネットワーク サービス エンドポイントを使用する",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
            "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "中程度",
            "subcategory": "PaaS",
            "text": "既定では、すべてのサブネットで仮想ネットワーク サービス エンドポイントを有効にしないでください。",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "中程度",
            "subcategory": "PaaS",
            "text": "NVA フィルター処理を使用しない限り、データ流出の懸念がある場合は仮想ネットワーク サービス エンドポイントを使用しないでください。",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "179b599d-e0d5-4973-ad4c-d21b088137f5",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "中程度",
            "subcategory": "PaaS",
            "text": "Azure から Azure リソースへの通信を有効にするために強制トンネリングを実装しないでください。",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
            "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
            "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
            "severity": "中程度",
            "subcategory": "セグメンテーション",
            "text": "接続を制限するために、仮想ネットワーク サービス タグを使用する NSG 受信の既定の規則に依存しないでください。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "c2447ec6-6138-4a72-80f1-ce16ed301d6e",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
            "severity": "中程度",
            "subcategory": "セグメンテーション",
            "text": "サブネットの作成をランディングゾーンの所有者に委任します。",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "中程度",
            "subcategory": "セグメンテーション",
            "text": "NSG を使用して、サブネット間のトラフィックと、プラットフォーム全体の East/West トラフィック (ランディング ゾーン間のトラフィック) を保護します。",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)",
            "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563",
            "severity": "中程度",
            "subcategory": "セグメンテーション",
            "text": "アプリケーション チームは、サブネット レベルの NSG でアプリケーション セキュリティ グループを使用して、ランディング ゾーン内の多層 VM を保護する必要があります。",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "中程度",
            "subcategory": "セグメンテーション",
            "text": "NSG とアプリケーション セキュリティ グループを使用してランディング ゾーン内のトラフィックをマイクロセグメント化し、中央の NVA を使用してトラフィック フローをフィルター処理しないようにします。",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "中程度",
            "subcategory": "セグメンテーション",
            "text": "NSG フロー ログを有効にしてトラフィック分析にフィードし、内部および外部のトラフィック フローに関する分析情報を取得します。",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "a8042d88-e79d-417b-93b2-2a5a67e7a8ed",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "中程度",
            "subcategory": "セグメンテーション",
            "text": "NSG を使用して、ランディング ゾーン間の接続を選択的に許可します。",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "4b30e38c-3f29-4812-a236-3cefe179b599",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "中程度",
            "subcategory": "セグメンテーション",
            "text": "Virtual WAN トポロジの場合、組織がランディング ゾーン間を流れるトラフィックのフィルター処理とログ記録機能を必要とする場合は、Azure Firewall を介してランディング ゾーン間でトラフィックをルーティングします。",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
            "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
            "severity": "中程度",
            "subcategory": "仮想 WAN",
            "text": "Azure ネットワーク管理を簡素化するために Virtual WAN を検討し、Virtual WAN ルーティング設計の一覧にシナリオが明示的に記述されていることを確認します。",
            "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "中程度",
            "subcategory": "仮想 WAN",
            "text": "Azure リージョンごとに仮想 WAN ハブを使用して、共通のグローバル Azure 仮想 WAN を介して Azure リージョン間で複数のランディング ゾーンを接続します。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "4f5664b5-e984-4a85-ac77-3e7d261623a7",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "中程度",
            "subcategory": "仮想 WAN",
            "text": "仮想ハブ ルーティング機能を使用して、VNet とブランチ間のトラフィックをさらにセグメント化します。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "65a917e1-f348-4ef2-94c2-7d42e8bbac75",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "中程度",
            "subcategory": "仮想 WAN",
            "text": "ExpressRoute を使用して仮想 WAN ハブをオンプレミスのデータセンターに接続する",
            "training": "https://learn.microsoft.com/learn/modules/configure-expressroute-virtual-wan/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "71559ab9-153e-4890-aae2-8c84c33b6b78",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "中程度",
            "subcategory": "仮想 WAN",
            "text": "ブランチとリモート ロケーションをサイト間 VPN 経由で最も近い Virtual WAN ハブに接続するか、SD-WAN パートナー ソリューションを介して Virtual WAN へのブランチ接続を有効にします。",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-hybrid-networking/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "08b9fe5c-4104-49d4-83a9-23c3474d0001",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "中程度",
            "subcategory": "仮想 WAN",
            "text": "ポイント対サイト VPN 経由でユーザーを仮想 WAN ハブに接続します。",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-hybrid-networking/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "中程度",
            "subcategory": "仮想 WAN",
            "text": "\"Azure のトラフィックは Azure にとどまる\" という原則に従って、Azure のリソース間の通信が Microsoft のバックボーン ネットワーク経由で行われるようにします。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "中程度",
            "subcategory": "仮想 WAN",
            "text": "送信インターネット トラフィックの保護とフィルター処理のために、Azure Firewall をデプロイする",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "12df27ee-412e-47f9-a3f6-304722dd69c5",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "中程度",
            "subcategory": "仮想 WAN",
            "text": "VWAN にパートナー ネットワーク テクノロジと NVA をデプロイする場合は、パートナー ベンダーのガイダンスを使用して構成を確認し、構成が競合していないことを確認します。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "b5c2622f-54b6-49ba-b33a-ad5e8c68e1d7",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "中程度",
            "subcategory": "仮想 WAN",
            "text": "Azure 仮想 WAN リソースと Azure ファイアウォール リソースが接続サブスクリプションに作成されていることを確認します。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
            "severity": "中程度",
            "subcategory": "仮想 WAN",
            "text": "ネットワーク アーキテクチャが Azure 仮想 WAN の制限内にあることを確認します。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
            "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
            "severity": "中程度",
            "subcategory": "仮想 WAN",
            "text": "仮想 WAN の Azure Monitor インサイトを使用して、仮想 WAN のエンド ツー エンドのトポロジ、状態、および主要なメトリックを監視します。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "2df4930f-6a43-49a3-926b-309f02c302f0",
            "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/identity/adds-extend-domain#vm-recommendations",
            "severity": "高い",
            "subcategory": "ハイブリッド",
            "text": "AD DS を実行している VM をドメイン コントローラーとして少なくとも 2 つデプロイする場合は、それらを異なる可用性ゾーンに追加します。リージョンで使用できない場合は、可用性セットにデプロイします。"
        },
        {
            "category": "オペレーションズ",
            "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
            "severity": "高い",
            "subcategory": "フロントドア",
            "text": "Azure Front Door でマネージド TLS 証明書を使用します。運用コストと証明書の更新による停止のリスクを軽減します。"
        },
        {
            "category": "オペレーションズ",
            "guid": "f00a69de-7076-4734-a734-6e4552cad9e1",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
            "severity": "中程度",
            "subcategory": "フロントドア",
            "text": "Azure Front Door でカスタマー マネージド TLS 証明書を使用する場合は、\"最新\" の証明書バージョンを使用します。証明書の手動更新による停止のリスクを軽減します。"
        },
        {
            "category": "オペレーションズ",
            "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code",
            "severity": "中程度",
            "subcategory": "フロントドア",
            "text": "Azure Front Door WAF 構成をコードとして定義します。コードを使用すると、新しいルール・セット・バージョンをより簡単に採用し、保護を強化することができます。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls",
            "severity": "高い",
            "subcategory": "フロントドア",
            "text": "Azure Front Door でエンド ツー エンドの TLS を使用します。クライアントからフロント ドアへの接続、およびフロント ドアから配信元への接続には TLS を使用します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection",
            "severity": "中程度",
            "subcategory": "フロントドア",
            "text": "Azure Front Door で HTTP から HTTPS へのリダイレクトを使用します。古いクライアントを HTTPS 要求に自動的にリダイレクトすることで、クライアントをサポートします。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf",
            "severity": "高い",
            "subcategory": "フロントドア",
            "text": "Azure Front Door WAF を有効にします。さまざまな攻撃からアプリケーションを保護します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf",
            "severity": "高い",
            "subcategory": "フロントドア",
            "text": "ワークロードに合わせて Azure Front Door WAF を調整します。誤検出を減らします。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-prevention-mode",
            "severity": "高い",
            "subcategory": "フロントドア",
            "text": "Azure Front Door WAF で防止モードを使用します。防止モードでは、WAF が悪意のある要求を確実にブロックします。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets",
            "severity": "高い",
            "subcategory": "フロントドア",
            "text": "Azure Front Door WAF の既定の規則セットを有効にします。既定のルール セットは、一般的な攻撃を検出してブロックします。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "147a13d4-2a2f-4824-a524-f5855b52b946",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules",
            "severity": "高い",
            "subcategory": "フロントドア",
            "text": "Azure Front Door WAF ボット管理規則を有効にします。ボットルールは、良いボットと悪いボットを検出します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions",
            "severity": "中程度",
            "subcategory": "フロントドア",
            "text": "最新の Azure Front Door WAF ルールセット バージョンを使用します。ルールセットの更新は、現在の脅威の状況を考慮して定期的に更新されます。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "b9620385-1cde-418f-914b-a84a06982ffc",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting",
            "severity": "中程度",
            "subcategory": "フロントドア",
            "text": "Azure Front Door WAF にレート制限を追加します。レート制限は、クライアントが誤ってまたは意図的に大量のトラフィックを短期間に送信するのをブロックします。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits",
            "severity": "中程度",
            "subcategory": "フロントドア",
            "text": "Azure Front Door WAF のレート制限には高いしきい値を使用します。レート制限のしきい値を高くすると、正当なトラフィックのブロックを回避しながら、インフラストラクチャを圧倒する可能性のある非常に多数の要求に対する保護が提供されます。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic",
            "severity": "低い",
            "subcategory": "フロントドア",
            "text": "Azure Front Door WAF を使用してトラフィックを地理的にフィルター処理します。予想されるリージョンからのトラフィックのみを許可し、他のリージョンからのトラフィックをブロックします。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "00acd8a9-6975-414f-8491-2be6309893b8",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location",
            "severity": "中程度",
            "subcategory": "フロントドア",
            "text": "Azure フロント ドア WAF を使用してトラフィックを地理的フィルター処理するときに、不明な (ZZ) の場所を指定します。IP アドレスを地理的に一致させない場合に、正当な要求を誤ってブロックしないようにします。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "高い",
            "subcategory": "統治",
            "text": "Azure Policy の活用"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "e979377b-cdb3-4751-ab2a-b13ada6e55d7",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/naming-and-tagging",
            "severity": "中程度",
            "subcategory": "統治",
            "text": "必要な Azure タグを特定し、追加ポリシー モードを使用して使用を強制します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "中程度",
            "subcategory": "統治",
            "text": "規制とコンプライアンスの要件を Azure ポリシー定義と Azure ロールの割り当てにマップします。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "中程度",
            "subcategory": "統治",
            "text": "最上位のルート管理グループで Azure Policy 定義を確立して、継承されたスコープで割り当てられるようにする"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "中程度",
            "subcategory": "統治",
            "text": "必要に応じて、最下位レベルで除外を使用して、適切な最上位レベルでポリシー割り当てを管理します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "43334f24-9116-4341-a2ba-527526944008",
            "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
            "severity": "低い",
            "subcategory": "統治",
            "text": "Azure Policy を使用して、ユーザーがサブスクリプション/管理グループ レベルでプロビジョニングできるサービスを制御する"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "中程度",
            "subcategory": "統治",
            "text": "可能な場合は組み込みのポリシーを使用して、運用オーバーヘッドを最小限に抑えます。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "中程度",
            "subcategory": "統治",
            "text": "組み込みのポリシー共同作成者ロールを特定のスコープに割り当てて、アプリケーション レベルのガバナンスを有効にします。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "19048384-5c98-46cb-8913-156a12476e49",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "中程度",
            "subcategory": "統治",
            "text": "ルート管理グループのスコープで行われる Azure Policy の割り当ての数を制限して、継承されたスコープでの除外による管理を回避します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
            "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
            "severity": "中程度",
            "subcategory": "統治",
            "text": "Azure ポリシーを使用して、VM 拡張機能を介してソフトウェア構成を自動的にデプロイし、準拠したベースライン VM 構成を適用します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "9b5e2a28-9823-4faf-ab7e-afa5f6c57221",
            "link": "Configure Azure Automation Start/Stop VMs during off-hours | Microsoft Learn",
            "severity": "中程度",
            "subcategory": "統治",
            "text": "コストを節約するために、自動化タグを使用して環境内の VM を起動/停止することを検討してください。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
            "severity": "中程度",
            "subcategory": "統治",
            "text": "Azure ポリシーを使用して VM のセキュリティ構成のドリフトを監視します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "5017f154-e3ab-4369-9829-e7e316183687",
            "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
            "severity": "高い",
            "subcategory": "秘密",
            "text": "Azure Key Vault を使用してシークレットと資格情報を格納する"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
            "guid": "a0477a20-9945-4bda-9333-4f2491163418",
            "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
            "severity": "中程度",
            "subcategory": "秘密",
            "text": "アプリケーションやリージョンごとに異なる Azure Key Vault を使用して、トランザクション スケールの制限を回避し、シークレットへのアクセスを制限します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "中程度",
            "subcategory": "秘密",
            "text": "論理的な削除ポリシーと消去ポリシーを有効にして Azure Key Vault をプロビジョニングし、削除されたオブジェクトの保持保護を有効にします。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "中程度",
            "subcategory": "秘密",
            "text": "キー、シークレット、証明書を完全に削除する承認を特殊なカスタム Azure Active Directory (Azure AD) ロールに制限することで、最小特権モデルに従います。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "中程度",
            "subcategory": "秘密",
            "text": "パブリック認証局を使用して証明書の管理と更新プロセスを自動化し、管理を容易にします。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "913156a1-2476-4e49-b541-acdce979377b",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "中程度",
            "subcategory": "秘密",
            "text": "キーと証明書のローテーションの自動化されたプロセスを確立します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "中程度",
            "subcategory": "秘密",
            "text": "コンテナーでファイアウォールと仮想ネットワーク サービス エンドポイントまたはプライベート エンドポイントを有効にして、キー コンテナーへのアクセスを制御します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
            "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
            "severity": "中程度",
            "subcategory": "秘密",
            "text": "プラットフォーム中央の Azure Monitor Log Analytics ワークスペースを使用して、Key Vault の各インスタンス内のキー、証明書、シークレットの使用状況を監査します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "中程度",
            "subcategory": "秘密",
            "text": "Key Vault のインスタンス化と特権アクセスを委任し、Azure Policy を使用して一貫した準拠構成を適用します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "16183687-a047-47a2-8994-5bda43334f24",
            "link": "https://learn.microsoft.com/azure/security/fundamentals/encryption-atrest",
            "severity": "中程度",
            "subcategory": "秘密",
            "text": "プリンシパル暗号化機能には既定で Microsoft マネージド キーを使用し、必要に応じてカスタマー マネージド キーを使用します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "中程度",
            "subcategory": "秘密",
            "text": "リージョンごとの環境ごとにアプリケーションごとに Azure Key Vault を使用します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "中程度",
            "subcategory": "秘密",
            "text": "独自のキーを持ち込む場合、これは考慮されるすべてのサービスでサポートされているとは限りません。不整合によって望ましい結果が妨げられないように、関連する軽減策を実装します。待機時間を最小限に抑える適切なリージョン ペアとディザスター リカバリー リージョンを選択します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
            "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
            "severity": "中程度",
            "subcategory": "安全",
            "text": "Azure AD のレポート機能を使用して、アクセス制御監査レポートを生成します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "4e3ab369-3829-4e7e-9161-83687a0477a2",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-data-export?tabs=portal",
            "severity": "中程度",
            "subcategory": "安全",
            "text": "Azure アクティビティ ログを Azure Monitor ログにエクスポートして、長期的なデータ保持を行います。必要に応じて、2 年を超える長期ストレージ用に Azure Storage にエクスポートします。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "09945bda-4333-44f2-9911-634182ba5275",
            "link": "https://learn.microsoft.com/azure/security-center/",
            "severity": "中程度",
            "subcategory": "安全",
            "text": "すべてのサブスクリプションに対して Defender for Cloud Standard を有効にします。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
            "link": "https://learn.microsoft.com/azure/security-center/",
            "severity": "中程度",
            "subcategory": "安全",
            "text": "Azure Monitor ログと Defender for Cloud を使用して、基本オペレーティング システムの修正プログラム適用ドリフトを監視します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "中程度",
            "subcategory": "安全",
            "text": "既定のリソース構成を一元化された Azure Monitor ログ分析ワークスペースに接続します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "b86ad884-08e3-4727-94b8-75ba18f20459",
            "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response",
            "severity": "中程度",
            "subcategory": "安全",
            "text": "運用環境へのアクセスを許可する前に、Azure サービスのインシデント対応計画を決定します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "01365d38-e43f-49cc-ad86-8266abca264f",
            "link": "https://www.microsoft.com/security/business/zero-trust",
            "severity": "中程度",
            "subcategory": "安全",
            "text": "必要に応じて、Azure プラットフォームにアクセスするためのゼロトラスト アプローチを実装します。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "9a19bf39-c95d-444c-9c89-19ca1f6d5215",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework",
            "severity": "中程度",
            "subcategory": "安全",
            "text": "新しい Azure サービスの実装方法を計画する"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "ae514b93-3d45-485e-8112-9bd7ba012f7b",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework",
            "severity": "中程度",
            "subcategory": "安全",
            "text": "Azure サービスのサービス要求を満たす方法を計画する"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "cacf55bc-e4e4-46be-96bc-57a5f23a269a",
            "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/resource-naming",
            "severity": "高い",
            "subcategory": "統治",
            "text": "マイクロソフトのベスト プラクティスの名前付け標準に従うことをお勧めします。"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
            "link": "https://learn.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer",
            "severity": "高い",
            "subcategory": "安全",
            "text": "ストレージ アカウントへの安全な転送を有効にする必要があります"
        },
        {
            "category": "セキュリティ、ガバナンス、コンプライアンス",
            "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
            "link": "https://learn.microsoft.com/en-us/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
            "severity": "高い",
            "subcategory": "安全",
            "text": "ストレージ アカウントのコンテナーの論理的な削除を有効にして、削除されたコンテナーとその内容を回復します。"
        }
    ],
    "metadata": {
        "name": "Azure Landing Zone Review",
        "state": "GA",
        "timestamp": "March 16, 2023"
    },
    "severities": [
        {
            "name": "高い"
        },
        {
            "name": "中程度"
        },
        {
            "name": "低い"
        }
    ],
    "status": [
        {
            "description": "このチェックはまだ確認されていません",
            "name": "未確認"
        },
        {
            "description": "このチェックに関連付けられているアクションアイテムがあります",
            "name": "開ける"
        },
        {
            "description": "このチェックは検証済みであり、それ以上のアクションアイテムは関連付けられていません",
            "name": "達成"
        },
        {
            "description": "推奨事項は理解されていますが、現在の要件では必要ありません",
            "name": "必須ではありません"
        },
        {
            "description": "現在のデザインには適用できません",
            "name": "該当なし"
        }
    ]
}
checklists/lz_checklist.es.json METASEP
{
    "categories": [
        {
            "name": "Identidad y acceso"
        },
        {
            "name": "Topología y conectividad de red"
        },
        {
            "name": "Seguridad, gobernanza y cumplimiento"
        },
        {
            "name": "Gestión y Monitoreo"
        },
        {
            "name": "Grupo de administración y suscripciones"
        },
        {
            "name": "Operaciones"
        },
        {
            "name": "Copia de seguridad y recuperación ante desastres"
        }
    ],
    "items": [
        {
            "category": "Copia de seguridad y recuperación ante desastres",
            "guid": "7ea02e1c-7166-45a3-bdf5-098891367fcb",
            "link": "https://learn.microsoft.com/en-us/azure/reliability/cross-region-replication-azure",
            "severity": "Medio",
            "subcategory": "Protección de datos",
            "text": "Considere la replicación entre regiones en Azure para BCDR con regiones emparejadas"
        },
        {
            "category": "Copia de seguridad y recuperación ante desastres",
            "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
            "link": "https://learn.microsoft.com/en-us/azure/storage/common/storage-redundancy",
            "severity": "Medio",
            "subcategory": "Protección de datos",
            "text": "Al usar Azure Backup, tenga en cuenta los diferentes tipos de copia de seguridad (GRS, ZRS Y LRS) ya que la configuración predeterminada es GRS"
        },
        {
            "category": "Identidad y acceso",
            "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
            "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access",
            "severity": "Alto",
            "subcategory": "Identidad",
            "text": "Implementar para el acceso de emergencia o cuentas de vidrio roto para evitar el bloqueo de cuentas en todo el inquilino",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "Identidad y acceso",
            "guid": "348ef254-c27d-442e-abba-c7571559ab91",
            "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
            "severity": "Alto",
            "subcategory": "Identidad",
            "text": "Aplicar un modelo RBAC para grupos de administración, suscripciones, grupos de recursos y recursos",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "Identidad y acceso",
            "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
            "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview",
            "severity": "Bajo",
            "subcategory": "Identidad",
            "text": "Aplicar directivas de acceso condicional de Azure AD para cualquier usuario con derechos en entornos de Azure",
            "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/"
        },
        {
            "category": "Identidad y acceso",
            "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
            "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks",
            "severity": "Alto",
            "subcategory": "Identidad",
            "text": "Aplicar la autenticación multifactor para cualquier usuario con derechos en los entornos de Azure",
            "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/"
        },
        {
            "category": "Identidad y acceso",
            "guid": "e6a83de5-de32-4c19-a248-1607d5d1e4e6",
            "link": "https://learn.microsoft.com/azure/role-based-access-control/overview",
            "severity": "Medio",
            "subcategory": "Identidad",
            "text": "Aplique responsabilidades centralizadas y delegadas para administrar los recursos implementados dentro de la zona de aterrizaje, en función de los requisitos de rol y seguridad",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/"
        },
        {
            "category": "Identidad y acceso",
            "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
            "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure",
            "severity": "Medio",
            "subcategory": "Identidad",
            "text": "Aplicar Azure AD Privileged Identity Management (PIM) para establecer un acceso sin pie y privilegios mínimos",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "Identidad y acceso",
            "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
            "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts",
            "severity": "Alto",
            "subcategory": "Identidad",
            "text": "Utilice únicamente el tipo de autenticación Cuenta profesional o educativa para todos los tipos de cuenta. Evite usar la cuenta Microsoft",
            "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/"
        },
        {
            "category": "Identidad y acceso",
            "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
            "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal",
            "severity": "Medio",
            "subcategory": "Identidad",
            "text": "Utilice solo grupos para asignar permisos. Agregue grupos locales al grupo solo de Azure AD si ya hay un sistema de administración de grupos implementado.",
            "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/"
        },
        {
            "category": "Identidad y acceso",
            "guid": "f5664b5e-984a-4859-a773-e7d261623a76",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations",
            "severity": "Medio",
            "subcategory": "Identidad",
            "text": "Considere la posibilidad de usar roles personalizados de Azure para los siguientes roles clave: propietario de la plataforma Azure, administración de red, operaciones de seguridad, propietario de la suscripción, propietario de la aplicación",
            "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/"
        },
        {
            "category": "Identidad y acceso",
            "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
            "link": "https://azure.microsoft.com/resources/achieving-compliant-data-residency-and-security-with-azure/",
            "severity": "Medio",
            "subcategory": "Identidad",
            "text": "Si existen requisitos de soberanía de datos, se pueden implementar directivas de Azure para aplicarlos",
            "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/"
        },
        {
            "category": "Identidad y acceso",
            "guid": "1559ab91-53e8-4908-ae28-c84c33b6b780",
            "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
            "severity": "Medio",
            "subcategory": "Identidad",
            "text": "Si Azure Active Directory Domains Services (AADDS) está en uso, implemente AADDS dentro de la región principal, ya que este servicio solo se puede proyectar en una suscripción.",
            "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/"
        },
        {
            "category": "Identidad y acceso",
            "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
            "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview",
            "severity": "Medio",
            "subcategory": "Identidad",
            "text": "Si AADDS está en uso, evalúe la compatibilidad de todas las cargas de trabajo",
            "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/"
        },
        {
            "category": "Identidad y acceso",
            "guid": "ac6a9e01-e6a8-43de-9de3-2c1992481607",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
            "severity": "Medio",
            "subcategory": "Identidad",
            "text": "Si AD en Windows Server está en uso, ¿pueden todos los recursos necesarios acceder al controlador de dominio correcto?",
            "training": "https://learn.microsoft.com/learn/paths/implement-windows-server-iaas-virtual-machine-identity/"
        },
        {
            "category": "Identidad y acceso",
            "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
            "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy",
            "severity": "Medio",
            "subcategory": "Identidad",
            "text": "Considere la posibilidad de usar Azure AD Application Proxy como reemplazo de VPN o proxy inverso para proporcionar a los usuarios remotos acceso seguro y autenticado a las aplicaciones internas (hospedadas en la nube o localmente).",
            "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/"
        },
        {
            "category": "Identidad y acceso",
            "guid": "35037e68-9349-4c15-b371-228514f4cdff",
            "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices",
            "severity": "Medio",
            "subcategory": "Identidad",
            "text": "Evite usar cuentas sincronizadas locales para las asignaciones de roles de Azure AD.",
            "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/"
        },
        {
            "category": "Grupo de administración y suscripciones",
            "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
            "guid": "2df27ee4-12e7-4f98-9f63-04722dd69c5b",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups",
            "severity": "Medio",
            "subcategory": "Suscripciones",
            "text": "Aplique una jerarquía de grupos de administración razonablemente plana con no más de tres o cuatro niveles, idealmente",
            "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/"
        },
        {
            "category": "Grupo de administración y suscripciones",
            "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
            "guid": "5c2622f5-4b69-4bad-93aa-d5e8c68e1d76",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/resource-tagging/?toc=/azure/azure-resource-manager/management/toc.json",
            "severity": "Medio",
            "subcategory": "Suscripciones",
            "text": "Aplicación o anexión de etiquetas de recursos a través de Azure Policy",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "Grupo de administración y suscripciones",
            "guid": "667313b4-f566-44b5-b984-a859c773e7d2",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
            "severity": "Medio",
            "subcategory": "Suscripciones",
            "text": "Aplicación de un grupo de administración de espacio aislado para permitir a los usuarios experimentar inmediatamente con Azure",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/"
        },
        {
            "category": "Grupo de administración y suscripciones",
            "guid": "61623a76-5a91-47e1-b348-ef254c27d42e",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
            "severity": "Medio",
            "subcategory": "Suscripciones",
            "text": "Aplicación de un grupo de administración de plataforma en el grupo de administración raíz para admitir la directiva de plataforma común y la asignación de roles de Azure",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/"
        },
        {
            "category": "Grupo de administración y suscripciones",
            "guid": "8bbac757-1559-4ab9-853e-8908ae28c84c",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations",
            "severity": "Medio",
            "subcategory": "Suscripciones",
            "text": "Aplique una suscripción de conectividad dedicada en el grupo de administración de plataforma para hospedar un concentrador WAN virtual de Azure, un sistema de nombres de dominio (DNS) privado, un circuito ExpressRoute y otros recursos de red.",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/"
        },
        {
            "category": "Grupo de administración y suscripciones",
            "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant = (array_length(mgmtChain) > 1)",
            "guid": "33b6b780-8b9f-4e5c-9104-9d403a923c34",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---default-management-group",
            "severity": "Medio",
            "subcategory": "Suscripciones",
            "text": "Exigir que no se coloquen suscripciones en el grupo de administración raíz"
        },
        {
            "category": "Grupo de administración y suscripciones",
            "guid": "74d00018-ac6a-49e0-8e6a-83de5de32c19",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization",
            "severity": "Medio",
            "subcategory": "Suscripciones",
            "text": "Exigir que solo los usuarios con privilegios puedan operar grupos de administración en el inquilino habilitando la autorización RBAC de Azure en la configuración de la jerarquía de grupos de administración"
        },
        {
            "category": "Grupo de administración y suscripciones",
            "guid": "92481607-d5d1-4e4e-9146-58d3558fd772",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/overview",
            "severity": "Medio",
            "subcategory": "Suscripciones",
            "text": "Aplique grupos de administración bajo el grupo de administración de nivel raíz para representar los tipos de cargas de trabajo, en función de sus necesidades de seguridad, cumplimiento, conectividad y características."
        },
        {
            "category": "Grupo de administración y suscripciones",
            "guid": "49b82111-2df2-47ee-912e-7f983f630472",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/overview",
            "severity": "Alto",
            "subcategory": "Suscripciones",
            "text": "Aplique un proceso para que los propietarios de recursos conozcan sus roles y responsabilidades, acceda a la revisión, la revisión del presupuesto, el cumplimiento de las políticas y corrija cuando sea necesario."
        },
        {
            "category": "Grupo de administración y suscripciones",
            "guid": "2dd69c5b-5c26-422f-94b6-9bad33aad5e8",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
            "severity": "Medio",
            "subcategory": "Suscripciones",
            "text": "Asegúrese de que todos los propietarios de suscripciones y el equipo central de TI conozcan las limitaciones de recursos de suscripción como parte de las sesiones de diseño de cargas de trabajo."
        },
        {
            "category": "Grupo de administración y suscripciones",
            "guid": "c68e1d76-6673-413b-9f56-64b5e984a859",
            "link": "https://learn.microsoft.com/azure/cost-management-billing/reservations/save-compute-costs-reservations",
            "severity": "Alto",
            "subcategory": "Suscripciones",
            "text": "Utilice instancias reservadas cuando corresponda para optimizar los costos y garantizar la capacidad disponible en las regiones de destino. Explique el uso de SKU de máquina virtual de instancia reservada adquiridas a través de Azure Policy.",
            "training": "https://learn.microsoft.com/learn/paths/improve-reliability-modern-operations/"
        },
        {
            "category": "Grupo de administración y suscripciones",
            "guid": "c773e7d2-6162-43a7-95a9-17e1f348ef25",
            "link": "https://learn.microsoft.com/azure/architecture/framework/scalability/design-capacity",
            "severity": "Alto",
            "subcategory": "Suscripciones",
            "text": "Aplicar un panel, un libro de trabajo o un proceso manual para supervisar los niveles de capacidad utilizados",
            "training": "https://learn.microsoft.com/learn/paths/monitor-usage-performance-availability-resources-azure-monitor/"
        },
        {
            "category": "Grupo de administración y suscripciones",
            "guid": "4c27d42e-8bba-4c75-9155-9ab9153e8908",
            "link": "https://azure.microsoft.com/global-infrastructure/services/",
            "severity": "Medio",
            "subcategory": "Suscripciones",
            "text": "Asegúrese de que los servicios y características necesarios estén disponibles dentro de las regiones de implementación elegidas",
            "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/"
        },
        {
            "category": "Grupo de administración y suscripciones",
            "guid": "ae28c84c-33b6-4b78-88b9-fe5c41049d40",
            "link": "https://learn.microsoft.com/azure/cost-management-billing/cost-management-billing-overview",
            "severity": "Alto",
            "subcategory": "Suscripciones",
            "text": "Aplicar un proceso para la gestión de costos",
            "training": "https://learn.microsoft.com/learn/paths/control-spending-manage-bills/"
        },
        {
            "category": "Grupo de administración y suscripciones",
            "guid": "3a923c34-74d0-4001-aac6-a9e01e6a83de",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/overview",
            "severity": "Medio",
            "subcategory": "Suscripciones",
            "text": "Si AD es Windows Server, establezca una suscripción de identidad dedicada en el grupo de administración de plataforma para hospedar controladores de dominio de Windows Server Active Directory",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/"
        },
        {
            "category": "Grupo de administración y suscripciones",
            "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
            "guid": "5de32c19-9248-4160-9d5d-1e4e614658d3",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/track-costs",
            "severity": "Medio",
            "subcategory": "Suscripciones",
            "text": "Asegúrese de que las etiquetas se utilizan para la facturación y la gestión de costos",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs",
            "severity": "Alto",
            "subcategory": "Puerta",
            "text": "Agregue la configuración de diagnóstico para guardar los registros de WAF de Azure Front Door. Revise regularmente los registros para comprobar si hay ataques y detecciones de falsos positivos."
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel",
            "severity": "Medio",
            "subcategory": "Puerta",
            "text": "Envíe los registros de Azure Front Door a Microsoft Sentinel. Detecte ataques e integre la telemetría de puerta principal en su entorno general de Azure."
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Use un único área de trabajo de registros de monitor para administrar plataformas de forma centralizada, excepto donde el control de acceso basado en rol de Azure (RBAC de Azure), los requisitos de soberanía de datos o las directivas de retención de datos exijan áreas de trabajo independientes.",
            "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "e179b599-de0d-4597-9cd4-cd21b088137f",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "¿Está documentada la zona de aterrizaje?"
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Exporte registros a Azure Storage si los requisitos de retención de registros superan los dos años. Utilice el almacenamiento inmutable con una política de escritura única y lectura múltiple para que los datos no se puedan borrar ni modificar durante un intervalo especificado por el usuario.",
            "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/"
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "00f1ce16-ed30-41d6-b872-e52e3611cc58",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Use Azure Policy para el control de acceso y los informes de cumplimiento. Azure Policy proporciona la capacidad de aplicar la configuración de toda la organización para garantizar el cumplimiento coherente de las directivas y la detección rápida de infracciones. ",
            "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/"
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
            "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Supervise la desviación de la configuración de la máquina virtual (VM) invitada mediante Azure Policy. Habilitar las capacidades de auditoría de configuración de invitados a través de políticas ayuda a las cargas de trabajo del equipo de aplicaciones a consumir inmediatamente las capacidades de las características con poco esfuerzo.",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
            "link": "https://learn.microsoft.com/azure/automation/update-management/overview",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Use Update Management en Azure Automation como mecanismo de revisión a largo plazo para máquinas virtuales Windows y Linux. ",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/"
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "90483845-c986-4cb2-a131-56a12476e49f",
            "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Usar Network Watcher para supervisar de forma proactiva los flujos de tráfico",
            "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/"
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "541acdce-9793-477b-adb3-751ab2ab13ad",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Utilice bloqueos de recursos para evitar la eliminación accidental de servicios compartidos críticos.",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "a6e55d7d-8a2a-4db1-87d6-326af625ca44",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "Bajo",
            "subcategory": "Monitorización",
            "text": "Use directivas de denegación para complementar las asignaciones de roles de Azure. La combinación de directivas de denegación y asignaciones de roles de Azure garantiza que existan las barreras de protección adecuadas para exigir quién puede implementar y configurar recursos y qué recursos pueden implementar y configurar."
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "e5695f22-23ac-4e8c-a123-08ca5017f154",
            "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Incluya eventos de estado de servicio y recursos como parte de la solución general de supervisión de la plataforma. El seguimiento del estado del servicio y de los recursos desde la perspectiva de la plataforma es un componente importante de la administración de recursos en Azure."
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "d5f345bf-97ab-41a7-819c-6104baa7d48c",
            "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Incluir alertas y grupos de acción como parte de la plataforma Azure Service Health para garantizar que se puedan realizar acciones en las alertas o los problemas."
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "e3ab3693-829e-47e3-8618-3687a0477a20",
            "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "No envíe entradas de registro sin procesar a los sistemas de supervisión locales. En su lugar, adopte el principio de que los datos nacidos en Azure permanezcan en Azure. Si se requiere la integración de SIEM local, envíe alertas críticas en lugar de registros."
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "9945bda4-3334-4f24-a116-34182ba52752",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Use un área de trabajo centralizada de Azure Monitor Log Analytics para recopilar registros y métricas de los recursos de aplicaciones de IaaS y PaaS y controlar el acceso al registro con RBAC de Azure."
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Use los registros de Azure Monitor para obtener información e informes."
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "619e8a13-f988-4795-85d6-26886d70ba6c",
            "link": "https://learn.microsoft.com/azure/azure-monitor/agents/diagnostics-extension-overview",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Cuando sea necesario, use cuentas de almacenamiento compartido dentro de la zona de aterrizaje para el almacenamiento del registro de extensión de diagnóstico de Azure."
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
            "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Use alertas de Azure Monitor para la generación de alertas operativas."
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
            "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Use Azure Site Recovery para escenarios de recuperación ante desastres de Azure a Azure Virtual Machines. Esto le permite replicar cargas de trabajo entre regiones."
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "b2ab13ad-a6e5-45d7-b8a2-adb117d6326a",
            "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Asegúrese de usar y probar las capacidades nativas de recuperación ante desastres del servicio PaaS."
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
            "link": "https://learn.microsoft.com/azure/backup/backup-center-overview",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Use funcionalidades de copia de seguridad nativas de Azure. Compruebe que el asociado/cliente conoce Azure Backup y todas las nuevas funcionalidades, lo que puede simplificar enormemente la administración de copias de seguridad"
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "859c3900-4514-41eb-b010-475d695abd74",
            "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Asegúrese de que se han evaluado los requisitos de supervisión y que se aplican las configuraciones adecuadas de recopilación de datos y alertas."
        },
        {
            "category": "Gestión y Monitoreo",
            "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
            "link": "https://learn.microsoft.com/en-us/azure/automation/how-to/region-mappings",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Considerar las regiones admitidas para el área de trabajo de Log Analytics vinculada y las cuentas de automatización"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "6138a720-0f1c-4e16-bd30-1d6e872e52e3",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator",
            "severity": "Medio",
            "subcategory": "Entrega de aplicaciones",
            "text": "Realice la entrega de aplicaciones dentro de las zonas de aterrizaje para aplicaciones internas (corporativas) y externas (en línea).",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = (properties.webApplicationFirewallConfiguration.enabled == True and properties.webApplicationFirewallConfiguration.firewallMode == 'Prevention')",
            "guid": "611cc58b-5a4b-4151-8e43-a58a9c2299c4",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-faq",
            "severity": "Medio",
            "subcategory": "Entrega de aplicaciones",
            "text": "Para la entrega segura de aplicaciones HTTP/S, asegúrese de que la protección y las directivas de WAF estén habilitadas en las puertas de enlace de aplicaciones",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
            "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
            "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2",
            "severity": "Medio",
            "subcategory": "Entrega de aplicaciones",
            "text": "Asegúrese de que está utilizando SKU de Application Gateway v2",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "d7b57d0c-6555-462f-8b3e-4563a4d87397",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/organize-resources?tabs=AzureManagementGroupsAndHierarchy",
            "severity": "Medio",
            "subcategory": "Entrega de aplicaciones",
            "text": "Use un NVA asociado si no puede usar Application Gateway v2 para la seguridad de las aplicaciones HTTP/S.",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "Medio",
            "subcategory": "Entrega de aplicaciones",
            "text": "Implemente Azure Application Gateway v2 o NVA de asociados usados para conexiones HTTP/S entrantes dentro de la red virtual de la zona de aterrizaje y con las aplicaciones que están protegiendo.",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "Medio",
            "subcategory": "Entrega de aplicaciones",
            "text": "Utilice una red DDoS o planes de protección IP para todas las direcciones IP públicas en las zonas de aterrizaje de la aplicación.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "Medio",
            "subcategory": "Entrega de aplicaciones",
            "text": "Use Azure Front Door con directivas WAF para entregar y ayudar a proteger aplicaciones HTTP/S globales que abarcan regiones de Azure.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
            "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
            "severity": "Medio",
            "subcategory": "Entrega de aplicaciones",
            "text": "Cuando use Front Door y Application Gateway para ayudar a proteger las aplicaciones HTTP/S, use directivas WAF en Front Door. Bloquee Application Gateway para recibir tráfico solo desde Front Door.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "Medio",
            "subcategory": "Entrega de aplicaciones",
            "text": "Use el Administrador de tráfico para entregar aplicaciones globales que abarquen protocolos distintos de HTTP/S.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
            "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
            "severity": "Bajo",
            "subcategory": "Entrega de aplicaciones",
            "text": "Si los usuarios solo necesitan acceso a aplicaciones internas, ¿se ha considerado Azure AD Application Proxy como una alternativa a Azure Virtual Desktop (AVD)?",
            "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
            "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works",
            "severity": "Medio",
            "subcategory": "Entrega de aplicaciones",
            "text": "Para reducir el número de puertos de firewall abiertos para las conexiones entrantes en la red, considere la posibilidad de usar el proxy de aplicación de Azure AD para proporcionar a los usuarios remotos acceso seguro y autenticado a las aplicaciones internas.",
            "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "Medio",
            "subcategory": "Encriptación",
            "text": "Cuando use ExpressRoute Direct, configure MACsec para cifrar el tráfico en el nivel de capa dos entre los enrutadores de la organización y MSEE. El diagrama muestra este cifrado en flujo."
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about",
            "severity": "Medio",
            "subcategory": "Encriptación",
            "text": "Para escenarios en los que MACsec no es una opción (por ejemplo, no usar ExpressRoute Direct), use una puerta de enlace VPN para establecer túneles IPsec sobre el emparejamiento privado de ExpressRoute. ",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode",
            "guid": "ae248989-b306-4591-9186-de482e3f0f0e",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
            "severity": "Medio",
            "subcategory": "Puerta",
            "text": "Implemente sus perfiles WAF para Front Door en modo 'Prevención'."
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "062d5839-4d36-402f-bfa4-02811eb936e9",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door",
            "severity": "Alto",
            "subcategory": "Puerta",
            "text": "Evite combinar Azure Traffic Manager y Azure Front Door."
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin",
            "severity": "Medio",
            "subcategory": "Puerta",
            "text": "Use el mismo nombre de dominio en Azure Front Door y su origen. Los nombres de host no coincidentes pueden causar errores sutiles."
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group",
            "severity": "Bajo",
            "subcategory": "Puerta",
            "text": "Deshabilite los sondeos de mantenimiento cuando solo hay un origen en un grupo de origen de Azure Front Door."
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints",
            "severity": "Medio",
            "subcategory": "Puerta",
            "text": "Seleccione puntos de conexión de sondeo de buen estado para Azure Front Door. Considere la posibilidad de crear extremos de mantenimiento que comprueben todas las dependencias de la aplicación."
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes",
            "severity": "Bajo",
            "subcategory": "Puerta",
            "text": "Use sondeos de estado HEAD con Azure Front Door para reducir el tráfico que Front Door envía a la aplicación."
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity",
            "severity": "Medio",
            "subcategory": "Hub and spoke",
            "text": "Considere un diseño de red basado en la topología de red radial tradicional para los siguientes escenarios: una arquitectura de red implementada en una sola región de Azure; una arquitectura de red abarca varias regiones de Azure sin necesidad de conectividad transitiva entre redes virtuales para zonas de aterrizaje entre regiones; una arquitectura de red que abarca varias regiones de Azure con emparejamiento de red virtual global que se usa para conectar redes virtuales entre regiones de Azure; una arquitectura de red sin necesidad de conectividad transitiva entre las conexiones VPN y ExpressRoute; el principal método de conectividad híbrida implementado es ExpressRoute, y el número de conexiones VPN es inferior a 30 por puerta de enlace VPN; hay una dependencia de NVA centralizados y enrutamiento granular.",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute",
            "severity": "Medio",
            "subcategory": "Hub and spoke",
            "text": "Asegúrese de que los servicios compartidos, incluidas las puertas de enlace de ExpressRoute, las puertas de enlace VPN y Azure Firewall o NVA asociados en la red virtual del concentrador central. Si es necesario, implemente también controladores de dominio de Active Directory y servidores DNS."
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha",
            "severity": "Medio",
            "subcategory": "Hub and spoke",
            "text": "Al implementar tecnologías de red de socios o NVA, siga las instrucciones del proveedor del socio"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "44ce3b1a-2808-4b9e-a1bf-1038df03a822",
            "link": "https://azure.microsoft.com/solutions/network-appliances/",
            "severity": "Medio",
            "subcategory": "Hub and spoke",
            "text": "No implemente servicios L7 entrantes, como Azure Application Gateway, como un servicio compartido en la red virtual del concentrador central. En su lugar, impleméntelos junto con la aplicación en sus respectivas zonas de aterrizaje."
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn",
            "severity": "Medio",
            "subcategory": "Hub and spoke",
            "text": "Si necesita tránsito entre ExpressRoute y puertas de enlace VPN, use Azure Route Server."
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region",
            "severity": "Medio",
            "subcategory": "Hub and spoke",
            "text": "Para arquitecturas de red con varias topologías radiales en regiones de Azure, use el emparejamiento de red virtual global para conectar redes virtuales de zona de aterrizaje cuando un pequeño número de zonas de aterrizaje necesite comunicarse entre regiones. ",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "37239b82-1112-4dbd-9eaf-12e6f943e53f",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs",
            "severity": "Medio",
            "subcategory": "Hub and spoke",
            "text": "Cuando implemente una arquitectura de red radial en dos regiones de Azure y se requiera conectividad de tránsito entre todas las zonas de aterrizaje entre regiones, use ExpressRoute con circuitos duales para proporcionar conectividad de tránsito para redes virtuales de zona de aterrizaje en regiones de Azure. ",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview",
            "severity": "Medio",
            "subcategory": "Hub and spoke",
            "text": "Use Azure Monitor for Networks para supervisar el estado completo de las redes en Azure.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits",
            "severity": "Medio",
            "subcategory": "Hub and spoke",
            "text": "Al conectar redes virtuales radiales a la red virtual del concentrador central, tenga en cuenta los límites de emparejamiento de red virtual y el número máximo de prefijos que se pueden anunciar a través de ExpressRoute"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
            "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering",
            "severity": "Alto",
            "subcategory": "Hub and spoke",
            "text": "Use la configuración \"Permitir tráfico a la red virtual remota\" al configurar emparejamientos de red virtual de red virtual"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli",
            "severity": "Medio",
            "subcategory": "Híbrido",
            "text": "Asegúrese de que ha investigado la posibilidad de usar ExpressRoute como conexión principal a Azure.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
            "severity": "Medio",
            "subcategory": "Híbrido",
            "text": "Cuando use varios circuitos ExpressRoute o varias ubicaciones locales, asegúrese de optimizar el enrutamiento con atributos BGP, si se prefieren determinadas rutas de acceso.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
            "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing",
            "severity": "Medio",
            "subcategory": "Híbrido",
            "text": "Asegúrese de usar la SKU correcta para las puertas de enlace ExpressRoute/VPN en función de los requisitos de ancho de banda y rendimiento.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
            "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways",
            "severity": "Medio",
            "subcategory": "Híbrido",
            "text": "Implemente una puerta de enlace de ExpressRoute con redundancia de zona en las regiones de Azure admitidas.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
            "link": "https://learn.microsoft.com/azure/networking/",
            "severity": "Medio",
            "subcategory": "Híbrido",
            "text": "Para escenarios que requieren un ancho de banda superior a 10 Gbps o puertos dedicados de 10/100 Gbps, use ExpressRoute Direct.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
            "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath",
            "severity": "Medio",
            "subcategory": "Híbrido",
            "text": "Cuando se requiera una latencia baja o el rendimiento del entorno local a Azure deba ser superior a 10 Gbps, habilite FastPath para omitir la puerta de enlace de ExpressRoute de la ruta de datos.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant",
            "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
            "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
            "severity": "Medio",
            "subcategory": "Híbrido",
            "text": "Use puertas de enlace VPN para conectar sucursales o ubicaciones remotas a Azure. Para una mayor resiliencia, implemente puertas de enlace con redundancia de zona (donde estén disponibles).",
            "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "fe237de1-43b1-46c3-8d7a-a9b64704489a",
            "link": "https://learn.microsoft.com/azure/networking/",
            "severity": "Medio",
            "subcategory": "Híbrido",
            "text": "Use el alcance global de ExpressRoute para conectar grandes oficinas, oficinas centrales regionales o centros de datos conectados a Azure a través de ExpressRoute.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
            "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability",
            "severity": "Medio",
            "subcategory": "Híbrido",
            "text": "Cuando se requiere aislamiento de tráfico o ancho de banda dedicado, como para separar entornos de producción y no producción, use circuitos ExpressRoute diferentes. Le ayudará a garantizar dominios de enrutamiento aislados y aliviar los riesgos de vecinos ruidosos.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts",
            "severity": "Medio",
            "subcategory": "Híbrido",
            "text": "Supervise la disponibilidad y el uso de ExpressRoute mediante métricas integradas de Azure Monitor.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
            "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor",
            "severity": "Medio",
            "subcategory": "Híbrido",
            "text": "Utilice el Monitor de conexión para la supervisión de la conectividad en todo el entorno.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
            "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#challenges-of-using-multiple-expressroute-circuits",
            "severity": "Medio",
            "subcategory": "Híbrido",
            "text": "No use explícitamente circuitos ExpressRoute desde una única ubicación de emparejamiento. Al hacerlo, se crea un único punto de error y se hace que la organización sea susceptible a interrupciones de ubicación de interconexión.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "cd163e39-84a5-4b39-97b7-6973abd70d94",
            "link": "https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-staging-server",
            "severity": "Medio",
            "subcategory": "Híbrido",
            "text": "Al implementar una máquina virtual de AD Connect, considere la posibilidad de tener un servidor de ensayo para alta disponibilidad / recuperación ante desastres"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
            "link": "https://learn.microsoft.com/en-us/azure/bastion/bastion-overview",
            "severity": "Medio",
            "subcategory": "Híbrido",
            "text": "Considere usar Bastion para conectarse de forma segura a su red."
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
            "severity": "Medio",
            "subcategory": "Plan IP",
            "text": "Asegúrese de que no haya espacios de direcciones IP superpuestos entre regiones de Azure y ubicaciones locales",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)')  | project id, compliant, cidr",
            "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
            "severity": "Medio",
            "subcategory": "Plan IP",
            "text": "Asegúrese de utilizar direcciones IP de la asignación de direcciones para Internet privado (RFC 1918).",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
            "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
            "severity": "Medio",
            "subcategory": "Plan IP",
            "text": "Asegúrese de que no se desperdicie espacio de direcciones IP, no cree redes virtuales innecesariamente grandes (por ejemplo, /16) ",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "e984a859-c773-4e7d-8616-23a765a917e1",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing",
            "severity": "Medio",
            "subcategory": "Plan IP",
            "text": "Asegúrese de que no haya un intervalo de direcciones IP públicas (bloqueo CIDR) para las redes virtuales, especialmente si no son propiedad de su organización",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
            "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses",
            "severity": "Medio",
            "subcategory": "Plan IP",
            "text": "Evite usar rangos de direcciones IP superpuestos para los sitios de producción y DR.",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
            "severity": "Medio",
            "subcategory": "Plan IP",
            "text": "Para entornos en los que la resolución de nombres en Azure es todo lo que se requiere, use Azure Private DNS para la resolución. Cree una zona delegada para la resolución de nombres (como 'azure.contoso.com').",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
            "severity": "Medio",
            "subcategory": "Plan IP",
            "text": "Para entornos donde se requiere resolución de nombres en Azure y local, use la infraestructura DNS existente (por ejemplo, DNS integrado en Active Directory) implementada en al menos dos máquinas virtuales (VM). Configure las opciones de DNS en redes virtuales para usar esos servidores DNS.",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances",
            "severity": "Medio",
            "subcategory": "Plan IP",
            "text": "Las cargas de trabajo especiales que requieren e implementan su propio DNS (como Red Hat OpenShift) deben usar su solución DNS preferida."
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "614658d3-558f-4d77-849b-821112df27ee",
            "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration",
            "severity": "Medio",
            "subcategory": "Plan IP",
            "text": "Habilite el registro automático de DNS de Azure para administrar automáticamente el ciclo de vida de los registros DNS de las máquinas virtuales implementadas en una red virtual.",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "1e43a58a-9c22-499c-9d7b-57d0c655562f",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview",
            "severity": "Medio",
            "subcategory": "Inspección",
            "text": "Utilice los paquetes de Network Watcher para capturar a pesar de la ventana de captura limitada.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "a65498f6-dfe2-437d-b143-b16c31d7aa9b",
            "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview",
            "severity": "Medio",
            "subcategory": "Inspección",
            "text": "Use soluciones de asociados para escenarios que requieran una inspección profunda de paquetes."
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "Medio",
            "subcategory": "Internet",
            "text": "Use Azure Firewall para controlar el tráfico saliente de Azure a Internet, las conexiones entrantes que no son HTTP/S y el filtrado de tráfico Este/Oeste (si la organización lo requiere)",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "resources | where type == 'microsoft.network/azurefirewalls' | project id,compliant=isnotnull(properties.firewallPolicy.id)",
            "guid": "0f1ce16e-d301-4d6e-a72e-52e3611cc58b",
            "link": "https://learn.microsoft.com/azure/firewall/",
            "severity": "Medio",
            "subcategory": "Internet",
            "text": "Use Firewall Manager con Virtual WAN para implementar y administrar Azure Firewalls en concentradores de Virtual WAN o en redes virtuales de concentradores.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
            "link": "https://learn.microsoft.com/azure/firewall/",
            "severity": "Medio",
            "subcategory": "Internet",
            "text": "Cree una directiva global de Azure Firewall para controlar la postura de seguridad en todo el entorno de red global y asígnela a todas las instancias de Azure Firewall. Permita que las directivas granulares cumplan los requisitos de regiones específicas delegando directivas de firewall incrementales a equipos de seguridad locales a través del control de acceso basado en roles de Azure.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
            "link": "https://learn.microsoft.com/azure/firewall/",
            "severity": "Medio",
            "subcategory": "Internet",
            "text": "Configure los proveedores de seguridad SaaS de socios compatibles en Firewall Manager si la organización desea usar dichas soluciones para ayudar a proteger las conexiones salientes.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "d15f512a-6549-48f6-bfe2-37de143b16c3",
            "link": "https://learn.microsoft.com/azure/firewall/",
            "severity": "Medio",
            "subcategory": "Internet",
            "text": "Utilice WAF dentro de una red virtual de zona de aterrizaje para proteger el tráfico HTTP/S entrante de Internet.",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview",
            "severity": "Medio",
            "subcategory": "Internet",
            "text": "Use Azure Front Door y las directivas WAF para proporcionar protección global en todas las regiones de Azure para las conexiones HTTP/S entrantes a una zona de aterrizaje.",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "Medio",
            "subcategory": "Internet",
            "text": "Cuando use Azure Front Door y Azure Application Gateway para ayudar a proteger las aplicaciones HTTP/S, use directivas WAF en Azure Front Door. Bloquee Azure Application Gateway para recibir tráfico solo de Azure Front Door.",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "Medio",
            "subcategory": "Internet",
            "text": "Si se requieren NVA de socios para las conexiones HTTP/S entrantes, impleméntelas dentro de una red virtual de zona de aterrizaje y junto con las aplicaciones que están protegiendo y exponiendo a Internet.",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
            "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures",
            "severity": "Medio",
            "subcategory": "Internet",
            "text": "Use planes de protección IP o de red DDoS de Azure para ayudar a proteger los puntos de conexión de direcciones IP públicas dentro de las redes virtuales.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "e504547c-2447-4ec6-9138-a7200f1ce16e",
            "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
            "severity": "Medio",
            "subcategory": "Paas",
            "text": "Si necesita comunicación privada con los servicios de PaaS, considere las diferentes opciones disponibles.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-private-access-to-azure-services/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
            "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services",
            "severity": "Medio",
            "subcategory": "Paas",
            "text": "Los servicios PaaS de Azure que se han insertado en una red virtual siguen realizando operaciones del plano de administración mediante direcciones IP públicas. Asegúrese de que esta comunicación no se interrumpa",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "e43a58a9-c229-49c4-b7b5-7d0c655562f2",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "Medio",
            "subcategory": "Paas",
            "text": "Use Private Link, donde esté disponible, para los servicios PaaS de Azure compartidos.",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "Medio",
            "subcategory": "Paas",
            "text": "Acceda a los servicios PaaS de Azure desde el entorno local a través del emparejamiento privado de ExpressRoute. Este método evita el tránsito a través de la Internet pública.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "65498f6d-fe23-47de-843b-16c31d7aa9b6",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "Medio",
            "subcategory": "Paas",
            "text": "Usar extremos de servicio de red virtual cuando Private Link no está disponible",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc",
            "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "Medio",
            "subcategory": "Paas",
            "text": "No habilite los extremos del servicio de red virtual de forma predeterminada en todas las subredes.",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "Medio",
            "subcategory": "Paas",
            "text": "No use extremos de servicio de red virtual cuando haya problemas de exfiltración de datos, a menos que use el filtrado NVA.",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "179b599d-e0d5-4973-ad4c-d21b088137f5",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "severity": "Medio",
            "subcategory": "Paas",
            "text": "No implemente túneles forzados para habilitar la comunicación de Azure a los recursos de Azure.",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)",
            "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
            "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
            "severity": "Medio",
            "subcategory": "Segmentación",
            "text": "No confíe en las reglas predeterminadas de entrada de NSG mediante la etiqueta de servicio VirtualNetwork para limitar la conectividad."
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "c2447ec6-6138-4a72-80f1-ce16ed301d6e",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation",
            "severity": "Medio",
            "subcategory": "Segmentación",
            "text": "Delegue la creación de subredes al propietario de la zona de aterrizaje. ",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview",
            "severity": "Medio",
            "subcategory": "Segmentación",
            "text": "Utilice NSG para ayudar a proteger el tráfico a través de subredes, así como el tráfico este/oeste a través de la plataforma (tráfico entre zonas de aterrizaje).",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)",
            "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563",
            "severity": "Medio",
            "subcategory": "Segmentación",
            "text": "El equipo de aplicaciones debe usar grupos de seguridad de aplicaciones en los grupos de seguridad de red de nivel de subred para ayudar a proteger las máquinas virtuales de varios niveles dentro de la zona de aterrizaje.",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "Medio",
            "subcategory": "Segmentación",
            "text": "Utilice grupos de seguridad de aplicaciones y NSG para microsegmentar el tráfico dentro de la zona de aterrizaje y evite usar un NVA central para filtrar los flujos de tráfico.",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "Medio",
            "subcategory": "Segmentación",
            "text": "Habilite los registros de flujo de NSG y introdúzcalos en Traffic Analytics para obtener información sobre los flujos de tráfico internos y externos.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "a8042d88-e79d-417b-93b2-2a5a67e7a8ed",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "Medio",
            "subcategory": "Segmentación",
            "text": "Utilice NSG para permitir selectivamente la conectividad entre las zonas de aterrizaje.",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "4b30e38c-3f29-4812-a236-3cefe179b599",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works",
            "severity": "Medio",
            "subcategory": "Segmentación",
            "text": "Para topologías de WAN virtual, dirija el tráfico a través de zonas de aterrizaje a través de Azure Firewall si la organización requiere funcionalidades de filtrado y registro para el tráfico que fluye a través de las zonas de aterrizaje.",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
            "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any",
            "severity": "Medio",
            "subcategory": "Virtual WAN",
            "text": "Considere Virtual WAN para simplificar la administración de redes de Azure y asegúrese de que su escenario se describe explícitamente en la lista de diseños de enrutamiento de Virtual WAN",
            "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "Medio",
            "subcategory": "Virtual WAN",
            "text": "Use un centro de WAN virtual por región de Azure para conectar varias zonas de aterrizaje entre regiones de Azure a través de una WAN virtual de Azure global común."
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "4f5664b5-e984-4a85-ac77-3e7d261623a7",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "Medio",
            "subcategory": "Virtual WAN",
            "text": "Use las características de enrutamiento de concentradores virtuales para segmentar aún más el tráfico entre redes virtuales y sucursales."
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "65a917e1-f348-4ef2-94c2-7d42e8bbac75",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "Medio",
            "subcategory": "Virtual WAN",
            "text": "Conexión de concentradores de Virtual WAN a centros de datos locales mediante ExpressRoute",
            "training": "https://learn.microsoft.com/learn/modules/configure-expressroute-virtual-wan/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "71559ab9-153e-4890-aae2-8c84c33b6b78",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "Medio",
            "subcategory": "Virtual WAN",
            "text": "Conecte sucursales y ubicaciones remotas al concentrador de Virtual WAN más cercano a través de Site-to-Site VPN, o habilite la conectividad de sucursales a Virtual WAN a través de una solución de socio SD-WAN.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-hybrid-networking/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "08b9fe5c-4104-49d4-83a9-23c3474d0001",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "Medio",
            "subcategory": "Virtual WAN",
            "text": "Conecte a los usuarios al concentrador WAN virtual a través de una VPN de punto a sitio.",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-hybrid-networking/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "Medio",
            "subcategory": "Virtual WAN",
            "text": "Siga el principio \"el tráfico en Azure permanece en Azure\" para que la comunicación entre los recursos de Azure se produzca a través de la red troncal de Microsoft"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "Medio",
            "subcategory": "Virtual WAN",
            "text": "Para la protección y el filtrado del tráfico saliente de Internet, implemente Azure Firewall",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "12df27ee-412e-47f9-a3f6-304722dd69c5",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "Medio",
            "subcategory": "Virtual WAN",
            "text": "Al implementar tecnologías de red de socios y NVA en VWAN, verifique la configuración con la guía del proveedor del socio para asegurarse de que no haya configuraciones conflictivas"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "b5c2622f-54b6-49ba-b33a-ad5e8c68e1d7",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about",
            "severity": "Medio",
            "subcategory": "Virtual WAN",
            "text": "Asegúrese de que los recursos de Azure Virtual WAN y Azure Firewall se crean en la suscripción de conectividad."
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
            "severity": "Medio",
            "subcategory": "Virtual WAN",
            "text": "Asegúrese de que la arquitectura de red está dentro de los límites de Azure Virtual WAN."
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
            "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights",
            "severity": "Medio",
            "subcategory": "Virtual WAN",
            "text": "Use Azure Monitor Insights for Virtual WAN para supervisar la topología de un extremo a otro de la WAN virtual, el estado y las métricas clave."
        },
        {
            "category": "Topología y conectividad de red ",
            "guid": "2df4930f-6a43-49a3-926b-309f02c302f0",
            "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/identity/adds-extend-domain#vm-recommendations",
            "severity": "Alto",
            "subcategory": "Híbrido",
            "text": "Si va a implementar al menos dos máquinas virtuales que ejecutan AD DS como controladores de dominio, agréguelas a diferentes zonas de disponibilidad. Si no está disponible en la región, implemente en un conjunto de disponibilidad."
        },
        {
            "category": "Operaciones",
            "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates",
            "severity": "Alto",
            "subcategory": "Puerta",
            "text": "Use certificados TLS administrados con Azure Front Door. Reduzca el costo operativo y el riesgo de interrupciones debido a la renovación de certificados."
        },
        {
            "category": "Operaciones",
            "guid": "f00a69de-7076-4734-a734-6e4552cad9e1",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates",
            "severity": "Medio",
            "subcategory": "Puerta",
            "text": "Si usa certificados TLS administrados por el cliente con Azure Front Door, use la versión de certificado \"más reciente\". Reduzca el riesgo de interrupciones causadas por la renovación manual de certificados."
        },
        {
            "category": "Operaciones",
            "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code",
            "severity": "Medio",
            "subcategory": "Puerta",
            "text": "Defina la configuración de Azure Front Door WAF como código. Mediante el uso de código, puede adoptar más fácilmente nuevas versiones del conjunto de reglas y obtener protección adicional."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls",
            "severity": "Alto",
            "subcategory": "Puerta",
            "text": "Use TLS de un extremo a otro con Azure Front Door. Utilice TLS para las conexiones de sus clientes a la puerta principal, y de la puerta principal a su origen."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection",
            "severity": "Medio",
            "subcategory": "Puerta",
            "text": "Use la redirección de HTTP a HTTPS con Azure Front Door. Admite clientes más antiguos redirigiéndolos automáticamente a una solicitud HTTPS."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf",
            "severity": "Alto",
            "subcategory": "Puerta",
            "text": "Habilite Azure Front Door WAF. Proteja su aplicación de una variedad de ataques."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf",
            "severity": "Alto",
            "subcategory": "Puerta",
            "text": "Ajuste el WAF de puerta delantera de Azure para su carga de trabajo. Reduzca las detecciones de falsos positivos."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-prevention-mode",
            "severity": "Alto",
            "subcategory": "Puerta",
            "text": "Use el modo de prevención con Azure Front Door WAF. El modo de prevención garantiza que el WAF bloquee las solicitudes maliciosas."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets",
            "severity": "Alto",
            "subcategory": "Puerta",
            "text": "Habilite los conjuntos de reglas predeterminadas de Azure Front Door WAF. Los conjuntos de reglas predeterminados detectan y bloquean ataques comunes."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "147a13d4-2a2f-4824-a524-f5855b52b946",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules",
            "severity": "Alto",
            "subcategory": "Puerta",
            "text": "Habilite las reglas de administración de bots de Azure Front Door WAF. Las reglas del bot detectan bots buenos y malos."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions",
            "severity": "Medio",
            "subcategory": "Puerta",
            "text": "Use las versiones más recientes del conjunto de reglas de Azure Front Door WAF. Las actualizaciones del conjunto de reglas se actualizan periódicamente para tener en cuenta el panorama actual de amenazas."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "b9620385-1cde-418f-914b-a84a06982ffc",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting",
            "severity": "Medio",
            "subcategory": "Puerta",
            "text": "Agregue limitación de velocidad al WAF de Azure Front Door. La limitación de velocidad bloquea a los clientes accidental o intencionalmente enviando grandes cantidades de tráfico en un corto período de tiempo."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits",
            "severity": "Medio",
            "subcategory": "Puerta",
            "text": "Use un umbral alto para los límites de velocidad WAF de Azure Front Door. Los umbrales de límite de alta velocidad evitan bloquear el tráfico legítimo, al tiempo que proporcionan protección contra un número extremadamente alto de solicitudes que podrían abrumar su infraestructura. "
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic",
            "severity": "Bajo",
            "subcategory": "Puerta",
            "text": "Filtre geográficamente el tráfico mediante Azure Front Door WAF. Permitir el tráfico solo de las regiones esperadas y bloquear el tráfico de otras regiones."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "00acd8a9-6975-414f-8491-2be6309893b8",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location",
            "severity": "Medio",
            "subcategory": "Puerta",
            "text": "Especifique la ubicación desconocida (ZZ) al filtrar geográficamente el tráfico con Azure Front Door WAF. Evite bloquear accidentalmente solicitudes legítimas cuando las direcciones IP no se pueden igualar geográficamente."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "Alto",
            "subcategory": "Gobernanza",
            "text": "Aproveche la directiva de Azure"
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "e979377b-cdb3-4751-ab2a-b13ada6e55d7",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/naming-and-tagging",
            "severity": "Medio",
            "subcategory": "Gobernanza",
            "text": "Identifique las etiquetas de Azure necesarias y use el modo de directiva anexar para aplicar el uso."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "Medio",
            "subcategory": "Gobernanza",
            "text": "Asigne los requisitos normativos y de cumplimiento a las definiciones de directivas de Azure y las asignaciones de roles de Azure."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "Medio",
            "subcategory": "Gobernanza",
            "text": "Establecer definiciones de directivas de Azure en el grupo de administración raíz de nivel superior para que se puedan asignar en ámbitos heredados"
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "Medio",
            "subcategory": "Gobernanza",
            "text": "Administre las asignaciones de directivas en el nivel más alto apropiado con exclusiones en los niveles inferiores, si es necesario"
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "43334f24-9116-4341-a2ba-527526944008",
            "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services",
            "severity": "Bajo",
            "subcategory": "Gobernanza",
            "text": "Use Azure Policy para controlar qué servicios pueden aprovisionar los usuarios en el nivel de grupo de suscripción/administración"
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "Medio",
            "subcategory": "Gobernanza",
            "text": "Utilice políticas integradas siempre que sea posible para minimizar la sobrecarga operativa."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "Medio",
            "subcategory": "Gobernanza",
            "text": "Asigne el rol de colaborador de directivas integrado en un ámbito determinado para habilitar el gobierno de nivel de aplicación."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "19048384-5c98-46cb-8913-156a12476e49",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview",
            "severity": "Medio",
            "subcategory": "Gobernanza",
            "text": "Limite el número de asignaciones de directivas de Azure realizadas en el ámbito del grupo de administración raíz para evitar la administración mediante exclusiones en ámbitos heredados."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
            "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration",
            "severity": "Medio",
            "subcategory": "Gobernanza",
            "text": "Use directivas de Azure para implementar automáticamente configuraciones de software a través de extensiones de máquina virtual y aplicar una configuración de máquina virtual de línea base compatible."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "9b5e2a28-9823-4faf-ab7e-afa5f6c57221",
            "link": "Configure Azure Automation Start/Stop VMs during off-hours | Microsoft Learn",
            "severity": "Medio",
            "subcategory": "Gobernanza",
            "text": "Considere el uso de etiquetas de automatización para iniciar/detener máquinas virtuales en su entorno para ahorrar costos."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift",
            "severity": "Medio",
            "subcategory": "Gobernanza",
            "text": "Supervise la desviación de la configuración de seguridad de VM a través de Azure Policy."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "5017f154-e3ab-4369-9829-e7e316183687",
            "link": "https://learn.microsoft.com/azure/key-vault/general/overview",
            "severity": "Alto",
            "subcategory": "Secretos",
            "text": "Uso del Almacén de claves de Azure para almacenar sus secretos y credenciales"
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
            "guid": "a0477a20-9945-4bda-9333-4f2491163418",
            "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling",
            "severity": "Medio",
            "subcategory": "Secretos",
            "text": "Use diferentes almacenes de claves de Azure para diferentes aplicaciones y regiones para evitar los límites de escala de transacciones y restringir el acceso a los secretos."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "Medio",
            "subcategory": "Secretos",
            "text": "Aprovisione Azure Key Vault con las directivas de eliminación y purga temporal habilitadas para permitir la protección de retención de objetos eliminados."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "Medio",
            "subcategory": "Secretos",
            "text": "Siga un modelo de privilegios mínimos limitando la autorización para eliminar permanentemente claves, secretos y certificados a roles personalizados especializados de Azure Active Directory (Azure AD)."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "Medio",
            "subcategory": "Secretos",
            "text": "Automatice el proceso de gestión y renovación de certificados con las autoridades de certificación públicas para facilitar la administración."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "913156a1-2476-4e49-b541-acdce979377b",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "Medio",
            "subcategory": "Secretos",
            "text": "Establezca un proceso automatizado para la rotación de claves y certificados."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "Medio",
            "subcategory": "Secretos",
            "text": "Habilite el firewall y el punto de conexión del servicio de red virtual o el punto de conexión privado en el almacén para controlar el acceso al almacén de claves."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
            "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault",
            "severity": "Medio",
            "subcategory": "Secretos",
            "text": "Use el área de trabajo de Azure Monitor Log Analytics central para auditar el uso de claves, certificados y secretos dentro de cada instancia de Key Vault."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "Medio",
            "subcategory": "Secretos",
            "text": "Delegue la creación de instancias del Almacén de claves y el acceso con privilegios, y use Azure Policy para aplicar una configuración compatible coherente."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "16183687-a047-47a2-8994-5bda43334f24",
            "link": "https://learn.microsoft.com/azure/security/fundamentals/encryption-atrest",
            "severity": "Medio",
            "subcategory": "Secretos",
            "text": "De forma predeterminada, utilice las claves administradas por Microsoft para la funcionalidad de cifrado principal y use claves administradas por el cliente cuando sea necesario."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "Medio",
            "subcategory": "Secretos",
            "text": "Use un Almacén de claves de Azure por aplicación por entorno y región."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices",
            "severity": "Medio",
            "subcategory": "Secretos",
            "text": "Si desea traer sus propias claves, es posible que no se admitan en todos los servicios considerados. Implemente una mitigación relevante para que las inconsistencias no obstaculicen los resultados deseados. Elija pares de regiones y regiones de recuperación ante desastres adecuadas que minimicen la latencia."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
            "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports",
            "severity": "Medio",
            "subcategory": "Seguridad",
            "text": "Use las funcionalidades de informes de Azure AD para generar informes de auditoría de control de acceso."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "4e3ab369-3829-4e7e-9161-83687a0477a2",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-data-export?tabs=portal",
            "severity": "Medio",
            "subcategory": "Seguridad",
            "text": "Exporte los registros de actividad de Azure a los registros de Azure Monitor para la retención de datos a largo plazo. Exporte a Azure Storage para almacenamiento a largo plazo más allá de dos años, si es necesario."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "09945bda-4333-44f2-9911-634182ba5275",
            "link": "https://learn.microsoft.com/azure/security-center/",
            "severity": "Medio",
            "subcategory": "Seguridad",
            "text": "Habilite Defender for Cloud Standard para todas las suscripciones."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
            "link": "https://learn.microsoft.com/azure/security-center/",
            "severity": "Medio",
            "subcategory": "Seguridad",
            "text": "Supervise la desviación de la revisión del sistema operativo base a través de Azure Monitor Logs y Defender for Cloud."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "severity": "Medio",
            "subcategory": "Seguridad",
            "text": "Conecte las configuraciones de recursos predeterminadas a un área de trabajo centralizada de Azure Monitor Log Analytics."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "b86ad884-08e3-4727-94b8-75ba18f20459",
            "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response",
            "severity": "Medio",
            "subcategory": "Seguridad",
            "text": "Determine el plan de respuesta a incidentes para los servicios de Azure antes de permitirlo en producción."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "01365d38-e43f-49cc-ad86-8266abca264f",
            "link": "https://www.microsoft.com/security/business/zero-trust",
            "severity": "Medio",
            "subcategory": "Seguridad",
            "text": "Implemente un enfoque de confianza cero para el acceso a la plataforma Azure, cuando corresponda."
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "9a19bf39-c95d-444c-9c89-19ca1f6d5215",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework",
            "severity": "Medio",
            "subcategory": "Seguridad",
            "text": "Planeación de cómo se implementarán los nuevos servicios de Azure"
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento",
            "guid": "ae514b93-3d45-485e-8112-9bd7ba012f7b",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework",
            "severity": "Medio",
            "subcategory": "Seguridad",
            "text": "Planeación de cómo se cumplirá la solicitud de servicio para los servicios de Azure"
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento ",
            "guid": "cacf55bc-e4e4-46be-96bc-57a5f23a269a",
            "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/resource-naming",
            "severity": "Alto",
            "subcategory": "Gobernanza",
            "text": "Se recomienda seguir los estándares de nomenclatura de procedimientos recomendados de Microsoft"
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento ",
            "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
            "link": "https://learn.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer",
            "severity": "Alto",
            "subcategory": "Seguridad",
            "text": "La transferencia segura a cuentas de almacenamiento debe estar habilitada"
        },
        {
            "category": "Seguridad, gobernanza y cumplimiento ",
            "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
            "link": "https://learn.microsoft.com/en-us/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection",
            "severity": "Alto",
            "subcategory": "Seguridad",
            "text": "Habilite la eliminación temporal del contenedor para que la cuenta de almacenamiento recupere un contenedor eliminado y su contenido."
        }
    ],
    "metadata": {
        "name": "Azure Landing Zone Review",
        "state": "GA",
        "timestamp": "March 16, 2023"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Medio"
        },
        {
            "name": "Bajo"
        }
    ],
    "status": [
        {
            "description": "Esta comprobación aún no se ha examinado",
            "name": "No verificado"
        },
        {
            "description": "Hay un elemento de acción asociado a esta comprobación",
            "name": "Abrir"
        },
        {
            "description": "Esta comprobación se ha comprobado y no hay más elementos de acción asociados a ella",
            "name": "Cumplido"
        },
        {
            "description": "Recomendación entendida, pero no necesaria por los requisitos actuales",
            "name": "No es necesario"
        },
        {
            "description": "No aplicable para el diseño actual",
            "name": "N/A"
        }
    ]
}
checklists/lz_checklist.en.json METASEP
{
    "items": [
        {
            "category": "Backup and Disaster Recovery",
            "subcategory": "Data Protection",
            "text": "Consider cross-region replication in Azure for BCDR with paired regions",
            "guid": "7ea02e1c-7166-45a3-bdf5-098891367fcb",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/en-us/azure/reliability/cross-region-replication-azure"
        },
        {
            "category": "Backup and Disaster Recovery",
            "subcategory": "Data Protection",
            "text": "When using Azure Backup, consider the different backup types (GRS, ZRS & LRS) as the default setting is GRS",
            "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/en-us/azure/storage/common/storage-redundancy"
        },
        {
            "category": "Identity and Access",
            "subcategory": "Identity",
            "text": "Implement for emergency access or break-glass accounts to prevent tenant-wide account lockout",
            "guid": "984a859c-773e-47d2-9162-3a765a917e1f",
            "severity": "High",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
            "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access"
        },
        {
            "category": "Identity and Access",
            "subcategory": "Identity",
            "text": "Enforce a RBAC model for management groups, subscriptions, resource groups and resources",
            "guid": "348ef254-c27d-442e-abba-c7571559ab91",
            "severity": "High",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
            "link": "https://learn.microsoft.com/azure/role-based-access-control/overview"
        },
        {
            "category": "Identity and Access",
            "subcategory": "Identity",
            "text": "Enforce Azure AD conditional-access policies for any user with rights to Azure environments",
            "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4",
            "severity": "Low",
            "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
            "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview"
        },
        {
            "category": "Identity and Access",
            "subcategory": "Identity",
            "text": "Enforce multi-factor authentication for any user with rights to the Azure environments",
            "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01",
            "severity": "High",
            "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
            "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks"
        },
        {
            "category": "Identity and Access",
            "subcategory": "Identity",
            "text": "Enforce centralized and delegated responsibilities to manage resources deployed inside the landing zone, based on role and security requirements",
            "guid": "e6a83de5-de32-4c19-a248-1607d5d1e4e6",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
            "link": "https://learn.microsoft.com/azure/role-based-access-control/overview"
        },
        {
            "category": "Identity and Access",
            "subcategory": "Identity",
            "text": "Enforce Azure AD Privileged Identity Management (PIM) to establish zero standing access and least privilege",
            "guid": "14658d35-58fd-4772-99b8-21112df27ee4",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
            "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure"
        },
        {
            "category": "Identity and Access",
            "subcategory": "Identity",
            "text": "Only use the authentication type Work or school account for all account types. Avoid using the Microsoft account",
            "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5",
            "severity": "High",
            "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
            "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts"
        },
        {
            "category": "Identity and Access",
            "subcategory": "Identity",
            "text": "Only use groups to assign permissions. Add on-premises groups to the Azure-AD-only group if a group management system is already in place.",
            "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
            "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal"
        },
        {
            "category": "Identity and Access",
            "subcategory": "Identity",
            "text": "Consider using Azure custom roles for the following key roles: Azure platform owner, network management, security operations, subscription owner, application owner",
            "guid": "f5664b5e-984a-4859-a773-e7d261623a76",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations"
        },
        {
            "category": "Identity and Access",
            "subcategory": "Identity",
            "text": "If any data sovereignty requirements exist, Azure Policies can be deployed to enforce them",
            "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/",
            "link": "https://azure.microsoft.com/resources/achieving-compliant-data-residency-and-security-with-azure/"
        },
        {
            "category": "Identity and Access",
            "subcategory": "Identity",
            "text": "If Azure Active Directory Domains Services (AADDS) is in use, deploy AADDS within the primary region because this service can only be projected into one subscription",
            "guid": "1559ab91-53e8-4908-ae28-c84c33b6b780",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/",
            "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview"
        },
        {
            "category": "Identity and Access",
            "subcategory": "Identity",
            "text": "If AADDS in use, evaluate the compatibility of all workloads",
            "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/",
            "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview"
        },
        {
            "category": "Identity and Access",
            "subcategory": "Identity",
            "text": "If AD on Windows server in use, can all required resources access correct domain controller?",
            "guid": "ac6a9e01-e6a8-43de-9de3-2c1992481607",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/implement-windows-server-iaas-virtual-machine-identity/",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain"
        },
        {
            "category": "Identity and Access",
            "subcategory": "Identity",
            "text": "Consider using Azure AD Application Proxy as a VPN or reverse proxy replacement to give remote users secure and authenticated access to internal applications (hosted in the cloud or on-premises).",
            "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
            "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy"
        },
        {
            "category": "Identity and Access",
            "subcategory": "Identity",
            "text": "Avoid using on-premises synced accounts for Azure AD role assignments.",
            "guid": "35037e68-9349-4c15-b371-228514f4cdff",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/",
            "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices"
        },
        {
            "category": "Management Group and Subscriptions",
            "subcategory": "Subscriptions",
            "text": "Enforce reasonably flat management group hierarchy with no more than three to four levels, ideally",
            "guid": "2df27ee4-12e7-4f98-9f63-04722dd69c5b",
            "severity": "Medium",
            "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)",
            "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups"
        },
        {
            "category": "Management Group and Subscriptions",
            "subcategory": "Subscriptions",
            "text": "Enforce or appended resource tags through Azure Policy",
            "guid": "5c2622f5-4b69-4bad-93aa-d5e8c68e1d76",
            "severity": "Medium",
            "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/resource-tagging/?toc=/azure/azure-resource-manager/management/toc.json"
        },
        {
            "category": "Management Group and Subscriptions",
            "subcategory": "Subscriptions",
            "text": "Enforce a sandbox management group to allow users to immediately experiment with Azure",
            "guid": "667313b4-f566-44b5-b984-a859c773e7d2",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations"
        },
        {
            "category": "Management Group and Subscriptions",
            "subcategory": "Subscriptions",
            "text": "Enforce a platform management group under the root management group to support common platform policy and Azure role assignment",
            "guid": "61623a76-5a91-47e1-b348-ef254c27d42e",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations"
        },
        {
            "category": "Management Group and Subscriptions",
            "subcategory": "Subscriptions",
            "text": "Enforce a dedicated connectivity subscription in the Platform management group to host an Azure Virtual WAN hub, private Domain Name System (DNS), ExpressRoute circuit, and other networking resources.",
            "guid": "8bbac757-1559-4ab9-853e-8908ae28c84c",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations"
        },
        {
            "category": "Management Group and Subscriptions",
            "subcategory": "Subscriptions",
            "text": "Enforce no subscriptions are placed under the root management group",
            "guid": "33b6b780-8b9f-4e5c-9104-9d403a923c34",
            "severity": "Medium",
            "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant = (array_length(mgmtChain) > 1)",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---default-management-group"
        },
        {
            "category": "Management Group and Subscriptions",
            "subcategory": "Subscriptions",
            "text": "Enforce that only privileged users can operate management groups in the tenant by enabling Azure RBAC authorization in the management group hierarchy settings",
            "guid": "74d00018-ac6a-49e0-8e6a-83de5de32c19",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization"
        },
        {
            "category": "Management Group and Subscriptions",
            "subcategory": "Subscriptions",
            "text": "Enforce management groups under the root-level management group to represent the types of workloads, based on their security, compliance, connectivity, and feature needs.",
            "guid": "92481607-d5d1-4e4e-9146-58d3558fd772",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
        },
        {
            "category": "Management Group and Subscriptions",
            "subcategory": "Subscriptions",
            "text": "Enforce a process to make resource owners aware of their roles and responsibilities, access review, budget review, policy compliance and remediate when necessary.",
            "guid": "49b82111-2df2-47ee-912e-7f983f630472",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
        },
        {
            "category": "Management Group and Subscriptions",
            "subcategory": "Subscriptions",
            "text": "Ensure that all subscription owners and IT core team are aware of subscription resource limitations as part of workload design sessions.",
            "guid": "2dd69c5b-5c26-422f-94b6-9bad33aad5e8",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits"
        },
        {
            "category": "Management Group and Subscriptions",
            "subcategory": "Subscriptions",
            "text": "Use Reserved Instances where appropriate to optimize cost and ensure available capacity in target regions. Enforce the use of purchased Reserved Instance VM SKUs via Azure Policy.",
            "guid": "c68e1d76-6673-413b-9f56-64b5e984a859",
            "severity": "High",
            "training": "https://learn.microsoft.com/learn/paths/improve-reliability-modern-operations/",
            "link": "https://learn.microsoft.com/azure/cost-management-billing/reservations/save-compute-costs-reservations"
        },
        {
            "category": "Management Group and Subscriptions",
            "subcategory": "Subscriptions",
            "text": "Enforce a dashboard, workbook, or manual process to monitor used capacity levels",
            "guid": "c773e7d2-6162-43a7-95a9-17e1f348ef25",
            "severity": "High",
            "training": "https://learn.microsoft.com/learn/paths/monitor-usage-performance-availability-resources-azure-monitor/",
            "link": "https://learn.microsoft.com/azure/architecture/framework/scalability/design-capacity"
        },
        {
            "category": "Management Group and Subscriptions",
            "subcategory": "Subscriptions",
            "text": "Ensure required services and features are available within the chosen deployment regions",
            "guid": "4c27d42e-8bba-4c75-9155-9ab9153e8908",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/",
            "link": "https://azure.microsoft.com/global-infrastructure/services/"
        },
        {
            "category": "Management Group and Subscriptions",
            "subcategory": "Subscriptions",
            "text": "Enforce a process for cost management",
            "guid": "ae28c84c-33b6-4b78-88b9-fe5c41049d40",
            "severity": "High",
            "training": "https://learn.microsoft.com/learn/paths/control-spending-manage-bills/",
            "link": "https://learn.microsoft.com/azure/cost-management-billing/cost-management-billing-overview"
        },
        {
            "category": "Management Group and Subscriptions",
            "subcategory": "Subscriptions",
            "text": "If AD on Windows Server, establish a dedicated identity subscription in the Platform management group to host Windows Server Active Directory domain controllers",
            "guid": "3a923c34-74d0-4001-aac6-a9e01e6a83de",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/",
            "link": "https://learn.microsoft.com/azure/governance/management-groups/overview"
        },
        {
            "category": "Management Group and Subscriptions",
            "subcategory": "Subscriptions",
            "text": "Ensure tags are used for billing and cost management",
            "guid": "5de32c19-9248-4160-9d5d-1e4e614658d3",
            "severity": "Medium",
            "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/track-costs"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Front Door",
            "text": "Add diagnostic settings to save your Azure Front Door WAF's logs. Regularly review the logs to check for attacks and for false positive detections.",
            "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Front Door",
            "text": "Send Azure Front Door logs to Microsoft Sentinel. Detect attacks and integrate Front Door telemetry into your overall Azure environment.",
            "guid": "7f408960-c626-44cb-a018-347c8d790cdf",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.",
            "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Is the landing zone documented?",
            "guid": "e179b599-de0d-4597-9cd4-cd21b088137f",
            "severity": "Medium"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Export logs to Azure Storage if log retention requirements exceed two years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.",
            "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ",
            "guid": "00f1ce16-ed30-41d6-b872-e52e3611cc58",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Monitor in-guest virtual machine (VM) configuration drift using Azure Policy. Enabling guest configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.",
            "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
            "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Use Update Management in Azure Automation as a long-term patching mechanism for both Windows and Linux VMs. ",
            "guid": "f9887952-5d62-4688-9d70-ba6c97be9951",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/",
            "link": "https://learn.microsoft.com/azure/automation/update-management/overview"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Use Network Watcher to proactively monitor traffic flows",
            "guid": "90483845-c986-4cb2-a131-56a12476e49f",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/",
            "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Use resource locks to prevent accidental deletion of critical shared services.",
            "guid": "541acdce-9793-477b-adb3-751ab2ab13ad",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Use deny policies to supplement Azure role assignments. The combination of deny policies and Azure role assignments ensures the appropriate guardrails are in place to enforce who can deploy and configure resources and what resources they can deploy and configure.",
            "guid": "a6e55d7d-8a2a-4db1-87d6-326af625ca44",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Include service and resource health events as part of the overall platform monitoring solution. Tracking service and resource health from the platform perspective is an important component of resource management in Azure.",
            "guid": "e5695f22-23ac-4e8c-a123-08ca5017f154",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Include alerts and action groups as part of the Azure Service Health platform to ensure that alerts or issues can be actioned",
            "guid": "d5f345bf-97ab-41a7-819c-6104baa7d48c",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Don't send raw log entries back to on-premises monitoring systems. Instead, adopt a principle that data born in Azure stays in Azure. If on-premises SIEM integration is required, then send critical alerts instead of logs.",
            "guid": "e3ab3693-829e-47e3-8618-3687a0477a20",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Use a centralized Azure Monitor Log Analytics workspace to collect logs and metrics from IaaS and PaaS application resources and control log access with Azure RBAC.",
            "guid": "9945bda4-3334-4f24-a116-34182ba52752",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Use Azure Monitor Logs for insights and reporting.",
            "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "When necessary, use shared storage accounts within the landing zone for Azure diagnostic extension log storage.",
            "guid": "619e8a13-f988-4795-85d6-26886d70ba6c",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-monitor/agents/diagnostics-extension-overview"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Use Azure Monitor alerts for the generation of operational alerts.",
            "guid": "97be9951-9048-4384-9c98-6cb2913156a1",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Use Azure Site Recovery for Azure-to-Azure Virtual Machines disaster recovery scenarios. This enables you to replicate workloads across regions.",
            "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Ensure to use and test native PaaS service disaster recovery capabilities.",
            "guid": "b2ab13ad-a6e5-45d7-b8a2-adb117d6326a",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Use Azure-native backup capabilities. Verify that partner/customer is aware of Azure Backup and all new capabilities which greatly can simplify backup management",
            "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/backup/backup-center-overview"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Ensure that monitoring requirements have been assessed and that appropriate data collection and alerting configurations are applied",
            "guid": "859c3900-4514-41eb-b010-475d695abd74",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring"
        },
        {
            "category": "Management and Monitoring",
            "subcategory": "Monitoring",
            "text": "Consider supported regions for linked Log Analytics workspace and automation accounts",
            "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/en-us/azure/automation/how-to/region-mappings"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "App delivery",
            "text": "Perform app delivery within landing zones for both internal-facing (corp) and external-facing apps (online).",
            "guid": "6138a720-0f1c-4e16-bd30-1d6e872e52e3",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "App delivery",
            "text": "For secure delivery of HTTP/S apps, ensure that WAF protection and policies are enabled in your Application Gateways",
            "guid": "611cc58b-5a4b-4151-8e43-a58a9c2299c4",
            "severity": "Medium",
            "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = (properties.webApplicationFirewallConfiguration.enabled == True and properties.webApplicationFirewallConfiguration.firewallMode == 'Prevention')",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-faq"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "App delivery",
            "text": "Ensure you are using Application Gateway v2 SKU",
            "guid": "553585a6-abe0-11ed-afa1-0242ac120002",
            "severity": "Medium",
            "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
            "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "App delivery",
            "text": "Use a partner NVA if you can't use Application Gateway v2 for the security of HTTP/S apps.",
            "guid": "d7b57d0c-6555-462f-8b3e-4563a4d87397",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/organize-resources?tabs=AzureManagementGroupsAndHierarchy"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "App delivery",
            "text": "Deploy Azure Application Gateway v2 or partner NVAs used for inbound HTTP/S connections within the landing-zone virtual network and with the apps that they're securing.",
            "guid": "48b662d6-d15f-4512-a654-98f6dfe237de",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "App delivery",
            "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.",
            "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "App delivery",
            "text": "Use Azure Front Door with WAF policies to deliver and help protect global HTTP/S apps that span Azure regions.",
            "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "App delivery",
            "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.",
            "guid": "3f29812b-2363-4cef-b179-b599de0d5973",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
            "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "App delivery",
            "text": "Use Traffic Manager to deliver global apps that span protocols other than HTTP/S.",
            "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "App delivery",
            "text": "If users only need access to internal applications, has Azure AD Application Proxy been considered as an alternative to Azure Virtual Desktop (AVD)?",
            "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204",
            "severity": "Low",
            "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/",
            "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "App delivery",
            "text": "To reduce the number of firewall ports open for incoming connections in your network, consider using Azure AD Application Proxy to give remote users secure and authenticated access to internal applications.",
            "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/",
            "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Encryption",
            "text": "When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.",
            "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Encryption",
            "text": "For scenarios where MACsec isn't an option (for example, not using ExpressRoute Direct), use a VPN gateway to establish IPsec tunnels over ExpressRoute private peering. ",
            "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Front Door",
            "text": "Deploy your WAF profiles for Front Door in 'Prevention' mode.",
            "guid": "ae248989-b306-4591-9186-de482e3f0f0e",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings",
            "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Front Door",
            "text": "Avoid combining Azure Traffic Manager and Azure Front Door.",
            "guid": "062d5839-4d36-402f-bfa4-02811eb936e9",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Front Door",
            "text": "Use the same domain name on Azure Front Door and your origin. Mismatched host names can cause subtle bugs.",
            "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Front Door",
            "text": "Disable health probes when there is only one origin in an Azure Front Door origin group.",
            "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Front Door",
            "text": "Select good health probe endpoints for Azure Front Door. Consider building health endpoints that check all of your application's dependencies.",
            "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Front Door",
            "text": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application.",
            "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hub and spoke",
            "text": "Consider a network design based on the traditional hub-and-spoke network topology for the following scenarios: a network architecture deployed within a single Azure region; a network architecture spans multiple Azure regions with no need for transitive connectivity between virtual networks for landing zones across regions; a network architecture that spans multiple Azure regions with global VNet peering used to connect virtual networks across Azure regions; a network architecture with no need for transitive connectivity between VPN and ExpressRoute connections; the main hybrid connectivity method in place is ExpressRoute, and the number of VPN connections is less than 30 per VPN gateway; there's a dependency on centralized NVAs and granular routing.",
            "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hub and spoke",
            "text": "Ensure that shared services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy Active Directory domain controllers and DNS servers.",
            "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hub and spoke",
            "text": "When deploying partner networking technologies or NVAs, follow the partner vendor's guidance",
            "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hub and spoke",
            "text": "Do not deploy inbound L7 services such as Azure Application Gateway as a shared service in the central-hub virtual network. Instead, deploy them together with the app in their respective landing zones.",
            "guid": "44ce3b1a-2808-4b9e-a1bf-1038df03a822",
            "severity": "Medium",
            "link": "https://azure.microsoft.com/solutions/network-appliances/"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hub and spoke",
            "text": "If you need transit between ExpressRoute and VPN gateways, use Azure Route Server.",
            "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hub and spoke",
            "text": "For network architectures with multiple hub-and-spoke topologies across Azure regions, use Global Virtual Network Peering to connect landing-zone virtual networks when a small number of landing zones need to communicate across regions. ",
            "guid": "cc881471-607c-41cc-a0e6-14658dd558f9",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hub and spoke",
            "text": "When you deploy a hub-and-spoke network architecture in two Azure regions and transit connectivity between all landing zones across regions is required, use ExpressRoute with dual circuits to provide transit connectivity for landing-zone virtual networks across Azure regions. ",
            "guid": "37239b82-1112-4dbd-9eaf-12e6f943e53f",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hub and spoke",
            "text": "Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.",
            "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hub and spoke",
            "text": "When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits and the maximum number of prefixes that can be advertised via ExpressRoute",
            "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hub and spoke",
            "text": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings",
            "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002",
            "severity": "High",
            "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hybrid",
            "text": "Ensure that you have investigated the possibility to use ExpressRoute as primary connection to Azure.",
            "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hybrid",
            "text": "When you use multiple ExpressRoute circuits, or multiple on-prem locations, make sure to optimize routing with BGP attributes, if certain paths are preferred.",
            "guid": "f29812b2-363c-4efe-879b-599de0d5973c",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hybrid",
            "text": "Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.",
            "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c",
            "severity": "Medium",
            "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hybrid",
            "text": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.",
            "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8",
            "severity": "Medium",
            "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hybrid",
            "text": "For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.",
            "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
            "link": "https://learn.microsoft.com/azure/networking/"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hybrid",
            "text": "When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.",
            "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
            "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hybrid",
            "text": "Use VPN gateways to connect branches or remote locations to Azure. For higher resilience, deploy zone-redundant gateways (where available).",
            "guid": "4d873974-8b66-42d6-b15f-512a65498f6d",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/",
            "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway",
            "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hybrid",
            "text": "Use ExpressRoute Global Reach to connect large offices, regional headquarters, or datacenters connected to Azure via ExpressRoute.",
            "guid": "fe237de1-43b1-46c3-8d7a-a9b64704489a",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
            "link": "https://learn.microsoft.com/azure/networking/"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hybrid",
            "text": "When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.",
            "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
            "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hybrid",
            "text": "Monitor ExpressRoute availability and utilization using built-in Azure Monitor metrics.",
            "guid": "b30e38c3-f298-412b-8363-cefe179b599d",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
            "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hybrid",
            "text": "Use Connection Monitor for connectivity monitoring across the environment.",
            "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
            "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hybrid",
            "text": "Don't explicitly use ExpressRoute circuits from a single peering location. Doing so creates a single point of failure and makes the organization susceptible to peering location outages.",
            "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
            "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#challenges-of-using-multiple-expressroute-circuits"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hybrid",
            "text": "When deploying an AD Connect VM, consider having a staging sever for high availability / Disaster recovery",
            "guid": "cd163e39-84a5-4b39-97b7-6973abd70d94",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-staging-server"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Hybrid",
            "text": "Consider using Bastion to securely connect to your network.",
            "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/en-us/azure/bastion/bastion-overview"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "IP plan",
            "text": "Ensure no overlapping IP address spaces across Azure regions and on-premises locations",
            "guid": "558fd772-49b8-4211-82df-27ee412e7f98",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "IP plan",
            "text": "Ensure to use IP addresses from the address allocation for private internets (RFC 1918).",
            "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad",
            "severity": "Medium",
            "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)')  | project id, compliant, cidr",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "IP plan",
            "text": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16) ",
            "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5",
            "severity": "Medium",
            "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "IP plan",
            "text": "Ensure no public IP address range (CIDR block) for VNETs, especially if not owned by your organization",
            "guid": "e984a859-c773-4e7d-8616-23a765a917e1",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "IP plan",
            "text": "Avoid using overlapping IP address ranges for production and DR sites.",
            "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
            "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "IP plan",
            "text": "For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution. Create a delegated zone for name resolution (such as 'azure.contoso.com').",
            "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "IP plan",
            "text": "For environments where name resolution across Azure and on-premises is required, use existing DNS infrastructure (for example, Active Directory integrated DNS) deployed onto at least two virtual machines (VMs). Configure DNS settings in virtual networks to use those DNS servers.",
            "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "IP plan",
            "text": "Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.",
            "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "IP plan",
            "text": "Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.",
            "guid": "614658d3-558f-4d77-849b-821112df27ee",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/",
            "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Inspection",
            "text": "Use Network Watcher packets to capture despite the limited capture window.",
            "guid": "1e43a58a-9c22-499c-9d7b-57d0c655562f",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
            "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Inspection",
            "text": "Use partner solutions for scenarios that require deep packet inspection.",
            "guid": "a65498f6-dfe2-437d-b143-b16c31d7aa9b",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Internet",
            "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)",
            "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Internet",
            "text": "Use Firewall Manager with Virtual WAN to deploy and manage Azure firewalls across Virtual WAN hubs or in hub virtual networks.",
            "guid": "0f1ce16e-d301-4d6e-a72e-52e3611cc58b",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
            "link": "https://learn.microsoft.com/azure/firewall/",
            "graph": "resources | where type == 'microsoft.network/azurefirewalls' | project id,compliant=isnotnull(properties.firewallPolicy.id)"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Internet",
            "text": "Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.",
            "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
            "link": "https://learn.microsoft.com/azure/firewall/"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Internet",
            "text": "Configure supported partner SaaS security providers within Firewall Manager if the organization wants to use such solutions to help protect outbound connections.",
            "guid": "655562f2-b3e4-4563-a4d8-739748b662d6",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
            "link": "https://learn.microsoft.com/azure/firewall/"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Internet",
            "text": "Use WAF within a landing-zone virtual network for protecting inbound HTTP/S traffic from the internet.",
            "guid": "d15f512a-6549-48f6-bfe2-37de143b16c3",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
            "link": "https://learn.microsoft.com/azure/firewall/"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Internet",
            "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.",
            "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Internet",
            "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.",
            "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Internet",
            "text": "If partner NVAs are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.",
            "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Internet",
            "text": "Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.",
            "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
            "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "PaaS",
            "text": "If you need private communication to PaaS services, consider the different options available.",
            "guid": "e504547c-2447-4ec6-9138-a7200f1ce16e",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-private-access-to-azure-services/",
            "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "PaaS",
            "text": "Azure PaaS services that have been injected into a virtual network still perform management plane operations by using public IP addresses. Ensure that this communication is not broken",
            "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
            "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "PaaS",
            "text": "Use Private Link, where available, for shared Azure PaaS services.",
            "guid": "e43a58a9-c229-49c4-b7b5-7d0c655562f2",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "PaaS",
            "text": "Access Azure PaaS services from on-premises via ExpressRoute private peering. This method avoids transiting over the public internet.",
            "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "PaaS",
            "text": "Use virtual network service endpoints when Private Link isn't available",
            "guid": "65498f6d-fe23-47de-843b-16c31d7aa9b6",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "PaaS",
            "text": "Don't enable virtual network service endpoints by default on all subnets.",
            "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features",
            "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "PaaS",
            "text": "Don't use virtual network service endpoints when there are data exfiltration concerns, unless you use NVA filtering.",
            "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "PaaS",
            "text": "Don't implement forced tunneling to enable communication from Azure to Azure resources.",
            "guid": "179b599d-e0d5-4973-ad4c-d21b088137f5",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Segmentation",
            "text": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.",
            "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags",
            "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Segmentation",
            "text": "Delegate subnet creation to the landing zone owner. ",
            "guid": "c2447ec6-6138-4a72-80f1-ce16ed301d6e",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Segmentation",
            "text": "Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).",
            "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Segmentation",
            "text": "The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone.",
            "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
            "graph": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Segmentation",
            "text": "Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.",
            "guid": "a4d87397-48b6-462d-9d15-f512a65498f6",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Segmentation",
            "text": "Enable NSG flow logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.",
            "guid": "dfe237de-143b-416c-91d7-aa9b64704489",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Segmentation",
            "text": "Use NSGs to selectively allow connectivity between landing zones.",
            "guid": "a8042d88-e79d-417b-93b2-2a5a67e7a8ed",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/implement-network-security/",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Segmentation",
            "text": "For Virtual WAN topologies, route traffic across landing zones via Azure Firewall if the organization requires filtering and logging capabilities for traffic flowing across landing zones.",
            "guid": "4b30e38c-3f29-4812-a236-3cefe179b599",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
            "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Virtual WAN",
            "text": "Consider Virtual WAN for simplified Azure networking management, and make sure your scenario is explicitly described in the list of Virtual WAN routing designs",
            "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/",
            "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Virtual WAN",
            "text": "Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.",
            "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Virtual WAN",
            "text": "Use Virtual Hub Routing features to further segment traffic between VNets and branches.",
            "guid": "4f5664b5-e984-4a85-ac77-3e7d261623a7",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Virtual WAN",
            "text": "Connect Virtual WAN hubs to on-premises datacenters by using ExpressRoute",
            "guid": "65a917e1-f348-4ef2-94c2-7d42e8bbac75",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/configure-expressroute-virtual-wan/",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Virtual WAN",
            "text": "Connect branches and remote locations to the nearest Virtual WAN hub via Site-to-Site VPN, or enable branch connectivity to Virtual WAN via an SD-WAN partner solution.",
            "guid": "71559ab9-153e-4890-aae2-8c84c33b6b78",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-hybrid-networking/",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Virtual WAN",
            "text": "Connect users to the Virtual WAN hub via a Point-to-Site VPN.",
            "guid": "08b9fe5c-4104-49d4-83a9-23c3474d0001",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/design-implement-hybrid-networking/",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Virtual WAN",
            "text": "Follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network",
            "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Virtual WAN",
            "text": "For outbound Internet traffic protection and filtering, deploy Azure Firewall",
            "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Virtual WAN",
            "text": "When deploying partner networking technologies and NVAs in VWAN, verify configuration with partner vendor's guidance to ensure there are no conflicting configurations",
            "guid": "12df27ee-412e-47f9-a3f6-304722dd69c5",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Virtual WAN",
            "text": "Ensure that Azure Virtual WAN and Azure Firewall resources are created in the connectivity subscription.",
            "guid": "b5c2622f-54b6-49ba-b33a-ad5e8c68e1d7",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Virtual WAN",
            "text": "Ensure that the network architecture is within the Azure Virtual WAN limits.",
            "guid": "6667313b-4f56-464b-9e98-4a859c773e7d",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Virtual WAN",
            "text": "Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.",
            "guid": "261623a7-65a9-417e-8f34-8ef254c27d42",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights"
        },
        {
            "category": "Network Topology and Connectivity ",
            "subcategory": "Hybrid",
            "text": "If you are deploying at least two VMs running AD DS as domain controllers, add them to different Availability Zones. If not available in the region, deploy in an Availability Set.",
            "guid": "2df4930f-6a43-49a3-926b-309f02c302f0",
            "severity": "High",
            "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/identity/adds-extend-domain#vm-recommendations"
        },
        {
            "category": "Operations",
            "subcategory": "Front Door",
            "text": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals.",
            "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates"
        },
        {
            "category": "Operations",
            "subcategory": "Front Door",
            "text": "If you use customer-managed TLS certificates with Azure Front Door, use the 'Latest' certificate version. Reduce the risk of outages caused by manual certificate renewal.",
            "guid": "f00a69de-7076-4734-a734-6e4552cad9e1",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates"
        },
        {
            "category": "Operations",
            "subcategory": "Front Door",
            "text": "Define your Azure Front Door WAF configuration as code. By using code, you can more easily adopt new ruleset versions and gain additional protection.",
            "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Front Door",
            "text": "Use end-to-end TLS with Azure Front Door. Use TLS for connections from your clients to Front Door, and from Front Door to your origin.",
            "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Front Door",
            "text": "Use HTTP to HTTPS redirection with Azure Front Door. Support older clients by redirecting them to an HTTPS request automatically.",
            "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Front Door",
            "text": "Enable the Azure Front Door WAF. Protect your application from a range of attacks.",
            "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Front Door",
            "text": "Tune the Azure Front Door WAF for your workload. Reduce false positive detections.",
            "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Front Door",
            "text": "Use prevention mode with the Azure Front Door WAF. Prevention mode ensures that the WAF blocks malicious requests.",
            "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-prevention-mode"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Front Door",
            "text": "Enable the Azure Front Door WAF default rule sets. The default rule sets detect and block common attacks.",
            "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Front Door",
            "text": "Enable the Azure Front Door WAF bot management rules. The bot rules detect good and bad bots.",
            "guid": "147a13d4-2a2f-4824-a524-f5855b52b946",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Front Door",
            "text": "Use the latest Azure Front Door WAF ruleset versions. Ruleset updates are regularly updated to take account of the current threat landscape.",
            "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Front Door",
            "text": "Add rate limiting to the Azure Front Door WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.",
            "guid": "b9620385-1cde-418f-914b-a84a06982ffc",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Front Door",
            "text": "Use a high threshold for Azure Front Door WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ",
            "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Front Door",
            "text": "Geo-filter traffic by using the Azure Front Door WAF. Allow traffic only from expected regions, and block traffic from other regions.",
            "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Front Door",
            "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Front Door WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.",
            "guid": "00acd8a9-6975-414f-8491-2be6309893b8",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Governance",
            "text": "Leverage Azure Policy",
            "guid": "5c986cb2-9131-456a-8247-6e49f541acdc",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Governance",
            "text": "Identify required Azure tags and use the append policy mode to enforce usage.",
            "guid": "e979377b-cdb3-4751-ab2a-b13ada6e55d7",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/naming-and-tagging"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Governance",
            "text": "Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.",
            "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Governance",
            "text": "Establish Azure Policy definitions at the top-level root management group so that they can be assigned at inherited scopes",
            "guid": "223ace8c-b123-408c-a501-7f154e3ab369",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Governance",
            "text": "Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required",
            "guid": "3829e7e3-1618-4368-9a04-77a209945bda",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Governance",
            "text": "Use Azure Policy to control which services users can provision at the subscription/management group level",
            "guid": "43334f24-9116-4341-a2ba-527526944008",
            "severity": "Low",
            "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Governance",
            "text": "Use built-in policies where possible to minimize operational overhead.",
            "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Governance",
            "text": "Assign the built-in Policy Contributor role at a particular scope to enable application-level governance.",
            "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Governance",
            "text": "Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.",
            "guid": "19048384-5c98-46cb-8913-156a12476e49",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/governance/policy/overview"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Governance",
            "text": "Use Azure policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.",
            "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Governance",
            "text": "Consider using automation tags to start/stop VM's in your environment to save on cost.",
            "guid": "9b5e2a28-9823-4faf-ab7e-afa5f6c57221",
            "severity": "Medium",
            "link": "Configure Azure Automation Start/Stop VMs during off-hours | Microsoft Learn"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Governance",
            "text": "Monitor VM security configuration drift via Azure Policy.",
            "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Secrets",
            "text": "Use Azure Key Vault to store your secrets and credentials",
            "guid": "5017f154-e3ab-4369-9829-e7e316183687",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/key-vault/general/overview"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Secrets",
            "text": "Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.",
            "guid": "a0477a20-9945-4bda-9333-4f2491163418",
            "severity": "Medium",
            "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)",
            "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Secrets",
            "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.",
            "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Secrets",
            "text": "Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Azure Active Directory (Azure AD) roles.",
            "guid": "dc055bcf-619e-48a1-9f98-879525d62688",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Secrets",
            "text": "Automate the certificate management and renewal process with public certificate authorities to ease administration.",
            "guid": "6d70ba6c-97be-4995-8904-83845c986cb2",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Secrets",
            "text": "Establish an automated process for key and certificate rotation.",
            "guid": "913156a1-2476-4e49-b541-acdce979377b",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Secrets",
            "text": "Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.",
            "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Secrets",
            "text": "Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.",
            "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Secrets",
            "text": "Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.",
            "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Secrets",
            "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.",
            "guid": "16183687-a047-47a2-8994-5bda43334f24",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/security/fundamentals/encryption-atrest"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Secrets",
            "text": "Use an Azure Key Vault per application per environment per region.",
            "guid": "91163418-2ba5-4275-8694-4008be7d7e48",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Secrets",
            "text": "If you want to bring your own keys, this might not be supported across all considered services. Implement relevant mitigation so that inconsistencies don't hinder desired outcomes. Choose appropriate region pairs and disaster recovery regions that minimize latency.",
            "guid": "25d62688-6d70-4ba6-a97b-e99519048384",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Security",
            "text": "Use Azure AD reporting capabilities to generate access control audit reports.",
            "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Security",
            "text": "Export Azure activity logs to Azure Monitor Logs for long-term data retention. Export to Azure Storage for long-term storage beyond two years, if necessary.",
            "guid": "4e3ab369-3829-4e7e-9161-83687a0477a2",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-data-export?tabs=portal"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Security",
            "text": "Enable Defender for Cloud Standard for all subscriptions.",
            "guid": "09945bda-4333-44f2-9911-634182ba5275",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/security-center/"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Security",
            "text": "Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.",
            "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/security-center/"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Security",
            "text": "Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.",
            "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Security",
            "text": "Determine the incident response plan for Azure services before allowing it into production.",
            "guid": "b86ad884-08e3-4727-94b8-75ba18f20459",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Security",
            "text": "Implement a zero-trust approach for access to the Azure platform, where appropriate.",
            "guid": "01365d38-e43f-49cc-ad86-8266abca264f",
            "severity": "Medium",
            "link": "https://www.microsoft.com/security/business/zero-trust"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Security",
            "text": "Plan how new azure services will be implemented",
            "guid": "9a19bf39-c95d-444c-9c89-19ca1f6d5215",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework"
        },
        {
            "category": "Security, Governance and Compliance",
            "subcategory": "Security",
            "text": "Plan how service request will be fulfilled for Azure services",
            "guid": "ae514b93-3d45-485e-8112-9bd7ba012f7b",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework"
        },
        {
            "category": "Security, Governance and Compliance ",
            "subcategory": "Governance",
            "text": "It is recommended to follow Microsoft Best Practice Naming Standards",
            "guid": "cacf55bc-e4e4-46be-96bc-57a5f23a269a",
            "severity": "High",
            "link": "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/resource-naming"
        },
        {
            "category": "Security, Governance and Compliance ",
            "subcategory": "Security",
            "text": "Secure transfer to storage accounts should be enabled",
            "guid": "b03ed428-4617-4067-a787-85468b9ccf3f",
            "severity": "High",
            "link": "https://learn.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer"
        },
        {
            "category": "Security, Governance and Compliance ",
            "subcategory": "Security",
            "text": "Enable container soft delete for the storage account to recover a deleted container and its contents.",
            "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e",
            "severity": "High",
            "link": "https://learn.microsoft.com/en-us/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection"
        }
    ],
    "categories": [
        {
            "name": "Identity and Access"
        },
        {
            "name": "Network Topology and Connectivity"
        },
        {
            "name": "Security, Governance and Compliance"
        },
        {
            "name": "Management and Monitoring"
        },
        {
            "name": "Management Group and Subscriptions"
        },
        {
            "name": "Operations"
        },
        {
            "name": "Backup and Disaster Recovery"
        }
    ],
    "status": [
        {
            "name": "Not verified",
            "description": "This check has not been looked at yet"
        },
        {
            "name": "Open",
            "description": "There is an action item associated to this check"
        },
        {
            "name": "Fulfilled",
            "description": "This check has been verified, and there are no further action items associated to it"
        },
        {
            "name": "Not required",
            "description": "Recommendation understood, but not needed by current requirements"
        },
        {
            "name": "N/A",
            "description": "Not applicable for current design"
        }
    ],
    "severities": [
        {
            "name": "High"
        },
        {
            "name": "Medium"
        },
        {
            "name": "Low"
        }
    ],
    "metadata": {
        "name": "Azure Landing Zone Review",
        "state": "GA",
        "timestamp": "March 16, 2023"
    }
}
checklists/eh_security_checklist.pt.json METASEP
{
    "categories": [
        {
            "name": "Segurança"
        }
    ],
    "items": [
        {
            "category": "Segurança",
            "description": "O Hub de Eventos do Azure fornece criptografia de dados em repouso. Se você usar sua própria chave, os dados ainda serão criptografados usando a chave gerenciada pela Microsoft, mas, além disso, a chave gerenciada pela Microsoft será criptografada usando a chave gerenciada pelo cliente. ",
            "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
            "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
            "severity": "Baixo",
            "subcategory": "Proteção de Dados",
            "text": "Usar a opção de chave gerenciada pelo cliente na criptografia de dados em repouso quando necessário",
            "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/"
        },
        {
            "category": "Segurança",
            "description": "Os namespaces dos Hubs de Eventos do Azure permitem que os clientes enviem e recebam dados com o TLS 1.0 e superior. Para impor medidas de segurança mais rigorosas, você pode configurar o namespace dos Hubs de Eventos para exigir que os clientes enviem e recebam dados com uma versão mais recente do TLS. Se um namespace de Hubs de Eventos exigir uma versão mínima do TLS, todas as solicitações feitas com uma versão mais antiga falharão. ",
            "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
            "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
            "severity": "Média",
            "subcategory": "Proteção de Dados",
            "text": "Impor uma versão mínima necessária do Transport Layer Security (TLS) para solicitações ",
            "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/"
        },
        {
            "category": "Segurança",
            "description": "Quando você cria um namespace de Hubs de Eventos, uma regra de política chamada RootManageSharedAccessKey é criada automaticamente para o namespace. Essa política tem permissões de gerenciamento para todo o namespace. É recomendável que você trate essa regra como uma conta raiz administrativa e não a use em seu aplicativo. Recomenda-se o uso do AAD como um provedor de autenticação com RBAC. ",
            "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
            "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
            "severity": "Média",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "Evite usar a conta root quando não for necessário",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/"
        },
        {
            "category": "Segurança",
            "description": "As identidades gerenciadas para recursos do Azure podem autorizar o acesso aos recursos dos Hubs de Eventos usando credenciais do Azure AD de aplicativos em execução em VMs (Máquinas Virtuais) do Azure, aplicativos de Função, Conjuntos de Escala de Máquina Virtual e outros serviços. Usando identidades gerenciadas para recursos do Azure junto com a autenticação do Azure AD, você pode evitar o armazenamento de credenciais com seus aplicativos executados na nuvem. ",
            "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
            "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
            "severity": "Média",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "Quando possível, seu aplicativo deve estar usando uma identidade gerenciada para autenticar no Hub de Eventos do Azure. Caso contrário, considere ter a credencial de armazenamento (SAS, credencial da entidade de serviço) no Cofre da Chave do Azure ou em um serviço equivalente",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "Segurança",
            "description": "Ao criar permissões, forneça controle refinado sobre o acesso de um cliente ao Hub de Eventos do Azure. As permissões no Hub de Eventos do Azure podem e devem ter como escopo o nível de recurso individual, por exemplo, grupo de consumidores, entidade do hub de eventos, namespaces do hub de eventos, etc.",
            "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
            "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
            "severity": "Alto",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "Usar RBAC do plano de dados de privilégios mínimos",
            "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/"
        },
        {
            "category": "Segurança",
            "description": "Os logs de recursos do Hub de Eventos do Azure incluem logs operacionais, rede virtual e logs do Kafka. Os logs de auditoria de tempo de execução capturam informações de diagnóstico agregadas para todas as operações de acesso ao plano de dados (como eventos de envio ou recebimento) em Hubs de Eventos.",
            "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
            "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Habilite o log para investigação de segurança. Usar o Azure Monitor para capturar métricas e logs, como logs de recursos, logs de auditoria de tempo de execução e logs do Kafka",
            "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/"
        },
        {
            "category": "Segurança",
            "description": "O Hub de Eventos do Azure, por padrão, tem um endereço IP público e pode ser acessado pela Internet. Os pontos de extremidade privados permitem que o tráfego entre sua rede virtual e o Hub de Eventos do Azure percorra a rede de backbone da Microsoft. Além disso, você deve desabilitar pontos de extremidade públicos se eles não forem usados. ",
            "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
            "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
            "severity": "Média",
            "subcategory": "Rede",
            "text": "Considere o uso de pontos de extremidade privados para acessar o Hub de Eventos do Azure e desabilitar o acesso à rede pública, quando aplicável.",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "Segurança",
            "description": "Com o firewall IP, você pode restringir ainda mais o ponto de extremidade público a apenas um conjunto de endereços IPv4 ou intervalos de endereços IPv4 na notação CIDR (Roteamento entre Domínios Sem Classe). ",
            "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
            "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
            "severity": "Média",
            "subcategory": "Rede",
            "text": "Considere permitir apenas o acesso ao namespace do Hub de Eventos do Azure a partir de endereços IP ou intervalos específicos",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        }
    ],
    "metadata": {
        "name": "Azure Event Hub Review"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Média"
        },
        {
            "name": "Baixo"
        }
    ],
    "status": [
        {
            "description": "Esta verificação ainda não foi analisada",
            "name": "Não verificado"
        },
        {
            "description": "Há um item de ação associado a essa verificação",
            "name": "Abrir"
        },
        {
            "description": "Essa verificação foi verificada e não há mais itens de ação associados a ela",
            "name": "Cumprido"
        },
        {
            "description": "Recomendação entendida, mas não necessária pelos requisitos atuais",
            "name": "Não é necessário"
        },
        {
            "description": "Não aplicável ao projeto atual",
            "name": "N/A"
        }
    ]
}
checklists/eh_security_checklist.ko.json METASEP
{
    "categories": [
        {
            "name": "안전"
        }
    ],
    "items": [
        {
            "category": "안전",
            "description": "Azure 이벤트 허브는 미사용 데이터의 암호화를 제공합니다. 사용자 고유의 키를 사용하는 경우 데이터는 여전히 Microsoft 관리형 키를 사용하여 암호화되지만 Microsoft 관리형 키는 고객 관리형 키를 사용하여 암호화됩니다. ",
            "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
            "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
            "severity": "낮다",
            "subcategory": "데이터 보호",
            "text": "필요한 경우 미사용 데이터 암호화에서 고객 관리형 키 옵션 사용",
            "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/"
        },
        {
            "category": "안전",
            "description": "Azure 이벤트 허브 네임스페이스를 사용하면 클라이언트가 TLS 1.0 이상을 사용하여 데이터를 보내고 받을 수 있습니다. 더 엄격한 보안 조치를 적용하려면 클라이언트가 최신 버전의 TLS를 사용하여 데이터를 보내고 받도록 요구하도록 Event Hubs 네임스페이스를 구성할 수 있습니다. Event Hubs 네임스페이스에 최소 버전의 TLS가 필요한 경우 이전 버전으로 수행된 모든 요청이 실패합니다. ",
            "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
            "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
            "severity": "보통",
            "subcategory": "데이터 보호",
            "text": "요청에 필요한 최소 버전의 TLS(전송 계층 보안) 적용 ",
            "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/"
        },
        {
            "category": "안전",
            "description": "Event Hubs 네임스페이스를 만들면 네임스페이스에 대해 RootManageSharedAccessKey라는 정책 규칙이 자동으로 만들어집니다. 이 정책에는 전체 네임스페이스에 대한 관리 권한이 있습니다. 이 규칙을 관리 루트 계정처럼 취급하고 애플리케이션에서 사용하지 않는 것이 좋습니다. AAD를 RBAC와 함께 인증 공급자로 사용하는 것이 좋습니다. ",
            "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
            "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
            "severity": "보통",
            "subcategory": "ID 및 액세스 관리",
            "text": "필요하지 않은 경우 루트 계정을 사용하지 마십시오.",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/"
        },
        {
            "category": "안전",
            "description": "Azure 리소스에 대한 관리 ID는 Azure VM(가상 머신), 함수 앱, 가상 머신 확장 집합 및 기타 서비스에서 실행되는 애플리케이션의 Azure AD 자격 증명을 사용하여 Event Hubs 리소스에 대한 액세스 권한을 부여할 수 있습니다. Azure AD 인증과 함께 Azure 리소스에 대한 관리 ID를 사용하면 클라우드에서 실행되는 애플리케이션에 자격 증명을 저장하지 않아도 됩니다. ",
            "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
            "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
            "severity": "보통",
            "subcategory": "ID 및 액세스 관리",
            "text": "가능한 경우 애플리케이션은 관리 ID를 사용하여 Azure 이벤트 허브에 인증해야 합니다. 그렇지 않은 경우 Azure Key Vault 또는 이와 동등한 서비스에 스토리지 자격 증명(SAS, 서비스 주체 자격 증명)이 있는 것이 좋습니다.",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "안전",
            "description": "사용 권한을 만들 때 Azure 이벤트 허브에 대한 클라이언트의 액세스에 대한 세분화된 제어를 제공합니다. Azure Event Hub의 사용 권한은 개별 리소스 수준(예: 소비자 그룹, 이벤트 허브 엔터티, 이벤트 허브 네임스페이스 등)으로 범위를 지정할 수 있고 지정해야 합니다.",
            "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
            "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
            "severity": "높다",
            "subcategory": "ID 및 액세스 관리",
            "text": "최소 권한 데이터부 RBAC 사용",
            "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/"
        },
        {
            "category": "안전",
            "description": "Azure 이벤트 허브 리소스 로그에는 작업 로그, 가상 네트워크 및 Kafka 로그가 포함됩니다. 런타임 감사 로그는 Event Hubs의 모든 데이터 평면 액세스 작업(예: 이벤트 보내기 또는 받기)에 대한 집계된 진단 정보를 캡처합니다.",
            "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
            "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "보안 조사를 위해 로깅을 사용하도록 설정합니다. Azure Monitor를 사용하여 캡처된 메트릭 및 로그(예: 리소스 로그, 런타임 감사 로그 및 Kafka 로그)를 사용합니다.",
            "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/"
        },
        {
            "category": "안전",
            "description": "Azure 이벤트 허브는 기본적으로 공용 IP 주소를 가지며 인터넷에 연결할 수 있습니다. 프라이빗 엔드포인트는 가상 네트워크와 Azure 이벤트 허브 간의 트래픽이 Microsoft 백본 네트워크를 통과하도록 허용합니다. 그 외에도 퍼블릭 엔드포인트를 사용하지 않는 경우 비활성화해야 합니다. ",
            "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
            "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
            "severity": "보통",
            "subcategory": "네트워킹",
            "text": "프라이빗 엔드포인트를 사용하여 Azure Event Hub에 액세스하고 해당하는 경우 공용 네트워크 액세스를 사용하지 않도록 설정하는 것이 좋습니다.",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "안전",
            "description": "IP 방화벽을 사용하면 퍼블릭 엔드포인트를 CIDR(클래스 없는 도메인 간 라우팅) 표기법의 IPv4 주소 집합 또는 IPv4 주소 범위로만 추가로 제한할 수 있습니다. ",
            "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
            "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
            "severity": "보통",
            "subcategory": "네트워킹",
            "text": "특정 IP 주소 또는 범위에서 Azure 이벤트 허브 네임스페이스에 대한 액세스만 허용하는 것이 좋습니다.",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        }
    ],
    "metadata": {
        "name": "Azure Event Hub Review"
    },
    "severities": [
        {
            "name": "높다"
        },
        {
            "name": "보통"
        },
        {
            "name": "낮다"
        }
    ],
    "status": [
        {
            "description": "이 검사는 아직 검토되지 않았습니다.",
            "name": "확인되지 않음"
        },
        {
            "description": "이 검사와 연결된 작업 항목이 있습니다.",
            "name": "열다"
        },
        {
            "description": "이 검사가 확인되었으며 연결된 추가 작업 항목이 없습니다.",
            "name": "성취"
        },
        {
            "description": "권장 사항을 이해했지만 현재 요구 사항에서 필요하지 않음",
            "name": "필요하지 않음"
        },
        {
            "description": "현재 디자인에는 적용되지 않음",
            "name": "해당 없음"
        }
    ]
}
checklists/eh_security_checklist.ja.json METASEP
{
    "categories": [
        {
            "name": "安全"
        }
    ],
    "items": [
        {
            "category": "安全",
            "description": "Azure イベント ハブでは、保存データの暗号化が提供されます。独自のキーを使用する場合、データは引き続き Microsoft マネージド キーを使用して暗号化されますが、さらに Microsoft マネージド キーはカスタマー マネージド キーを使用して暗号化されます。",
            "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
            "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
            "severity": "低い",
            "subcategory": "データ保護",
            "text": "必要に応じて、保存データの暗号化でカスタマー マネージド キー オプションを使用する",
            "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/"
        },
        {
            "category": "安全",
            "description": "Azure Event Hubs 名前空間を使用すると、クライアントは TLS 1.0 以降を使用してデータを送受信できます。より厳格なセキュリティ対策を適用するには、クライアントが新しいバージョンの TLS を使用してデータを送受信することを要求するように Event Hubs 名前空間を構成できます。Event Hubs 名前空間で最小バージョンの TLS が必要な場合、古いバージョンで行われた要求はすべて失敗します。",
            "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
            "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
            "severity": "中程度",
            "subcategory": "データ保護",
            "text": "要求に最低限必要なバージョンのトランスポート層セキュリティ (TLS) を適用する",
            "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/"
        },
        {
            "category": "安全",
            "description": "Event Hubs 名前空間を作成すると、その名前空間に対して RootManageSharedAccessKey という名前のポリシー規則が自動的に作成されます。このポリシーには、名前空間全体に対する管理アクセス許可があります。このルールは管理ルートアカウントのように扱い、アプリケーションでは使用しないことをお勧めします。RBAC で認証プロバイダーとして AAD を使用することをお勧めします。",
            "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
            "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
            "severity": "中程度",
            "subcategory": "ID およびアクセス管理",
            "text": "不要な場合はrootアカウントを使用しないでください",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/"
        },
        {
            "category": "安全",
            "description": "Azure リソースのマネージド ID では、Azure 仮想マシン (VM)、関数アプリ、仮想マシン スケール セット、およびその他のサービスで実行されているアプリケーションから Azure AD 資格情報を使用して、Event Hubs リソースへのアクセスを承認できます。Azure リソースのマネージド ID を Azure AD 認証と共に使用することで、クラウドで実行されるアプリケーションに資格情報を格納する必要がなくなります。",
            "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
            "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
            "severity": "中程度",
            "subcategory": "ID およびアクセス管理",
            "text": "可能であれば、アプリケーションはマネージド ID を使用して Azure Event Hub に対する認証を行う必要があります。そうでない場合は、ストレージ資格情報 (SAS、サービス プリンシパル資格情報) を Azure Key Vault または同等のサービスに配置することを検討してください。",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "安全",
            "description": "アクセス許可を作成するときに、Azure Event Hub へのクライアントのアクセスをきめ細かく制御できるようにします。Azure Event Hub のアクセス許可は、コンシューマー グループ、イベント ハブ エンティティ、イベント ハブ名前空間など、個々のリソース レベルにスコープを設定することができ、またそうする必要があります。",
            "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
            "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
            "severity": "高い",
            "subcategory": "ID およびアクセス管理",
            "text": "最小特権データ プレーン RBAC を使用する",
            "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/"
        },
        {
            "category": "安全",
            "description": "Azure イベント ハブ リソース ログには、操作ログ、仮想ネットワーク、Kafka ログが含まれます。ランタイム監査ログは、Event Hubs 内のすべてのデータ プレーン アクセス操作 (送信イベントや受信イベントなど) の集計された診断情報をキャプチャします。",
            "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
            "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "セキュリティ調査のログ記録を有効にします。Azure Monitor を使用して、リソース ログ、ランタイム監査ログ、Kafka ログなどのメトリックとログをキャプチャする",
            "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/"
        },
        {
            "category": "安全",
            "description": "Azure イベント ハブには既定でパブリック IP アドレスがあり、インターネットでアクセスできます。プライベート エンドポイントを使用すると、仮想ネットワークと Azure イベント ハブ間のトラフィックが Microsoft バックボーン ネットワーク経由で通過できます。それに加えて、パブリックエンドポイントが使用されていない場合は無効にする必要があります。",
            "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
            "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
            "severity": "中程度",
            "subcategory": "ネットワーキング",
            "text": "プライベート エンドポイントを使用して Azure Event Hub にアクセスし、該当する場合はパブリック ネットワーク アクセスを無効にすることを検討してください。",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "安全",
            "description": "IP ファイアウォールを使用すると、パブリック エンドポイントを IPv4 アドレスのセットまたは CIDR (クラスレス ドメイン間ルーティング) 表記の IPv4 アドレス範囲のみに制限できます。",
            "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
            "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
            "severity": "中程度",
            "subcategory": "ネットワーキング",
            "text": "特定の IP アドレスまたは範囲からの Azure イベント ハブ名前空間へのアクセスのみを許可することを検討してください",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        }
    ],
    "metadata": {
        "name": "Azure Event Hub Review"
    },
    "severities": [
        {
            "name": "高い"
        },
        {
            "name": "中程度"
        },
        {
            "name": "低い"
        }
    ],
    "status": [
        {
            "description": "このチェックはまだ確認されていません",
            "name": "未確認"
        },
        {
            "description": "このチェックに関連付けられているアクションアイテムがあります",
            "name": "開ける"
        },
        {
            "description": "このチェックは検証済みであり、それ以上のアクションアイテムは関連付けられていません",
            "name": "達成"
        },
        {
            "description": "推奨事項は理解されていますが、現在の要件では必要ありません",
            "name": "必須ではありません"
        },
        {
            "description": "現在のデザインには適用できません",
            "name": "該当なし"
        }
    ]
}
checklists/eh_security_checklist.es.json METASEP
{
    "categories": [
        {
            "name": "Seguridad"
        }
    ],
    "items": [
        {
            "category": "Seguridad",
            "description": "Azure Event Hub proporciona cifrado de datos en reposo. Si usa su propia clave, los datos aún se cifran con la clave administrada por Microsoft, pero además la clave administrada por Microsoft se cifrará con la clave administrada por el cliente. ",
            "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
            "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key",
            "severity": "Bajo",
            "subcategory": "Protección de datos",
            "text": "Usar la opción de clave administrada por el cliente en el cifrado de datos en reposo cuando sea necesario",
            "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/"
        },
        {
            "category": "Seguridad",
            "description": "Los espacios de nombres de Azure Event Hubs permiten a los clientes enviar y recibir datos con TLS 1.0 y versiones posteriores. Para aplicar medidas de seguridad más estrictas, puede configurar el espacio de nombres de Centros de eventos para que requiera que los clientes envíen y reciban datos con una versión más reciente de TLS. Si un espacio de nombres de Centros de eventos requiere una versión mínima de TLS, se producirá un error en las solicitudes realizadas con una versión anterior. ",
            "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
            "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version",
            "severity": "Medio",
            "subcategory": "Protección de datos",
            "text": "Aplicar una versión mínima requerida de Seguridad de la capa de transporte (TLS) para las solicitudes ",
            "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/"
        },
        {
            "category": "Seguridad",
            "description": "Al crear un espacio de nombres de Centros de eventos, se crea automáticamente una regla de directiva denominada RootManageSharedAccessKey para el espacio de nombres. Esta directiva tiene permisos de administración para todo el espacio de nombres. Se recomienda tratar esta regla como una cuenta raíz administrativa y no usarla en la aplicación. Se recomienda usar AAD como proveedor de autenticación con RBAC. ",
            "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
            "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies",
            "severity": "Medio",
            "subcategory": "Gestión de identidades y accesos",
            "text": "Evite usar una cuenta root cuando no sea necesario",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/"
        },
        {
            "category": "Seguridad",
            "description": "Las identidades administradas para los recursos de Azure pueden autorizar el acceso a los recursos de Centros de eventos mediante credenciales de Azure AD desde aplicaciones que se ejecutan en máquinas virtuales (VM), aplicaciones de función, conjuntos de escalado de máquinas virtuales y otros servicios. Mediante el uso de identidades administradas para recursos de Azure junto con la autenticación de Azure AD, puede evitar almacenar credenciales con las aplicaciones que se ejecutan en la nube. ",
            "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
            "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest",
            "severity": "Medio",
            "subcategory": "Gestión de identidades y accesos",
            "text": "Siempre que sea posible, la aplicación debe usar una identidad administrada para autenticarse en Azure Event Hub. Si no es así, considere la posibilidad de tener la credencial de almacenamiento (SAS, credencial de entidad de servicio) en Azure Key Vault o un servicio equivalente",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "Seguridad",
            "description": "Al crear permisos, proporcione un control detallado sobre el acceso de un cliente a Azure Event Hub. Los permisos en Azure Event Hub pueden y deben limitarse al nivel de recurso individual, por ejemplo, grupo de consumidores, entidad de centro de eventos, espacios de nombres de centros de eventos, etc.",
            "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
            "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs",
            "severity": "Alto",
            "subcategory": "Gestión de identidades y accesos",
            "text": "Usar RBAC del plano de datos con privilegios mínimos",
            "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/"
        },
        {
            "category": "Seguridad",
            "description": "Los registros de recursos de Azure Event Hub incluyen registros operativos, registros de red virtual y registros de Kafka. Los registros de auditoría en tiempo de ejecución capturan información de diagnóstico agregada para todas las operaciones de acceso al plano de datos (como eventos de envío o recepción) en Centros de eventos.",
            "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
            "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Habilite el registro para la investigación de seguridad. Use Azure Monitor para capturar métricas y registros, como registros de recursos, registros de auditoría en tiempo de ejecución y registros de Kafka",
            "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/"
        },
        {
            "category": "Seguridad",
            "description": "De forma predeterminada, Azure Event Hub tiene una dirección IP pública y es accesible desde Internet. Los puntos de conexión privados permiten que el tráfico entre la red virtual y Azure Event Hub atraviese la red troncal de Microsoft. Además de eso, debe deshabilitar los puntos finales públicos si no se usan. ",
            "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
            "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service",
            "severity": "Medio",
            "subcategory": "Gestión de redes",
            "text": "Considere la posibilidad de usar puntos de conexión privados para acceder a Azure Event Hub y deshabilitar el acceso a la red pública cuando corresponda.",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "Seguridad",
            "description": "Con el firewall IP, puede restringir el punto final público a solo un conjunto de direcciones IPv4 o rangos de direcciones IPv4 en notación CIDR (enrutamiento entre dominios sin clases). ",
            "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
            "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering",
            "severity": "Medio",
            "subcategory": "Gestión de redes",
            "text": "Considere la posibilidad de permitir solo el acceso al espacio de nombres de Azure Event Hub desde direcciones IP o intervalos específicos",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        }
    ],
    "metadata": {
        "name": "Azure Event Hub Review"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Medio"
        },
        {
            "name": "Bajo"
        }
    ],
    "status": [
        {
            "description": "Esta comprobación aún no se ha examinado",
            "name": "No verificado"
        },
        {
            "description": "Hay un elemento de acción asociado a esta comprobación",
            "name": "Abrir"
        },
        {
            "description": "Esta comprobación se ha comprobado y no hay más elementos de acción asociados a ella",
            "name": "Cumplido"
        },
        {
            "description": "Recomendación entendida, pero no necesaria por los requisitos actuales",
            "name": "No es necesario"
        },
        {
            "description": "No aplicable para el diseño actual",
            "name": "N/A"
        }
    ]
}
checklists/eh_security_checklist.en.json METASEP
{
    "items": [
        {
            "category": "Security",
            "subcategory": "Data Protection",
            "text": "Use customer-managed key option in data at rest encryption when required",
            "description": "Azure Event Hub provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
            "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6",
            "severity": "Low",
            "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
            "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key"
        },
        {
            "category": "Security",
            "subcategory": "Data Protection",
            "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
            "description": "Azure Event Hubs namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Event Hubs namespace to require that clients send and receive data with a newer version of TLS. If an Event Hubs namespace requires a minimum version of TLS, then any requests made with an older version will fail. ",
            "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
            "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Management",
            "text": "Avoid using root account when it is not necessary",
            "description": "When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has manage permissions for the entire namespace. It\u2019s recommended that you treat this rule like an administrative root account and don\u2019t use it in your application. Using AAD as an authentication provider with RBAC is recommended. ",
            "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
            "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Management",
            "text": "When possible, your application should be using a managed identity to authenticate to Azure Event Hub. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service",
            "description": "Managed identities for Azure resources can authorize access to Event Hubs resources using Azure AD credentials from applications running in Azure Virtual Machines (VMs), Function apps, Virtual Machine Scale Sets, and other services. By using managed identities for Azure resources together with Azure AD authentication, you can avoid storing credentials with your applications that run in the cloud. ",
            "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
            "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Management",
            "text": "Use least privilege data plane RBAC",
            "description": "When creating permissions, provide fine-grained control over a client's access to Azure Event Hub. Permissions in Azure Event Hub can and should be scoped to the individual resource level e.g. consumer group, event hub entity, event hub namespaces, etc.",
            "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2",
            "severity": "High",
            "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
            "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs"
        },
        {
            "category": "Security",
            "subcategory": "Monitoring",
            "text": "Enable logging for security investigation. Use Azure Monitor to captured metrics and logs such as resource logs, runtime audit logs and Kafka logs",
            "description": "Azure Event Hub resource logs include operational logs, virtual network and Kafka logs. Runtime audit logs capture aggregated diagnostic information for all data plane access operations (such as send or receive events) in Event Hubs.",
            "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
            "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference"
        },
        {
            "category": "Security",
            "subcategory": "Networking",
            "text": "Consider using private endpoints to access Azure Event Hub and disable public network access when applicable.",
            "description": "Azure Event Hub by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Event Hub traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
            "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
            "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service"
        },
        {
            "category": "Security",
            "subcategory": "Networking",
            "text": "Consider only allowing access to Azure Event Hub namespace from specific IP addresses or ranges",
            "description": "With IP firewall, you can restrict public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
            "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
            "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering"
        }
    ],
    "categories": [
        {
            "name": "Security"
        }
    ],
    "status": [
        {
            "name": "Not verified",
            "description": "This check has not been looked at yet"
        },
        {
            "name": "Open",
            "description": "There is an action item associated to this check"
        },
        {
            "name": "Fulfilled",
            "description": "This check has been verified, and there are no further action items associated to it"
        },
        {
            "name": "Not required",
            "description": "Recommendation understood, but not needed by current requirements"
        },
        {
            "name": "N/A",
            "description": "Not applicable for current design"
        }
    ],
    "severities": [
        {
            "name": "High"
        },
        {
            "name": "Medium"
        },
        {
            "name": "Low"
        }
    ],
    "metadata": {
        "name": "Azure Event Hub Review",
        "timestamp": "Feb 13, 2023",
        "state": "Preview"
    }
}
checklists/checklist.schema.json METASEP
{
    "$schema": "http://json-schema.org/draft-07/schema#",
    "$id": "https://github.com/Azure/review-checklists/checklist.schema.json",
    "title": "Review Checklist",
    "type": "object",
    "properties": {
        "items": {
            "type": "array",
            "description": "The recommendations that make up the checklist.",
            "items": {
                "type": "object",
                "additionalProperties": false,
                "properties": {
                    "category": {
                        "type": "string",
                        "description": "The main category this recommendation applies to."
                    },
                    "subcategory": {
                        "type": "string",
                        "description": "The subcategory this recommendation applies to."
                    },
                    "text": {
                        "type": "string",
                        "description": "A short summary of the recommendation."
                    },
                    "description": {
                        "type": "string",
                        "description": "A long description or additional information for the recommendation."
                    },
                    "guid": {
                        "type": "string",
                        "description": "A unique GUID for the recommendation."
                    },
                    "link": {
                        "type": "string",
                        "description": "A link to documentation that provides more information or background."
                    },
                    "training": {
                        "type": "string",
                        "description": "A link to a training resource where you can learn more."
                    },
                    "graph": {
                        "type": "string",
                        "description": "An Azure Resource Graph query which checks if resources comply with the recommendation."
                    },
                    "graph_success": {
                        "type": "string",
                        "description": "[OBSOLETE: use 'graph' instead.] An Azure Resource Graph query which identifies resources that comply with the recommendation."
                    },
                    "graph_failure": {
                        "type": "string",
                        "description": "[OBSOLETE: use 'graph' instead.] An Azure Resource Graph query which identifies resources that do not comply with the recommendation."
                    },
                    "severity": {
                        "type": "string",
                        "description": "The severity of the recommendation."
                    },
                    "cost": {
                        "type": "integer",
                        "description": "[EXPERIMENTAL] Documents the impact of this recommendation to the cost of a solution."
                    },
                    "ha": {
                        "type": "integer",
                        "description": "[EXPERIMENTAL] Documents the impact of this recommendation to the high availability of a solution."
                    },
                    "scale": {
                        "type": "integer",
                        "description": "[EXPERIMENTAL] Documents the impact of this recommendation to the scale of a solution."
                    },
                    "security": {
                        "type": "integer",
                        "description": "[EXPERIMENTAL] Documents the impact of this recommendation to the security of a solution."
                    },
                    "simple": {
                        "type": "integer",
                        "description": "[EXPERIMENTAL] Documents the impact of this recommendation to the complexity of a solution."
                    }
                },
                "required": [
                    "category",
                    "subcategory",
                    "text",
                    "guid",
                    "severity"
                ]
            }
        },
        "categories": {
            "type": "array",
            "description": "The available categories for the checklist items.",
            "items": {
                "type": "object",
                "additionalProperties": false,
                "properties": {
                    "name": {
                        "type": "string",
                        "description": "The name of the category."
                    }
                },
                "required": [ "name" ]
            }
        },
        "status": {
            "type": "array",
            "description": "The available statuses for the checklist items.",
            "items": {
                "type": "object",
                "additionalProperties": false,
                "properties": {
                    "name": {
                        "type": "string",
                        "description": "The name of the status."
                    },
                    "description": {
                        "type": "string",
                        "description": "The description of the status."
                    }
                },
                "required": [ "name" ]
            }
        },
        "severities": {
            "type": "array",
            "description": "The available severities for the checklist items.",
            "items": {
                "type": "object",
                "additionalProperties": false,
                "properties": {
                    "name": {
                        "type": "string",
                        "description": "The name of the severity."
                    }
                },
                "required": [ "name" ]
            }
        },
        "metadata": {
            "type": "object",
            "description": "The metadata for the checklist.",
            "additionalProperties": false,
            "properties": {
                "name": {
                    "type": "string",
                    "description": "The name of the checklist."
                },
                "timestamp": {
                    "type": "string",
                    "description": "Date/time when the checklist was last modified."
                },
                "state": {
                    "type": "string",
                    "description": "State of the checklist (GA/Preview)."
                }
            },
            "required": [ "name" ]
        }
    }
}
checklists/blob_storage_security_checklist.pt.json METASEP
{
    "categories": [
        {
            "name": "Segurança"
        }
    ],
    "items": [
        {
            "category": "Segurança",
            "description": "Aplicar orientações do benchmark de segurança de nuvem da Microsoft relacionadas ao Armazenamento",
            "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
            "severity": "Média",
            "subcategory": " Visão geral",
            "text": "Considere a 'Linha de base de segurança do Azure para armazenamento'"
        },
        {
            "category": "Segurança",
            "description": "O Armazenamento do Azure, por padrão, tem um endereço IP público e pode ser acessado pela Internet. Os pontos de extremidade privados permitem expor com segurança o Armazenamento do Azure somente aos recursos de Computação do Azure que precisam de acesso, eliminando assim a exposição à Internet pública",
            "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
            "severity": "Alto",
            "subcategory": "Rede",
            "text": "Considere o uso de pontos de extremidade privados para o Armazenamento do Azure"
        },
        {
            "category": "Segurança",
            "description": "As contas de armazenamento recém-criadas são criadas usando o modelo de implantação do ARM, para que o RBAC, a auditoria, etc., sejam todos habilitados. Verifique se não há contas de armazenamento antigas com o modelo de implantação clássico em uma assinatura",
            "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
            "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
            "severity": "Média",
            "subcategory": "Governança",
            "text": "Verifique se as contas de armazenamento mais antigas não estão usando o \"modelo de implantação clássico\""
        },
        {
            "category": "Segurança",
            "description": "Aproveite o Microsoft Defender para saber mais sobre atividades suspeitas e configurações incorretas.",
            "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
            "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
            "severity": "Alto",
            "subcategory": "Governança",
            "text": "Habilite o Microsoft Defender para todas as suas contas de armazenamento"
        },
        {
            "category": "Segurança",
            "description": "O mecanismo soft-delete permite recuperar blobs apagados acidentalmente.",
            "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
            "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
            "severity": "Média",
            "subcategory": "Disponibilidade de dados",
            "text": "Ativar 'exclusão suave' para blobs"
        },
        {
            "category": "Segurança",
            "description": "Considere desativar seletivamente a \"exclusão suave\" para determinados contêineres de blob, por exemplo, se o aplicativo precisar garantir que as informações excluídas sejam imediatamente excluídas, por exemplo, por razões de confidencialidade, privacidade ou conformidade. ",
            "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
            "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
            "severity": "Média",
            "subcategory": "Confidencialidade",
            "text": "Desativar 'exclusão suave' para blobs"
        },
        {
            "category": "Segurança",
            "description": "A exclusão suave para contêineres permite que você recupere um contêiner depois que ele tiver sido excluído, por exemplo, recupere de uma operação de exclusão acidental.",
            "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
            "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
            "severity": "Alto",
            "subcategory": "Disponibilidade de dados",
            "text": "Ativar 'exclusão suave' para contêineres"
        },
        {
            "category": "Segurança",
            "description": "Considere desativar seletivamente a \"exclusão suave\" para determinados contêineres de blob, por exemplo, se o aplicativo precisar garantir que as informações excluídas sejam imediatamente excluídas, por exemplo, por razões de confidencialidade, privacidade ou conformidade. ",
            "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
            "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
            "severity": "Média",
            "subcategory": "Confidencialidade",
            "text": "Desativar 'exclusão suave' para contêineres"
        },
        {
            "category": "Segurança",
            "description": "Impede a exclusão acidental de uma conta de armazenamento, forçando o usuário a primeiro remover o bloqueio de exclusão, antes da exclusão",
            "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
            "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
            "severity": "Alto",
            "subcategory": "Disponibilidade de dados",
            "text": "Habilitar bloqueios de recursos em contas de armazenamento"
        },
        {
            "category": "Segurança",
            "description": "Considere políticas de \"retenção legal\" ou \"retenção baseada em tempo\" para blobs, de modo que seja impossível excluir o blob, o contêiner ou a conta de armazenamento. Por favor, note que \"impossível\" na verdade significa \"impossível\"; uma vez que uma conta de armazenamento contém um blob imutável, a única maneira de \"se livrar\" dessa conta de armazenamento é cancelando a assinatura do Azure.",
            "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
            "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
            "severity": "Alto",
            "subcategory": "Disponibilidade de dados, conformidade",
            "text": "Considere blobs imutáveis"
        },
        {
            "category": "Segurança",
            "description": "Considere desabilitar o acesso HTTP/80 desprotegido à conta de armazenamento, para que todas as transferências de dados sejam criptografadas, a integridade protegida e o servidor seja autenticado. ",
            "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
            "severity": "Alto",
            "subcategory": "Rede",
            "text": "Exigir HTTPS, ou seja, desativar a porta 80 na conta de armazenamento"
        },
        {
            "category": "Segurança",
            "description": "Ao configurar um domínio personalizado (nome de host) em uma conta de armazenamento, verifique se você precisa de TLS/HTTPS; em caso afirmativo, talvez seja necessário colocar a CDN do Azure na frente de sua conta de armazenamento.",
            "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
            "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
            "severity": "Alto",
            "subcategory": "Rede",
            "text": "Ao impor HTTPS (desabilitando HTTP), verifique se você não usa domínios personalizados (CNAME) para a conta de armazenamento."
        },
        {
            "category": "Segurança",
            "description": "Exigir HTTPS quando um cliente usa um token SAS para acessar dados de blob ajuda a minimizar o risco de perda de credenciais.",
            "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
            "severity": "Média",
            "subcategory": "Rede",
            "text": "Limitar tokens de assinatura de acesso compartilhado (SAS) apenas a conexões HTTPS"
        },
        {
            "category": "Segurança",
            "description": "Os tokens AAD devem ser favorecidos em relação às assinaturas de acesso compartilhado, sempre que possível",
            "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
            "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
            "severity": "Alto",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "Usar tokens do Azure Active Directory (Azure AD) para acesso a blob"
        },
        {
            "category": "Segurança",
            "description": "Ao atribuir uma função a um usuário, grupo ou aplicativo, conceda a essa entidade de segurança apenas as permissões necessárias para que ela execute suas tarefas. Limitar o acesso a recursos ajuda a evitar o uso indevido não intencional e mal-intencionado de seus dados.",
            "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
            "severity": "Média",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "Privilégio mínimo em permissões do IaM"
        },
        {
            "category": "Segurança",
            "description": "Uma SAS de delegação de usuário é protegida com credenciais do Azure Active Directory (Azure AD) e também pelas permissões especificadas para a SAS. Um SAS de delegação de usuário é análogo a um SAS de serviço em termos de escopo e função, mas oferece benefícios de segurança sobre o SAS de serviço. ",
            "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
            "severity": "Alto",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "Ao usar o SAS, prefira o 'SAS de delegação do usuário' ao SAS baseado na chave da conta de armazenamento."
        },
        {
            "category": "Segurança",
            "description": "As chaves de conta de armazenamento (\"chaves compartilhadas\") têm muito poucos recursos de auditoria. Embora possa ser monitorado sobre quem / quando buscou uma cópia das chaves, uma vez que as chaves estão nas mãos de várias pessoas, é impossível atribuir o uso a um usuário específico. Depender exclusivamente da autenticação do AAD facilita a vinculação do acesso ao armazenamento a um usuário. ",
            "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
            "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
            "severity": "Alto",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "Considere desabilitar chaves de conta de armazenamento, para que apenas o acesso ao AAD (e a SAS de delegação de usuário) seja suportado."
        },
        {
            "category": "Segurança",
            "description": "Use os dados do Registro de atividades para identificar 'quando', 'quem', 'o que' e 'como' a segurança da sua conta de armazenamento está sendo visualizada ou alterada (ou seja, chaves de conta de armazenamento, políticas de acesso, etc.).",
            "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
            "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
            "severity": "Alto",
            "subcategory": "Monitorização",
            "text": "Considere o uso do Azure Monitor para auditar operações do plano de controle na conta de armazenamento"
        },
        {
            "category": "Segurança",
            "description": "Uma política de expiração de chave permite que você defina um lembrete para a rotação das chaves de acesso da conta. O lembrete será exibido se o intervalo especificado tiver decorrido e as chaves ainda não tiverem sido giradas.",
            "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
            "severity": "Média",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "Ao usar chaves de conta de armazenamento, considere habilitar uma \"política de expiração de chave\""
        },
        {
            "category": "Segurança",
            "description": "Uma política de expiração SAS especifica um intervalo recomendado durante o qual a SAS é válida. As políticas de expiração de SAS aplicam-se a uma SAS de serviço ou a uma SAS de conta. Quando um usuário gera SAS de serviço ou SAS de conta com um intervalo de validade maior que o intervalo recomendado, ele verá um aviso.",
            "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
            "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
            "severity": "Média",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "Considere configurar uma política de expiração SAS"
        },
        {
            "category": "Segurança",
            "description": "As políticas de acesso armazenado oferecem a opção de revogar permissões para uma SAS de serviço sem precisar regenerar as chaves da conta de armazenamento. ",
            "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
            "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
            "severity": "Média",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "Considere vincular o SAS a uma política de acesso armazenado"
        },
        {
            "category": "Segurança",
            "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
            "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
            "severity": "Média",
            "subcategory": "CI/CD",
            "text": "Considere configurar o repositório de código-fonte do aplicativo para detectar cadeias de conexão com check-in e chaves de conta de armazenamento."
        },
        {
            "category": "Segurança",
            "description": "Idealmente, seu aplicativo deve estar usando uma identidade gerenciada para autenticar no Armazenamento do Azure. Se isso não for possível, considere ter a credencial de armazenamento (cadeia de conexão, chave de conta de armazenamento, SAS, credencial de entidade de serviço) no Cofre de Chaves do Azure ou em um serviço equivalente.",
            "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
            "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
            "severity": "Alto",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "Considere armazenar cadeias de conexão no Cofre de Chaves do Azure (em cenários em que identidades gerenciadas não são possíveis)"
        },
        {
            "category": "Segurança",
            "description": "Use tempos de expiração de curto prazo em um SAS de serviço SAS ad hoc ou SAS de conta. Dessa forma, mesmo que um SAS seja comprometido, ele é válido apenas por um curto período de tempo. Essa prática é especialmente importante se você não puder fazer referência a uma política de acesso armazenada. Os tempos de expiração de curto prazo também limitam a quantidade de dados que podem ser gravados em um blob, limitando o tempo disponível para fazer o upload para ele.",
            "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
            "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
            "severity": "Alto",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "Esforce-se por curtos períodos de validade para SAS ad-hoc"
        },
        {
            "category": "Segurança",
            "description": "Ao criar um SAS, seja o mais específico e restritivo possível. Prefira um SAS para um único recurso e operação sobre um SAS que dá acesso muito mais amplo.",
            "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
            "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
            "severity": "Média",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "Aplicar um escopo restrito a uma SAS"
        },
        {
            "category": "Segurança",
            "description": "Uma SAS pode incluir parâmetros nos quais endereços IP do cliente ou intervalos de endereços estão autorizados a solicitar um recurso usando a SAS. ",
            "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
            "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
            "severity": "Média",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "Considere definir o escopo do SAS para um endereço IP de cliente específico, sempre que possível"
        },
        {
            "category": "Segurança",
            "description": "Um SAS não pode restringir a quantidade de dados que um cliente carrega; dado o modelo de preços da quantidade de armazenamento ao longo do tempo, pode fazer sentido validar se os clientes carregaram conteúdo maliciosamente grande.",
            "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
            "severity": "Baixo",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "Considere verificar os dados carregados, depois que os clientes usaram um SAS para carregar um arquivo. "
        },
        {
            "category": "Segurança",
            "description": "Ao acessar o armazenamento de blob via SFTP usando uma 'conta de usuário local', os controles RBAC 'usuais' não se aplicam. O acesso a Blobs via NFS ou REST pode ser mais restritivo do que o acesso SFTP. Infelizmente, a partir do início de 2023, os usuários locais são a única forma de gerenciamento de identidade atualmente suportada para o ponto de extremidade SFTP",
            "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
            "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
            "severity": "Alto",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "SFTP: Limite a quantidade de 'usuários locais' para acesso SFTP e audite se o acesso é necessário ao longo do tempo."
        },
        {
            "category": "Segurança",
            "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
            "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
            "severity": "Média",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "SFTP: O ponto de extremidade SFTP não oferece suporte a ACLs semelhantes a POSIX."
        },
        {
            "category": "Segurança",
            "description": "O armazenamento oferece suporte a CORS (Cross-Origin Resource Sharing), ou seja, um recurso HTTP que permite que aplicativos Web de um domínio diferente afrouxem a política de mesma origem. Ao habilitar o CORS, mantenha o CorsRules com o menor privilégio.",
            "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
            "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
            "severity": "Alto",
            "subcategory": "Rede",
            "text": "Evite políticas de CORS excessivamente amplas"
        },
        {
            "category": "Segurança",
            "description": "Os dados em repouso são sempre criptografados do lado do servidor e, além disso, também podem ser criptografados do lado do cliente. A criptografia do lado do servidor pode ocorrer usando uma chave gerenciada pela plataforma (padrão) ou uma chave gerenciada pelo cliente. A criptografia do lado do cliente pode acontecer fazendo com que o cliente forneça uma chave de criptografia/descriptografia por blob para o armazenamento do Azure ou manipulando completamente a criptografia no lado do cliente. portanto, não confiando no Armazenamento do Azure para garantias de confidencialidade.",
            "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
            "severity": "Alto",
            "subcategory": "Confidencialidade e criptografia",
            "text": "Determine como os dados em repouso devem ser criptografados. Entenda o modelo de thread para dados."
        },
        {
            "category": "Segurança",
            "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
            "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
            "severity": "Média",
            "subcategory": "Confidencialidade e criptografia",
            "text": "Determine qual/se a criptografia de plataforma deve ser usada."
        },
        {
            "category": "Segurança",
            "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
            "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
            "severity": "Média",
            "subcategory": "Confidencialidade e criptografia",
            "text": "Determine qual/se a criptografia do lado do cliente deve ser usada."
        },
        {
            "category": "Segurança",
            "description": "Aproveite o Resource Graph Explorer (recursos | onde o tipo == 'microsoft.storage/storageaccounts' | onde properties['allowBlobPublicAccess'] == true) para localizar contas de armazenamento que permitem acesso de blob anônimo.",
            "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
            "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
            "severity": "Alto",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "Considere se o acesso ao blob público é necessário ou se ele pode ser desabilitado para determinadas contas de armazenamento. "
        }
    ],
    "metadata": {
        "name": "Azure Blob Storage Review"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Média"
        },
        {
            "name": "Baixo"
        }
    ],
    "status": [
        {
            "description": "Esta verificação ainda não foi analisada",
            "name": "Não verificado"
        },
        {
            "description": "Há um item de ação associado a essa verificação",
            "name": "Abrir"
        },
        {
            "description": "Essa verificação foi verificada e não há mais itens de ação associados a ela",
            "name": "Cumprido"
        },
        {
            "description": "Não aplicável ao projeto atual",
            "name": "N/A"
        },
        {
            "description": "Não é necessário",
            "name": "Não é necessário"
        }
    ]
}
checklists/blob_storage_security_checklist.ko.json METASEP
{
    "categories": [
        {
            "name": "안전"
        }
    ],
    "items": [
        {
            "category": "안전",
            "description": "저장소와 관련된 Microsoft 클라우드 보안 벤치마크의 지침 적용",
            "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
            "severity": "보통",
            "subcategory": " 개요",
            "text": "'스토리지에 대한 Azure 보안 기준' 고려"
        },
        {
            "category": "안전",
            "description": "Azure 저장소는 기본적으로 공용 IP 주소를 가지며 인터넷에 연결할 수 있습니다. 프라이빗 엔드포인트를 사용하면 액세스가 필요한 Azure 계산 리소스에만 Azure 저장소를 안전하게 노출할 수 있으므로 공용 인터넷에 대한 노출을 제거할 수 있습니다.",
            "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
            "severity": "높다",
            "subcategory": "네트워킹",
            "text": "Azure 저장소에 프라이빗 엔드포인트를 사용하는 것이 좋습니다."
        },
        {
            "category": "안전",
            "description": "새로 만든 저장소 계정은 ARM 배포 모델을 사용하여 만들어지므로 RBAC, 감사 등을 모두 사용할 수 있습니다. 구독에 클래식 배포 모델을 사용하는 이전 저장소 계정이 없는지 확인",
            "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
            "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
            "severity": "보통",
            "subcategory": "거버넌스",
            "text": "이전 저장소 계정이 '클래식 배포 모델'을 사용하지 않는지 확인"
        },
        {
            "category": "안전",
            "description": "Microsoft Defender를 활용하여 의심스러운 활동 및 잘못된 구성에 대해 알아봅니다.",
            "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
            "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
            "severity": "높다",
            "subcategory": "거버넌스",
            "text": "모든 저장소 계정에 대해 Microsoft Defender 사용"
        },
        {
            "category": "안전",
            "description": "일시 삭제 메커니즘을 사용하면 실수로 삭제된 Blob을 복구할 수 있습니다.",
            "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
            "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
            "severity": "보통",
            "subcategory": "데이터 가용성",
            "text": "Blob에 대해 '일시 삭제' 사용"
        },
        {
            "category": "안전",
            "description": "예를 들어 애플리케이션이 기밀성, 개인 정보 보호 또는 규정 준수를 위해 삭제된 정보가 즉시 삭제되도록 해야 하는 경우와 같이 특정 Blob 컨테이너에 대해 '일시 삭제'를 선택적으로 사용하지 않도록 설정하는 것이 좋습니다. ",
            "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
            "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
            "severity": "보통",
            "subcategory": "기밀성",
            "text": "Blob에 대해 '일시 삭제' 사용 안 함"
        },
        {
            "category": "안전",
            "description": "컨테이너에 대한 일시 삭제를 사용하면 컨테이너가 삭제된 후 복구할 수 있습니다(예: 실수로 인한 삭제 작업에서 복구).",
            "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
            "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
            "severity": "높다",
            "subcategory": "데이터 가용성",
            "text": "컨테이너에 대해 '일시 삭제' 사용"
        },
        {
            "category": "안전",
            "description": "예를 들어 애플리케이션이 기밀성, 개인 정보 보호 또는 규정 준수를 위해 삭제된 정보가 즉시 삭제되도록 해야 하는 경우와 같이 특정 Blob 컨테이너에 대해 '일시 삭제'를 선택적으로 사용하지 않도록 설정하는 것이 좋습니다. ",
            "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
            "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
            "severity": "보통",
            "subcategory": "기밀성",
            "text": "컨테이너에 대해 '일시 삭제' 사용 안 함"
        },
        {
            "category": "안전",
            "description": "사용자가 삭제하기 전에 먼저 삭제 잠금을 제거하도록 하여 실수로 저장소 계정을 삭제하는 것을 방지합니다.",
            "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
            "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
            "severity": "높다",
            "subcategory": "데이터 가용성",
            "text": "저장소 계정에 리소스 잠금 사용"
        },
        {
            "category": "안전",
            "description": "Blob, 컨테이너 또는 저장소 계정을 삭제할 수 없도록 Blob에 대한 '법적 보존' 또는 '시간 기반 보존' 정책을 고려합니다. '불가능'은 실제로 '불가능'을 의미합니다. 저장소 계정에 변경할 수 없는 Blob이 포함된 경우 해당 저장소 계정을 '제거'하는 유일한 방법은 Azure 구독을 취소하는 것입니다.",
            "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
            "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
            "severity": "높다",
            "subcategory": "데이터 가용성, 규정 준수",
            "text": "변경할 수 없는 Blob 고려"
        },
        {
            "category": "안전",
            "description": "스토리지 계정에 대한 보호되지 않는 HTTP/80 액세스를 사용하지 않도록 설정하여 모든 데이터 전송이 암호화되고 무결성이 보호되며 서버가 인증되도록 하는 것이 좋습니다. ",
            "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
            "severity": "높다",
            "subcategory": "네트워킹",
            "text": "HTTPS 필요(예: 스토리지 계정에서 포트 80 사용 안 함)"
        },
        {
            "category": "안전",
            "description": "스토리지 계정에서 사용자 지정 도메인(호스트 이름)을 구성할 때 TLS/HTTPS가 필요한지 확인합니다. 그렇다면 저장소 계정 앞에 Azure CDN을 배치해야 할 수 있습니다.",
            "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
            "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
            "severity": "높다",
            "subcategory": "네트워킹",
            "text": "HTTPS를 적용하는 경우(HTTP 사용 안 함) 스토리지 계정에 사용자 지정 도메인(CNAME)을 사용하지 않는지 확인합니다."
        },
        {
            "category": "안전",
            "description": "클라이언트가 SAS 토큰을 사용하여 Blob 데이터에 액세스할 때 HTTPS를 요구하면 자격 증명 손실 위험을 최소화하는 데 도움이 됩니다.",
            "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
            "severity": "보통",
            "subcategory": "네트워킹",
            "text": "SAS(공유 액세스 서명) 토큰을 HTTPS 연결로만 제한"
        },
        {
            "category": "안전",
            "description": "AAD 토큰은 가능한 경우 공유 액세스 서명보다 선호되어야 합니다.",
            "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
            "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
            "severity": "높다",
            "subcategory": "ID 및 액세스 관리",
            "text": "Blob 액세스를 위해 Azure Active Directory (Azure AD) 토큰 사용"
        },
        {
            "category": "안전",
            "description": "사용자, 그룹 또는 응용 프로그램에 역할을 할당할 때 해당 보안 주체는 작업을 수행하는 데 필요한 권한만 부여합니다. 리소스에 대한 액세스를 제한하면 의도하지 않은 데이터와 악의적인 데이터 오용을 모두 방지할 수 있습니다.",
            "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
            "severity": "보통",
            "subcategory": "ID 및 액세스 관리",
            "text": "IaM 권한의 최소 권한"
        },
        {
            "category": "안전",
            "description": "사용자 위임 SAS는 Azure AD(Azure Active Directory) 자격 증명과 SAS에 대해 지정된 권한으로 보호됩니다. 사용자 위임 SAS는 범위 및 기능 측면에서 서비스 SAS와 유사하지만 서비스 SAS에 비해 보안 이점을 제공합니다. ",
            "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
            "severity": "높다",
            "subcategory": "ID 및 액세스 관리",
            "text": "SAS를 사용하는 경우 스토리지 계정 키 기반 SAS보다 '사용자 위임 SAS'를 선호합니다."
        },
        {
            "category": "안전",
            "description": "저장소 계정 키('공유 키')에는 감사 기능이 거의 없습니다. 누가/언제 키 사본을 가져왔는지 모니터링할 수 있지만 키가 여러 사람의 손에 있으면 특정 사용자에게 사용을 귀속시킬 수 없습니다. AAD 인증에만 의존하면 스토리지 액세스를 사용자에게 더 쉽게 연결할 수 있습니다. ",
            "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
            "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
            "severity": "높다",
            "subcategory": "ID 및 액세스 관리",
            "text": "AAD 액세스(및 사용자 위임 SAS)만 지원되도록 저장소 계정 키를 사용하지 않도록 설정하는 것이 좋습니다."
        },
        {
            "category": "안전",
            "description": "활동 로그 데이터를 사용하여 스토리지 계정의 보안을 '언제', '누가', '무엇을' 및 '어떻게' 보거나 변경하는지 식별합니다(예: 스토리지 계정 키, 액세스 정책 등).",
            "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
            "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
            "severity": "높다",
            "subcategory": "모니터링",
            "text": "Azure Monitor를 사용하여 스토리지 계정에 대한 컨트롤 플레인 작업을 감사하는 것이 좋습니다."
        },
        {
            "category": "안전",
            "description": "키 만료 정책을 사용하면 계정 액세스 키의 교체에 대한 미리 알림을 설정할 수 있습니다. 지정된 간격이 경과하고 키가 아직 회전되지 않은 경우 미리 알림이 표시됩니다.",
            "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
            "severity": "보통",
            "subcategory": "ID 및 액세스 관리",
            "text": "저장소 계정 키를 사용하는 경우 '키 만료 정책'을 사용하도록 설정하는 것이 좋습니다."
        },
        {
            "category": "안전",
            "description": "SAS 만료 정책은 SAS가 유효한 권장 간격을 지정합니다. SAS 만료 정책은 서비스 SAS 또는 계정 SAS에 적용됩니다. 사용자가 권장 간격보다 큰 유효 간격을 가진 서비스 SAS 또는 계정 SAS를 생성하면 경고가 표시됩니다.",
            "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
            "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
            "severity": "보통",
            "subcategory": "ID 및 액세스 관리",
            "text": "SAS 만료 정책 구성 고려"
        },
        {
            "category": "안전",
            "description": "저장된 액세스 정책은 저장소 계정 키를 다시 생성할 필요 없이 서비스 SAS에 대한 사용 권한을 취소할 수 있는 옵션을 제공합니다. ",
            "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
            "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
            "severity": "보통",
            "subcategory": "ID 및 액세스 관리",
            "text": "SAS를 저장된 액세스 정책에 연결하는 것이 좋습니다."
        },
        {
            "category": "안전",
            "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
            "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
            "severity": "보통",
            "subcategory": "CI/CD",
            "text": "체크 인된 연결 문자열과 저장소 계정 키를 검색하도록 응용 프로그램의 소스 코드 리포지토리를 구성하는 것이 좋습니다."
        },
        {
            "category": "안전",
            "description": "이상적으로 애플리케이션은 관리 ID를 사용하여 Azure Storage에 인증해야 합니다. 가능하지 않은 경우 Azure KeyVault 또는 이와 동등한 서비스에 스토리지 자격 증명(연결 문자열, 스토리지 계정 키, SAS, 서비스 주체 자격 증명)을 사용하는 것이 좋습니다.",
            "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
            "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
            "severity": "높다",
            "subcategory": "ID 및 액세스 관리",
            "text": "Azure KeyVault에 연결 문자열을 저장하는 것이 좋습니다(관리 ID를 사용할 수 없는 시나리오에서)."
        },
        {
            "category": "안전",
            "description": "임시 SAS 서비스 SAS 또는 계정 SAS에서 단기 만료 시간을 사용합니다. 이러한 방식으로 SAS가 손상되더라도 짧은 시간 동안만 유효합니다. 이 방법은 저장된 액세스 정책을 참조할 수 없는 경우에 특히 중요합니다. 또한 단기 만료 시간은 Blob에 업로드할 수 있는 시간을 제한하여 Blob에 쓸 수 있는 데이터의 양을 제한합니다.",
            "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
            "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
            "severity": "높다",
            "subcategory": "ID 및 액세스 관리",
            "text": "임시 SAS에 대한 짧은 유효 기간을 위해 노력"
        },
        {
            "category": "안전",
            "description": "SAS를 만들 때는 가능한 한 구체적이고 제한적이어야 합니다. 훨씬 더 광범위한 액세스를 제공하는 SAS보다 단일 리소스 및 작업에 대해 SAS를 선호합니다.",
            "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
            "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
            "severity": "보통",
            "subcategory": "ID 및 액세스 관리",
            "text": "SAS에 좁은 범위 적용"
        },
        {
            "category": "안전",
            "description": "SAS에는 SAS를 사용하여 리소스를 요청할 권한이 있는 클라이언트 IP 주소 또는 주소 범위에 대한 매개 변수가 포함될 수 있습니다. ",
            "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
            "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
            "severity": "보통",
            "subcategory": "ID 및 액세스 관리",
            "text": "가능한 경우 SAS 범위를 특정 클라이언트 IP 주소로 지정하는 것이 좋습니다."
        },
        {
            "category": "안전",
            "description": "SAS는 클라이언트가 업로드하는 데이터의 양을 제한할 수 없습니다. 시간 경과에 따른 저장소 용량의 가격 책정 모델을 고려할 때 클라이언트가 악의적으로 큰 콘텐츠를 업로드했는지 여부를 확인하는 것이 합리적일 수 있습니다.",
            "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
            "severity": "낮다",
            "subcategory": "ID 및 액세스 관리",
            "text": "클라이언트가 SAS를 사용하여 파일을 업로드한 후 업로드된 데이터를 확인하는 것이 좋습니다. "
        },
        {
            "category": "안전",
            "description": "'로컬 사용자 계정'을 사용하여 SFTP를 통해 Blob 저장소에 액세스하는 경우 '일반적인' RBAC 컨트롤이 적용되지 않습니다. NFS 또는 REST를 통한 Blob 액세스는 SFTP 액세스보다 제한적일 수 있습니다. 안타깝게도 2023년 초부터 로컬 사용자는 현재 SFTP 엔드포인트에 대해 지원되는 유일한 ID 관리 형태입니다.",
            "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
            "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
            "severity": "높다",
            "subcategory": "ID 및 액세스 관리",
            "text": "SFTP: SFTP 액세스에 대한 '로컬 사용자'의 수를 제한하고 시간이 지남에 따라 액세스가 필요한지 여부를 감사합니다."
        },
        {
            "category": "안전",
            "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
            "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
            "severity": "보통",
            "subcategory": "ID 및 액세스 관리",
            "text": "SFTP: SFTP 엔드포인트는 POSIX와 유사한 ACL을 지원하지 않습니다."
        },
        {
            "category": "안전",
            "description": "저장소는 CORS(원본 간 리소스 공유), 즉 다른 도메인의 웹앱이 동일 원본 정책을 완화할 수 있도록 하는 HTTP 기능을 지원합니다. CORS를 사용하도록 설정할 때 CorsRules를 최소 권한으로 유지합니다.",
            "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
            "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
            "severity": "높다",
            "subcategory": "네트워킹",
            "text": "지나치게 광범위한 CORS 정책 방지"
        },
        {
            "category": "안전",
            "description": "미사용 데이터는 항상 서버 측에서 암호화되며 클라이언트 측에서도 암호화될 수 있습니다. 서버 쪽 암호화는 플랫폼 관리형 키(기본값) 또는 고객 관리형 키를 사용하여 발생할 수 있습니다. 클라이언트 쪽 암호화는 클라이언트가 Azure Storage에 Blob별로 암호화/암호 해독 키를 제공하거나 클라이언트 쪽에서 암호화를 완전히 처리하여 발생할 수 있습니다. 따라서 기밀성 보장을 위해 Azure 저장소에 전혀 의존하지 않습니다.",
            "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
            "severity": "높다",
            "subcategory": "기밀성 및 암호화",
            "text": "미사용 데이터를 암호화하는 방법을 결정합니다. 데이터에 대한 스레드 모델을 이해합니다."
        },
        {
            "category": "안전",
            "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
            "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
            "severity": "보통",
            "subcategory": "기밀성 및 암호화",
            "text": "사용해야 하는 플랫폼 암호화를 결정합니다."
        },
        {
            "category": "안전",
            "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
            "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
            "severity": "보통",
            "subcategory": "기밀성 및 암호화",
            "text": "사용해야 하는 클라이언트 쪽 암호화를 결정합니다."
        },
        {
            "category": "안전",
            "description": "리소스 그래프 탐색기(리소스 | 여기서 유형 == 'microsoft.storage/storageaccounts' | 속성['allowBlobPublicAccess'] == true)를 활용하여 익명 Blob 액세스를 허용하는 저장소 계정을 찾습니다.",
            "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
            "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
            "severity": "높다",
            "subcategory": "ID 및 액세스 관리",
            "text": "공용 Blob 액세스가 필요한지 또는 특정 저장소 계정에 대해 사용하지 않도록 설정할 수 있는지 여부를 고려합니다. "
        }
    ],
    "metadata": {
        "name": "Azure Blob Storage Review"
    },
    "severities": [
        {
            "name": "높다"
        },
        {
            "name": "보통"
        },
        {
            "name": "낮다"
        }
    ],
    "status": [
        {
            "description": "이 검사는 아직 검토되지 않았습니다.",
            "name": "확인되지 않음"
        },
        {
            "description": "이 검사와 연결된 작업 항목이 있습니다.",
            "name": "열다"
        },
        {
            "description": "이 검사가 확인되었으며 연결된 추가 작업 항목이 없습니다.",
            "name": "성취"
        },
        {
            "description": "현재 디자인에는 적용되지 않음",
            "name": "해당 없음"
        },
        {
            "description": "필요하지 않음",
            "name": "필요하지 않음"
        }
    ]
}
checklists/blob_storage_security_checklist.ja.json METASEP
{
    "categories": [
        {
            "name": "安全"
        }
    ],
    "items": [
        {
            "category": "安全",
            "description": "ストレージに関連する Microsoft クラウド セキュリティ ベンチマークのガイダンスを適用する",
            "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
            "severity": "中程度",
            "subcategory": "概要",
            "text": "「ストレージの Azure セキュリティ ベースライン」を検討する"
        },
        {
            "category": "安全",
            "description": "Azure Storage には既定でパブリック IP アドレスがあり、インターネットでアクセスできます。プライベート エンドポイントを使用すると、アクセスが必要な Azure コンピューティング リソースにのみ Azure Storage を安全に公開できるため、パブリック インターネットへの露出が排除されます。",
            "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
            "severity": "高い",
            "subcategory": "ネットワーキング",
            "text": "Azure ストレージのプライベート エンドポイントの使用を検討する"
        },
        {
            "category": "安全",
            "description": "新しく作成されたストレージ アカウントは、ARM デプロイ モデルを使用して作成されるため、RBAC、監査などがすべて有効になります。サブスクリプションにクラシック デプロイ モデルの古いストレージ アカウントがないことを確認する",
            "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
            "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
            "severity": "中程度",
            "subcategory": "統治",
            "text": "古いストレージ アカウントが \"クラシック デプロイ モデル\" を使用していないことを確認する"
        },
        {
            "category": "安全",
            "description": "Microsoft Defender を活用して、疑わしいアクティビティや構成ミスについて学習します。",
            "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
            "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
            "severity": "高い",
            "subcategory": "統治",
            "text": "すべてのストレージ アカウントに対して Microsoft Defender を有効にする"
        },
        {
            "category": "安全",
            "description": "論理的な削除メカニズムにより、誤って削除された BLOB を回復できます。",
            "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
            "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
            "severity": "中程度",
            "subcategory": "データの可用性",
            "text": "BLOB の \"論理的な削除\" を有効にする"
        },
        {
            "category": "安全",
            "description": "特定の BLOB コンテナーに対して \"論理的な削除\" を選択的に無効にすることを検討してください (たとえば、機密性、プライバシー、コンプライアンス上の理由など) 削除された情報がすぐに削除されるようにする必要がある場合など)。",
            "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
            "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
            "severity": "中程度",
            "subcategory": "機密性",
            "text": "BLOB の \"論理的な削除\" を無効にする"
        },
        {
            "category": "安全",
            "description": "コンテナーの論理的な削除を使用すると、コンテナーが削除された後に回復できます (たとえば、偶発的な削除操作から回復します)。",
            "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
            "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
            "severity": "高い",
            "subcategory": "データの可用性",
            "text": "コンテナの「論理的な削除」を有効にする"
        },
        {
            "category": "安全",
            "description": "特定の BLOB コンテナーに対して \"論理的な削除\" を選択的に無効にすることを検討してください (たとえば、機密性、プライバシー、コンプライアンス上の理由など) 削除された情報がすぐに削除されるようにする必要がある場合など)。",
            "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
            "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
            "severity": "中程度",
            "subcategory": "機密性",
            "text": "コンテナの「論理的な削除」を無効にする"
        },
        {
            "category": "安全",
            "description": "削除する前に、ユーザーに削除ロックの削除を強制することで、ストレージ アカウントの偶発的な削除を防止します。",
            "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
            "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
            "severity": "高い",
            "subcategory": "データの可用性",
            "text": "ストレージ アカウントのリソース ロックを有効にする"
        },
        {
            "category": "安全",
            "description": "BLOB の \"訴訟ホールド\" または \"時間ベースのリテンション期間\" ポリシーを考慮して、BLOB、コンテナー、またはストレージ アカウントを削除できないようにします。「不可能」は実際には「不可能」を意味することに注意してください。ストレージ アカウントに不変の BLOB が含まれると、そのストレージ アカウントを \"取り除く\" 唯一の方法は、Azure サブスクリプションを取り消すことです。",
            "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
            "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
            "severity": "高い",
            "subcategory": "データの可用性、コンプライアンス",
            "text": "不変のブロブを検討する"
        },
        {
            "category": "安全",
            "description": "ストレージ アカウントへの保護されていない HTTP/80 アクセスを無効にして、すべてのデータ転送が暗号化され、整合性が保護され、サーバーが認証されるようにすることを検討してください。",
            "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
            "severity": "高い",
            "subcategory": "ネットワーキング",
            "text": "HTTPS を要求する (ストレージ アカウントのポート 80 を無効にする)"
        },
        {
            "category": "安全",
            "description": "ストレージ アカウントでカスタム ドメイン (ホスト名) を構成する場合は、TLS/HTTPS が必要かどうかを確認します。その場合は、ストレージ アカウントの前に Azure CDN を配置する必要があります。",
            "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
            "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
            "severity": "高い",
            "subcategory": "ネットワーキング",
            "text": "HTTPS を適用する (HTTP を無効にする) 場合は、ストレージ アカウントにカスタム ドメイン (CNAME) を使用していないことを確認します。"
        },
        {
            "category": "安全",
            "description": "クライアントが SAS トークンを使用して BLOB データにアクセスするときに HTTPS を要求すると、資格情報が失われるリスクを最小限に抑えるのに役立ちます。",
            "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
            "severity": "中程度",
            "subcategory": "ネットワーキング",
            "text": "共有アクセス署名 (SAS) トークンを HTTPS 接続のみに制限する"
        },
        {
            "category": "安全",
            "description": "AAD トークンは、可能な限り、共有アクセス署名よりも優先する必要があります",
            "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
            "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
            "severity": "高い",
            "subcategory": "ID およびアクセス管理",
            "text": "BLOB アクセスに Azure Active Directory (Azure AD) トークンを使用する"
        },
        {
            "category": "安全",
            "description": "ユーザー、グループ、またはアプリケーションにロールを割り当てる場合は、タスクの実行に必要なアクセス許可のみをセキュリティ プリンシパルに付与します。リソースへのアクセスを制限すると、データの意図しない誤用と悪意のある誤用の両方を防ぐことができます。",
            "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
            "severity": "中程度",
            "subcategory": "ID およびアクセス管理",
            "text": "IaM アクセス許可の最小特権"
        },
        {
            "category": "安全",
            "description": "ユーザー委任 SAS は、Azure Active Directory (Azure AD) 資格情報と、SAS に指定されたアクセス許可によってセキュリティで保護されます。ユーザー委任 SAS は、そのスコープと機能の点でサービス SAS に似ていますが、サービス SAS よりもセキュリティ上の利点があります。",
            "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
            "severity": "高い",
            "subcategory": "ID およびアクセス管理",
            "text": "SAS を使用する場合は、ストレージ アカウント キー ベースの SAS よりも \"ユーザー委任 SAS\" を優先します。"
        },
        {
            "category": "安全",
            "description": "ストレージ アカウント キー (\"共有キー\") には、監査機能がほとんどありません。誰が/いつキーのコピーを取得したかを監視することはできますが、キーが複数の人の手に渡ると、使用状況を特定のユーザーに帰属させることはできません。AAD 認証のみに依存すると、ストレージ アクセスをユーザーに結び付けることが容易になります。",
            "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
            "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
            "severity": "高い",
            "subcategory": "ID およびアクセス管理",
            "text": "AAD アクセス (およびユーザー委任 SAS) のみがサポートされるように、ストレージ アカウント キーを無効にすることを検討してください。"
        },
        {
            "category": "安全",
            "description": "アクティビティ ログ データを使用して、ストレージ アカウントのセキュリティ (ストレージ アカウント キー、アクセス ポリシーなど) が \"いつ\"、\"誰が\"、\"何を\"、\"どのように\" 表示または変更されているかを特定します。",
            "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
            "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
            "severity": "高い",
            "subcategory": "モニタリング",
            "text": "Azure Monitor を使用してストレージ アカウントのコントロール プレーン操作を監査することを検討する"
        },
        {
            "category": "安全",
            "description": "キーの有効期限ポリシーを使用すると、アカウントアクセスキーのローテーションのリマインダーを設定できます。指定した間隔が経過し、キーがまだ回転していない場合、リマインダーが表示されます。",
            "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
            "severity": "中程度",
            "subcategory": "ID およびアクセス管理",
            "text": "ストレージ アカウント キーを使用する場合は、\"キーの有効期限ポリシー\" を有効にすることを検討してください"
        },
        {
            "category": "安全",
            "description": "SAS 有効期限ポリシーは、SAS が有効な推奨間隔を指定します。SAS 有効期限ポリシーは、サービス SAS またはアカウント SAS に適用されます。ユーザーが推奨間隔よりも長い有効期間を持つサービス SAS またはアカウント SAS を生成すると、警告が表示されます。",
            "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
            "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
            "severity": "中程度",
            "subcategory": "ID およびアクセス管理",
            "text": "SAS 有効期限ポリシーの構成を検討する"
        },
        {
            "category": "安全",
            "description": "保存されているアクセス ポリシーでは、ストレージ アカウント キーを再生成することなく、サービス SAS のアクセス許可を取り消すことができます。",
            "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
            "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
            "severity": "中程度",
            "subcategory": "ID およびアクセス管理",
            "text": "SAS を保存されているアクセス ポリシーにリンクすることを検討する"
        },
        {
            "category": "安全",
            "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
            "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
            "severity": "中程度",
            "subcategory": "CI/CD",
            "text": "チェックインされた接続文字列とストレージ アカウント キーを検出するようにアプリケーションのソース コード リポジトリを構成することを検討してください。"
        },
        {
            "category": "安全",
            "description": "理想的には、アプリケーションでマネージド ID を使用して Azure Storage に対する認証を行う必要があります。それが不可能な場合は、Azure KeyVault または同等のサービスにストレージ資格情報 (接続文字列、ストレージ アカウント キー、SAS、サービス プリンシパル資格情報) を配置することを検討してください。",
            "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
            "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
            "severity": "高い",
            "subcategory": "ID およびアクセス管理",
            "text": "接続文字列を Azure KeyVault に格納することを検討する (マネージド ID が使用できないシナリオの場合)"
        },
        {
            "category": "安全",
            "description": "アドホック SAS サービス SAS またはアカウント SAS で短期的な有効期限を使用します。この方法では、SAS が侵害された場合でも、短時間しか有効ではありません。この方法は、保存されているアクセス ポリシーを参照できない場合に特に重要です。また、有効期限が近いと、BLOB にアップロードできる時間が制限されるため、BLOB に書き込むことができるデータの量も制限されます。",
            "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
            "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
            "severity": "高い",
            "subcategory": "ID およびアクセス管理",
            "text": "アドホックSASの有効期間を短くする"
        },
        {
            "category": "安全",
            "description": "SAS を作成するときは、できるだけ具体的かつ制限的にします。より広範なアクセスを提供する SAS よりも、単一のリソースと操作に対して SAS を優先します。",
            "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
            "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
            "severity": "中程度",
            "subcategory": "ID およびアクセス管理",
            "text": "狭いスコープを SAS に適用する"
        },
        {
            "category": "安全",
            "description": "SAS には、SAS を使用してリソースを要求するためにクライアント IP アドレスまたはアドレス範囲が承認されるパラメーターを含めることができます。",
            "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
            "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
            "severity": "中程度",
            "subcategory": "ID およびアクセス管理",
            "text": "可能な限り、SAS を特定のクライアント IP アドレスにスコープすることを検討してください。"
        },
        {
            "category": "安全",
            "description": "SAS は、クライアントがアップロードするデータの量を制限できません。時間の経過に伴うストレージ量の価格設定モデルを考えると、クライアントが悪意を持って大きなコンテンツをアップロードしたかどうかを検証することは理にかなっている場合があります。",
            "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
            "severity": "低い",
            "subcategory": "ID およびアクセス管理",
            "text": "クライアントが SAS を使用してファイルをアップロードした後、アップロードされたデータを確認することを検討してください。"
        },
        {
            "category": "安全",
            "description": "\"ローカル ユーザー アカウント\" を使用して SFTP 経由で BLOB ストレージにアクセスする場合、\"通常の\" RBAC コントロールは適用されません。NFS または REST を介した BLOB アクセスは、SFTP アクセスよりも制限が厳しい場合があります。残念ながら、2023年初頭の時点で、ローカルユーザーはSFTPエンドポイントで現在サポートされている唯一のID管理形式です。",
            "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
            "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
            "severity": "高い",
            "subcategory": "ID およびアクセス管理",
            "text": "SFTP: SFTP アクセスの「ローカル ユーザー」の数を制限し、時間の経過と共にアクセスが必要かどうかを監査します。"
        },
        {
            "category": "安全",
            "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
            "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
            "severity": "中程度",
            "subcategory": "ID およびアクセス管理",
            "text": "SFTP: SFTP エンドポイントは POSIX のような ACL をサポートしていません。"
        },
        {
            "category": "安全",
            "description": "ストレージは、CORS (クロスオリジンリソース共有)、つまり、異なるドメインの Web アプリが同一オリジンポリシーを緩めることを可能にする HTTP 機能をサポートしています。CORS を有効にする場合は、CorsRules を最小限の特権に保持します。",
            "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
            "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
            "severity": "高い",
            "subcategory": "ネットワーキング",
            "text": "過度に広範な CORS ポリシーを避ける"
        },
        {
            "category": "安全",
            "description": "保存データは常にサーバー側で暗号化され、さらにクライアント側でも暗号化される場合があります。サーバー側の暗号化は、プラットフォーム マネージド キー (既定) またはカスタマー マネージド キーを使用して行われる場合があります。クライアント側の暗号化は、クライアントが Azure Storage に BLOB ごとに暗号化/暗号化解除キーを提供するか、クライアント側で暗号化を完全に処理することによって発生する可能性があります。したがって、機密性の保証のために Azure ストレージにまったく依存しません。",
            "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
            "severity": "高い",
            "subcategory": "機密性と暗号化",
            "text": "保存データの暗号化方法を決定します。データのスレッド モデルを理解する。"
        },
        {
            "category": "安全",
            "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
            "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
            "severity": "中程度",
            "subcategory": "機密性と暗号化",
            "text": "使用するプラットフォーム暗号化を決定します。"
        },
        {
            "category": "安全",
            "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
            "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
            "severity": "中程度",
            "subcategory": "機密性と暗号化",
            "text": "クライアント側の暗号化を使用するかどうかを決定します。"
        },
        {
            "category": "安全",
            "description": "リソース グラフ エクスプローラー (リソース |の種類 == 'microsoft.storage/storageaccounts' |プロパティ ['allowBlobPublicAccess'] == true) を利用して、匿名 BLOB アクセスを許可するストレージ アカウントを見つけます。",
            "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
            "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
            "severity": "高い",
            "subcategory": "ID およびアクセス管理",
            "text": "パブリック BLOB アクセスが必要かどうか、または特定のストレージ アカウントに対して無効にできるかどうかを検討します。"
        }
    ],
    "metadata": {
        "name": "Azure Blob Storage Review"
    },
    "severities": [
        {
            "name": "高い"
        },
        {
            "name": "中程度"
        },
        {
            "name": "低い"
        }
    ],
    "status": [
        {
            "description": "このチェックはまだ確認されていません",
            "name": "未確認"
        },
        {
            "description": "このチェックに関連付けられているアクションアイテムがあります",
            "name": "開ける"
        },
        {
            "description": "このチェックは検証済みであり、それ以上のアクションアイテムは関連付けられていません",
            "name": "達成"
        },
        {
            "description": "現在のデザインには適用できません",
            "name": "該当なし"
        },
        {
            "description": "必須ではありません",
            "name": "必須ではありません"
        }
    ]
}
checklists/blob_storage_security_checklist.es.json METASEP
{
    "categories": [
        {
            "name": "Seguridad"
        }
    ],
    "items": [
        {
            "category": "Seguridad",
            "description": "Aplicar la orientación del banco de pruebas de seguridad en la nube de Microsoft relacionado con el almacenamiento",
            "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline",
            "severity": "Medio",
            "subcategory": " Visión general",
            "text": "Considere la 'Línea base de seguridad de Azure para el almacenamiento'"
        },
        {
            "category": "Seguridad",
            "description": "De forma predeterminada, Azure Storage tiene una dirección IP pública y es accesible desde Internet. Los puntos de conexión privados permiten exponer de forma segura Azure Storage solo a aquellos recursos de Azure Compute que necesitan acceso, eliminando así la exposición a la Internet pública",
            "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints",
            "severity": "Alto",
            "subcategory": "Gestión de redes",
            "text": "Considere la posibilidad de usar puntos de conexión privados para Azure Storage"
        },
        {
            "category": "Seguridad",
            "description": "Las cuentas de almacenamiento recién creadas se crean mediante el modelo de implementación de ARM, de modo que RBAC, auditoría, etc. están habilitados. Asegúrese de que no haya cuentas de almacenamiento antiguas con el modelo de implementación clásica en una suscripción",
            "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
            "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts",
            "severity": "Medio",
            "subcategory": "Gobernanza",
            "text": "Asegúrese de que las cuentas de almacenamiento más antiguas no usen el \"modelo de implementación clásica\""
        },
        {
            "category": "Seguridad",
            "description": "Aprovecha Microsoft Defender para obtener información sobre actividades sospechosas y configuraciones incorrectas.",
            "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
            "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure",
            "severity": "Alto",
            "subcategory": "Gobernanza",
            "text": "Habilitar Microsoft Defender para todas tus cuentas de almacenamiento"
        },
        {
            "category": "Seguridad",
            "description": "El mecanismo de eliminación temporal permite recuperar blobs eliminados accidentalmente.",
            "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
            "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview",
            "severity": "Medio",
            "subcategory": "Disponibilidad de datos",
            "text": "Habilitar 'eliminación temporal' para blobs"
        },
        {
            "category": "Seguridad",
            "description": "Considere la posibilidad de deshabilitar selectivamente la \"eliminación temporal\" para determinados contenedores de blobs, por ejemplo, si la aplicación debe garantizar que la información eliminada se elimine inmediatamente, por ejemplo, por motivos de confidencialidad, privacidad o cumplimiento. ",
            "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
            "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable",
            "severity": "Medio",
            "subcategory": "Confidencialidad",
            "text": "Deshabilitar 'eliminación temporal' para blobs"
        },
        {
            "category": "Seguridad",
            "description": "La eliminación temporal para contenedores le permite recuperar un contenedor después de que se haya eliminado, por ejemplo, recuperarse de una operación de eliminación accidental.",
            "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
            "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview",
            "severity": "Alto",
            "subcategory": "Disponibilidad de datos",
            "text": "Habilitar 'eliminación temporal' para contenedores"
        },
        {
            "category": "Seguridad",
            "description": "Considere la posibilidad de deshabilitar selectivamente la \"eliminación temporal\" para determinados contenedores de blobs, por ejemplo, si la aplicación debe garantizar que la información eliminada se elimine inmediatamente, por ejemplo, por motivos de confidencialidad, privacidad o cumplimiento. ",
            "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
            "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable",
            "severity": "Medio",
            "subcategory": "Confidencialidad",
            "text": "Deshabilitar 'eliminación temporal' para contenedores"
        },
        {
            "category": "Seguridad",
            "description": "Evita la eliminación accidental de una cuenta de almacenamiento, obligando al usuario a quitar primero el bloqueo de eliminación, antes de la eliminación",
            "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
            "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource",
            "severity": "Alto",
            "subcategory": "Disponibilidad de datos",
            "text": "Habilitar bloqueos de recursos en cuentas de almacenamiento"
        },
        {
            "category": "Seguridad",
            "description": "Considere las directivas de \"retención legal\" o \"retención basada en tiempo\" para los blobs, de modo que sea imposible eliminar el blob, el contenedor o la cuenta de almacenamiento. Tenga en cuenta que \"imposible\" en realidad significa \"imposible\"; una vez que una cuenta de almacenamiento contiene un blob inmutable, la única forma de \"deshacerse\" de esa cuenta de almacenamiento es cancelando la suscripción de Azure.",
            "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
            "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview",
            "severity": "Alto",
            "subcategory": "Disponibilidad de datos, cumplimiento",
            "text": "Considere los blobs inmutables"
        },
        {
            "category": "Seguridad",
            "description": "Considere deshabilitar el acceso HTTP/80 desprotegido a la cuenta de almacenamiento, de modo que todas las transferencias de datos estén cifradas, protegidas por integridad y el servidor esté autenticado. ",
            "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer",
            "severity": "Alto",
            "subcategory": "Gestión de redes",
            "text": "Requerir HTTPS, es decir, deshabilitar el puerto 80 en la cuenta de almacenamiento"
        },
        {
            "category": "Seguridad",
            "description": "Al configurar un dominio personalizado (nombre de host) en una cuenta de almacenamiento, compruebe si necesita TLS/HTTPS; si es así, es posible que tenga que poner Azure CDN delante de su cuenta de almacenamiento.",
            "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
            "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name",
            "severity": "Alto",
            "subcategory": "Gestión de redes",
            "text": "Al aplicar HTTPS (deshabilitar HTTP), compruebe que no usa dominios personalizados (CNAME) para la cuenta de almacenamiento."
        },
        {
            "category": "Seguridad",
            "description": "Requerir HTTPS cuando un cliente usa un token SAS para obtener acceso a los datos de blobs ayuda a minimizar el riesgo de pérdida de credenciales.",
            "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview",
            "severity": "Medio",
            "subcategory": "Gestión de redes",
            "text": "Limitar los tokens de firma de acceso compartido (SAS) solo a las conexiones HTTPS"
        },
        {
            "category": "Seguridad",
            "description": "Los tokens de AAD deben favorecerse sobre las firmas de acceso compartido, siempre que sea posible.",
            "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
            "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access",
            "severity": "Alto",
            "subcategory": "Gestión de identidades y accesos",
            "text": "Uso de tokens de Azure Active Directory (Azure AD) para el acceso a blobs"
        },
        {
            "category": "Seguridad",
            "description": "Al asignar un rol a un usuario, grupo o aplicación, conceda a esa entidad de seguridad solo los permisos necesarios para realizar sus tareas. Limitar el acceso a los recursos ayuda a evitar el uso indebido involuntario y malintencionado de los datos.",
            "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
            "severity": "Medio",
            "subcategory": "Gestión de identidades y accesos",
            "text": "Privilegios mínimos en permisos de IaM"
        },
        {
            "category": "Seguridad",
            "description": "Una SAS de delegación de usuario está protegida con credenciales de Azure Active Directory (Azure AD) y también con los permisos especificados para la SAS. Una SAS de delegación de usuario es análoga a una SAS de servicio en términos de su alcance y función, pero ofrece beneficios de seguridad sobre la SAS de servicio. ",
            "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas",
            "severity": "Alto",
            "subcategory": "Gestión de identidades y accesos",
            "text": "Cuando utilice SAS, prefiera 'SAS de delegación de usuario' en lugar de SAS basado en clave de cuenta de almacenamiento."
        },
        {
            "category": "Seguridad",
            "description": "Las claves de cuenta de almacenamiento ('claves compartidas') tienen muy pocas capacidades de auditoría. Si bien se puede monitorear quién / cuándo obtuvo una copia de las claves, una vez que las claves están en manos de varias personas, es imposible atribuir el uso a un usuario específico. Confiar únicamente en la autenticación de AAD facilita vincular el acceso al almacenamiento a un usuario. ",
            "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
            "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key",
            "severity": "Alto",
            "subcategory": "Gestión de identidades y accesos",
            "text": "Considere la posibilidad de deshabilitar las claves de cuenta de almacenamiento, de modo que solo se admita el acceso a AAD (y SAS de delegación de usuarios)."
        },
        {
            "category": "Seguridad",
            "description": "Utilice los datos del registro de actividad para identificar \"cuándo\", \"quién\", \"qué\" y \"cómo\" se está viendo o cambiando la seguridad de su cuenta de almacenamiento (es decir, claves de cuenta de almacenamiento, directivas de acceso, etc.).",
            "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
            "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity",
            "severity": "Alto",
            "subcategory": "Monitorización",
            "text": "Considere la posibilidad de usar Azure Monitor para auditar las operaciones del plano de control en la cuenta de almacenamiento"
        },
        {
            "category": "Seguridad",
            "description": "Una directiva de caducidad de claves le permite establecer un recordatorio para la rotación de las claves de acceso de la cuenta. El aviso se muestra si ha transcurrido el intervalo especificado y las teclas aún no se han girado.",
            "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy",
            "severity": "Medio",
            "subcategory": "Gestión de identidades y accesos",
            "text": "Al usar claves de cuenta de almacenamiento, considere habilitar una \"directiva de caducidad de claves\""
        },
        {
            "category": "Seguridad",
            "description": "Una directiva de expiración de SAS especifica un intervalo recomendado durante el cual la SAS es válida. Las directivas de caducidad de SAS se aplican a una SAS de servicio o a una SAS de cuenta. Cuando un usuario genera SAS de servicio o un SAS de cuenta con un intervalo de validez mayor que el intervalo recomendado, verá una advertencia.",
            "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
            "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy",
            "severity": "Medio",
            "subcategory": "Gestión de identidades y accesos",
            "text": "Considere la posibilidad de configurar una directiva de expiración de SAS"
        },
        {
            "category": "Seguridad",
            "description": "Las directivas de acceso almacenado le ofrecen la opción de revocar los permisos de una SAS de servicio sin tener que volver a generar las claves de la cuenta de almacenamiento. ",
            "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
            "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy",
            "severity": "Medio",
            "subcategory": "Gestión de identidades y accesos",
            "text": "Considere la posibilidad de vincular SAS a una directiva de acceso almacenado"
        },
        {
            "category": "Seguridad",
            "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
            "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/",
            "severity": "Medio",
            "subcategory": "CI/CD",
            "text": "Considere la posibilidad de configurar el repositorio de código fuente de la aplicación para detectar cadenas de conexión protegidas y claves de cuenta de almacenamiento."
        },
        {
            "category": "Seguridad",
            "description": "Lo ideal es que la aplicación use una identidad administrada para autenticarse en Azure Storage. Si eso no es posible, considere la posibilidad de tener la credencial de almacenamiento (cadena de conexión, clave de cuenta de almacenamiento, SAS, credencial de entidad de servicio) en Azure KeyVault o un servicio equivalente.",
            "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
            "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys",
            "severity": "Alto",
            "subcategory": "Gestión de identidades y accesos",
            "text": "Considere la posibilidad de almacenar cadenas de conexión en Azure KeyVault (en escenarios donde las identidades administradas no son posibles)"
        },
        {
            "category": "Seguridad",
            "description": "Utilice tiempos de caducidad a corto plazo en una SAS de servicio SAS ad hoc o SAS de cuenta. De esta manera, incluso si un SAS se ve comprometido, es válido solo por un corto tiempo. Esta práctica es especialmente importante si no puede hacer referencia a una directiva de acceso almacenado. Los tiempos de expiración a corto plazo también limitan la cantidad de datos que se pueden escribir en un blob al limitar el tiempo disponible para cargarlo.",
            "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
            "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
            "severity": "Alto",
            "subcategory": "Gestión de identidades y accesos",
            "text": "Esforzarse por períodos de validez cortos para SAS ad-hoc"
        },
        {
            "category": "Seguridad",
            "description": "Al crear una SAS, sea lo más específico y restrictivo posible. Prefiera una SAS para un solo recurso y operación en lugar de una SAS que brinda un acceso mucho más amplio.",
            "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
            "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature",
            "severity": "Medio",
            "subcategory": "Gestión de identidades y accesos",
            "text": "Aplicar un ámbito estrecho a una SAS"
        },
        {
            "category": "Seguridad",
            "description": "Una SAS puede incluir parámetros en los que las direcciones IP del cliente o los intervalos de direcciones están autorizados a solicitar un recurso mediante la SAS. ",
            "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
            "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas",
            "severity": "Medio",
            "subcategory": "Gestión de identidades y accesos",
            "text": "Considere la posibilidad de definir el ámbito de SAS a una dirección IP de cliente específica, siempre que sea posible"
        },
        {
            "category": "Seguridad",
            "description": "Una SAS no puede restringir la cantidad de datos que carga un cliente; Dado el modelo de precios de la cantidad de almacenamiento a lo largo del tiempo, podría tener sentido validar si los clientes cargaron contenidos malintencionadamente grandes.",
            "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
            "severity": "Bajo",
            "subcategory": "Gestión de identidades y accesos",
            "text": "Considere la posibilidad de verificar los datos cargados, después de que los clientes usaran un SAS para cargar un archivo. "
        },
        {
            "category": "Seguridad",
            "description": "Al acceder al almacenamiento de blobs a través de SFTP mediante una \"cuenta de usuario local\", no se aplican los controles RBAC \"habituales\". El acceso a blobs a través de NFS o REST puede ser más restrictivo que el acceso SFTP. Desafortunadamente, a principios de 2023, los usuarios locales son la única forma de administración de identidades que actualmente se admite para el punto de enlace SFTP",
            "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
            "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model",
            "severity": "Alto",
            "subcategory": "Gestión de identidades y accesos",
            "text": "SFTP: Limite la cantidad de \"usuarios locales\" para el acceso SFTP y audite si el acceso es necesario a lo largo del tiempo."
        },
        {
            "category": "Seguridad",
            "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
            "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization",
            "severity": "Medio",
            "subcategory": "Gestión de identidades y accesos",
            "text": "SFTP: el extremo SFTP no admite ACL similares a POSIX."
        },
        {
            "category": "Seguridad",
            "description": "El almacenamiento admite CORS (Cross-Origin Resource Sharing), es decir, una característica HTTP que permite a las aplicaciones web de un dominio diferente aflojar la directiva del mismo origen. Al habilitar CORS, mantenga CorsRules con el mínimo privilegio.",
            "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
            "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services",
            "severity": "Alto",
            "subcategory": "Gestión de redes",
            "text": "Evite políticas CORS excesivamente amplias"
        },
        {
            "category": "Seguridad",
            "description": "Los datos en reposo siempre se cifran en el lado del servidor y, además, también pueden cifrarse en el lado del cliente. El cifrado del lado del servidor puede ocurrir utilizando una clave administrada por la plataforma (predeterminada) o una clave administrada por el cliente. El cifrado del lado cliente puede realizarse haciendo que el cliente proporcione una clave de cifrado y descifrado por blob al almacenamiento de Azure o controlando completamente el cifrado en el lado cliente. por lo tanto, no depende en absoluto de Azure Storage para las garantías de confidencialidad.",
            "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
            "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption",
            "severity": "Alto",
            "subcategory": "Confidencialidad y cifrado",
            "text": "Determine cómo se deben cifrar los datos en reposo. Comprender el modelo de subprocesos para los datos."
        },
        {
            "category": "Seguridad",
            "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
            "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json",
            "severity": "Medio",
            "subcategory": "Confidencialidad y cifrado",
            "text": "Determine qué cifrado de plataforma se debe utilizar."
        },
        {
            "category": "Seguridad",
            "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
            "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys",
            "severity": "Medio",
            "subcategory": "Confidencialidad y cifrado",
            "text": "Determine qué / si se debe usar el cifrado del lado del cliente."
        },
        {
            "category": "Seguridad",
            "description": "Aproveche el Explorador de gráficos de recursos (recursos | donde tipo == 'microsoft.storage/storageaccounts' | donde propiedades['allowBlobPublicAccess'] == true) para buscar cuentas de almacenamiento que permitan el acceso anónimo a blobs.",
            "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
            "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account",
            "severity": "Alto",
            "subcategory": "Gestión de identidades y accesos",
            "text": "Considere si el acceso público a blobs es necesario o si se puede deshabilitar para determinadas cuentas de almacenamiento. "
        }
    ],
    "metadata": {
        "name": "Azure Blob Storage Review"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Medio"
        },
        {
            "name": "Bajo"
        }
    ],
    "status": [
        {
            "description": "Esta comprobación aún no se ha examinado",
            "name": "No verificado"
        },
        {
            "description": "Hay un elemento de acción asociado a esta comprobación",
            "name": "Abrir"
        },
        {
            "description": "Esta comprobación se ha comprobado y no hay más elementos de acción asociados a ella",
            "name": "Cumplido"
        },
        {
            "description": "No aplicable para el diseño actual",
            "name": "N/A"
        },
        {
            "description": "No es necesario",
            "name": "No es necesario"
        }
    ]
}
checklists/blob_storage_security_checklist.en.json METASEP
{
  "metadata": { 
    "name": "Azure Blob Storage Review",
    "timestamp": "Jan 13, 2023",
    "state": "Preview"
  },
  "categories": [
    { "name": "Security" }
  ],
  "status": [
    { "name": "Not verified", "description": "This check has not been looked at yet" },
    { "name": "Open", "description": "There is an action item associated to this check" },
    { "name": "Fulfilled", "description": "This check has been verified, and there are no further action items associated to it" },
    { "name": "N/A", "description": "Not applicable for current design" },
    { "name": "Not required", "description": "Not required" }
  ],
  "severities": [
    { "name": "High" },
    { "name": "Medium" },
    { "name": "Low" }
  ],
  "items": [
    {
      "category": "Security", "subcategory": " Overview",
      "text": "Consider the 'Azure security baseline for storage'",
      "description": "Apply guidance from the Microsoft cloud security benchmark related to Storage",
      "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline"
    },
    {
      "category": "Security", "subcategory": "Networking",
      "text": "Consider using private endpoints for Azure Storage",
      "description": "Azure Storage by default has a public IP address and is Internet-reachable. Private endpoints allow to securely expose Azure Storage only to those Azure Compute resources that need access, thus eliminating exposure to the public Internet",
      "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints"
    },
    {
      "category": "Security", "subcategory": "Governance",
      "text": "Ensure older storage accounts are not using 'classic deployment model'",
      "description": "Newly created storage accounts are created using the ARM deployment model, so that RBAC, auditing etc. are all enabled. Ensure that there are no old storage accounts with classic deployment model in a subscription",
      "guid": "30e37c3e-2971-41b2-963c-eee079b598de",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts"
    },
    {
      "category": "Security", "subcategory": "Governance",
      "text": "Enable Microsoft Defender for all of your storage accounts",
      "description": "Leverage Microsoft Defender to learn about suspicious activity and misconfigurations.",
      "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure"
    },
    {
      "category": "Security", "subcategory": "Data Availability",
      "text": "Enable 'soft delete' for blobs",
      "description": "The soft-delete mechanism allows to recover accidentally deleted blobs.",
      "guid": "503547c1-447e-4c66-828a-7100f1ce16dd",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview"
    },
    {
      "category": "Security", "subcategory": "Confidentiality",
      "text": "Disable 'soft delete' for blobs",
      "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
      "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable"
    },
    {
      "category": "Security", "subcategory": "Data Availability",
      "text": "Enable 'soft delete' for containers",
      "description": "Soft delete for containers enables you to recover a container after it has been deleted, for example recover from an accidental delete operation.",
      "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview"
    },
    {
      "category": "Security", "subcategory": "Confidentiality",
      "text": "Disable 'soft delete' for containers",
      "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ",
      "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable"
    },
    {
      "category": "Security", "subcategory": "Data Availability",
      "text": "Enable resource locks on storage accounts",
      "description": "Prevents accidental deletion of a storage account, by forcing the user to first remove the deletion lock, prior to deletion",
      "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource"
    },
    {
      "category": "Security", "subcategory": "Data Availability, Compliance",
      "text": "Consider immutable blobs",
      "description": "Consider 'legal hold' or 'time-based retention' policies for blobs, so that is is impossible to delete the blob, the container, or the storage account. Please note that 'impossible' actually means 'impossible'; once a storage account contains an immutable blob, the only way to 'get rid' of that storage account is by cancelling the Azure subscription.",
      "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview"
    },
    {
      "category": "Security", "subcategory": "Networking",
      "text": "Require HTTPS, i.e. disable port 80 on the storage account",
      "description": "Consider disabling unprotected HTTP/80 access to the storage account, so that all data transfers are encrypted, integrity protected, and the server is authenticated. ",
      "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer"
    },
    {
      "category": "Security", "subcategory": "Networking",
      "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.",
      "description": "When configuring a custom domain (hostname) on a storage account, check whether you need TLS/HTTPS; if so, you might have to put Azure CDN in front of your storage account.",
      "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name"
    },
    {
      "category": "Security", "subcategory": "Networking",
      "text": "Limit shared access signature (SAS) tokens to HTTPS connections only",
      "description": "Requiring HTTPS when a client uses a SAS token to access blob data helps to minimize the risk of credential loss.",
      "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview"
    },
    {
      "category": "Security", "subcategory": "Identity and Access Management",
      "text": "Use Azure Active Directory (Azure AD) tokens for blob access",
      "description": "AAD tokens should be favored over shared access signatures, wherever possible",
      "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access"
    },
    {
      "category": "Security", "subcategory": "Identity and Access Management",
      "text": "Least privilege in IaM permissions",
      "description": "When assigning a role to a user, group, or application, grant that security principal only those permissions that are necessary for them to perform their tasks. Limiting access to resources helps prevent both unintentional and malicious misuse of your data.",
      "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6",
      "severity": "Medium"
    },
    {
      "category": "Security", "subcategory": "Identity and Access Management",
      "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.",
      "description": "A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS is analogous to a service SAS in terms of its scope and function, but offers security benefits over the service SAS. ",
      "guid": "55461e1a-3e34-453a-9c86-39648b652d6c",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas"
    },
    {
      "category": "Security", "subcategory": "Identity and Access Management",
      "text": "Consider disabling storage account keys, so that only AAD access (and user delegation SAS) is supported.",
      "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on AAD authentication makes it easier to tie storage access to a user. ",
      "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21",
      "severity": "High",
      "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key"
    },
    {
      "category": "Security", "subcategory": "Monitoring",
      "text": "Consider using Azure Monitor to audit control plane operations on the storage account",
      "description": "Use Activity Log data to identify 'when', 'who', 'what' and 'how' the security of your storage account is being viewed or changed (i.e. storage account keys, access policies, etc.).",
      "guid": "d7999a64-6f43-489a-af42-c78e78c06a73",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity"
    },
    {
      "category": "Security", "subcategory": "Identity and Access Management",
      "text": "When using storage account keys, consider enabling a 'key expiration policy'",
      "description": "A key expiration policy enables you to set a reminder for the rotation of the account access keys. The reminder is displayed if the specified interval has elapsed and the keys have not yet been rotated.",
      "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy"
    },
    {
      "category": "Security", "subcategory": "Identity and Access Management",
      "text": "Consider configuring an SAS expiration policy",
      "description": "A SAS expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning.",
      "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy"
    },
    {
      "category": "Security", "subcategory": "Identity and Access Management",
      "text": "Consider linking SAS to a stored access policy",
      "description": "Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. ",
      "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy"
    },
    {
      "category": "Security", "subcategory": "CI/CD",
      "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.",
      "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36",
      "severity": "Medium",
      "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/"
    },
    {
      "category": "Security", "subcategory": "Identity and Access Management",
      "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)",
      "description": "Ideally, your application should be using a managed identity to authenticate to Azure Storage. If that is not possible, consider having the storage credential (connection string, storage account key, SAS, service principal credential) in Azure KeyVault or an equivalent service.",
      "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys"
    },
    {
      "category": "Security", "subcategory": "Identity and Access Management",
      "text": "Strive for short validity periods for ad-hoc SAS",
      "description": "Use near-term expiration times on an ad hoc SAS service SAS or account SAS. In this way, even if a SAS is compromised, it's valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.",
      "guid": "27138b82-1102-4cac-9eae-01e6e842e52f",
      "severity": "High",
      "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature"
    },
    {
      "category": "Security", "subcategory": "Identity and Access Management",
      "text": "Apply a narrow scope to a SAS",
      "description": "When creating a SAS, be as specific and restrictive as possible. Prefer a SAS for a single resource and operation over a SAS which gives much broader access.",
      "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature"
    },
    {
      "category": "Security", "subcategory": "Identity and Access Management",
      "text": "Consider scoping SAS to a specific client IP address, wherever possible",
      "description": "A SAS can include parameters on which client IP addresses or address ranges are authorized to request a resource using the SAS. ",
      "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas"
    },
    {
      "category": "Security", "subcategory": "Identity and Access Management",
      "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ",
      "description": "A SAS cannot constrain how much data a client uploads; given the pricing model of amount of storage over time, it might make sense to validate whether clients uploaded maliciously large contents.",
      "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e",
      "severity": "Low"
    },
    {
      "category": "Security", "subcategory": "Identity and Access Management",
      "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.",
      "description": "When accessing blob storage via SFTP using a 'local user account', the 'usual' RBAC controls do not apply. Blob access via NFS or REST might be more restrictive than SFTP access. Unfortunately, as of early 2023, local users are the only form of identity management that is currently supported for the SFTP endpoint",
      "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model"
    },
    {
      "category": "Security", "subcategory": "Identity and Access Management",
      "text": "SFTP: The SFTP endpoint does not support POSIX-like ACLs.",
      "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization"
    },
    {
      "category": "Security", "subcategory": "Networking",
      "text": "Avoid overly broad CORS policies",
      "description": "Storage supports CORS (Cross-Origin Resource Sharing), i.e. an HTTP feature that enables web apps from a different domain to loosen the same-origin policy. When enabling CORS, keep the CorsRules to the least privilege.",
      "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3",
      "severity": "High",
      "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services"
    },
    {
      "category": "Security", "subcategory": "Confidentiality and Encryption",
      "text": "Determine how data at rest should be encrypted. Understand the thread model for data.",
      "description": "Data at rest is always encrypted server-side, and in addition might be encrypted client-side as well. Server-side encryption might happen using a platform-managed key (default) or customer-managed key. Client-side encryption might happen by either having the client supply an encryption/decryption key on a per-blob basis to Azure storage, or by completely handling encryption on the client-side. thus not relying on Azure Storage at all for confidentiality guarantees.",
      "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption"
    },
    {
      "category": "Security", "subcategory": "Confidentiality and Encryption",
      "text": "Determine which/if platform encryption should be used.",
      "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json"
    },
    {
      "category": "Security", "subcategory": "Confidentiality and Encryption",
      "text": "Determine which/if client-side encryption should be used.",
      "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29",
      "severity": "Medium",
      "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys"
    },
    {
      "category": "Security", "subcategory": "Identity and Access Management",
      "text": "Consider whether public blob access is needed, or whether it can be disabled for certain storage accounts. ",
      "description": "Leverage Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) to find storage accounts which allow anonymous blob access.",
      "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012",
      "severity": "High",
      "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account"
    }
  ]
}
checklists/avs_checklist.pt.json METASEP
{
  "metadata": {
    "name": "Revisão da solução Azure VMware"
  },
  "severities": [
    {
      "name": "Alto"
    },
    {
      "name": "Média"
    },
    {
      "name": "Baixo"
    }
  ],
  "status": [
    {
      "name": "Não verificado",
      "description": "Este cheque ainda não foi examinado."
    },
    {
      "name": "Abrir",
      "description": "Há um item de ação associado a este cheque"
    },
    {
      "name": "Cumprido",
      "description": "Esta verificação foi verificada, e não há mais itens de ação associados a ele"
    },
    {
      "name": "Não é necessário",
      "description": "Recomendação compreendida, mas não necessária pelos requisitos atuais"
    },
    {
      "name": "N/A",
      "description": "Não é aplicável para o design atual"
    }
  ],
  "categories": [
    {
      "name": "Identidade"
    },
    {
      "name": "Rede"
    },
    {
      "name": "Governança"
    },
    {
      "name": "Gestão"
    },
    {
      "name": "BCDR"
    },
    {
      "name": "Automação de plataformas"
    }
  ],
  "items": [
    {
      "category": "Identidade",
      "subcategory": "Identidade",
      "text": "Certifique-se de que os controladores de domínio adicionais sejam implantados na assinatura de identidade no Azure nativo",
      "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
      "severity": "Alto"
    },
    {
      "category": "Identidade",
      "subcategory": "Identidade",
      "text": "Garantir que os sites e serviços adicionais sejam configurados para manter as solicitações de autenticação dos recursos baseados no Azure (incluindo o Azure VMware Solution) locais para o Azure",
      "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
      "severity": "Média"
    },
    {
      "category": "Identidade",
      "subcategory": "Identidade",
      "text": "Certifique-se de que o vCenter esteja conectado ao ADDS para habilitar a autenticação com base em 'contas de usuário nomeadas'",
      "guid": "de3aad1e-7c28-4ec9-9666-b7570449a80",
      "severity": "Alto"
    },
    {
      "category": "Identidade",
      "subcategory": "Identidade",
      "text": "Certifique-se de que a conexão do vCenter para o ADDS esteja usando um protocolo seguro (LDAPS)",
      "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
      "severity": "Média"
    },
    {
      "category": "Identidade",
      "subcategory": "Identidade",
      "text": "A conta CloudAdmin no vCenter IdP é usada apenas como uma conta de emergência (break-glass)",
      "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
      "severity": "Média"
    },
    {
      "category": "Identidade",
      "subcategory": "Identidade",
      "text": "Certifique-se de que o NSX-Manager não esteja integrado ao IdP externo, pois isso NÃO é suportado no momento (mesmo que tecnicamente possível)",
      "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
      "severity": "Alto"
    },
    {
      "category": "Identidade",
      "subcategory": "Identidade",
      "text": "Tem um modelo RBAC criado para uso dentro do VMware vSphere",
      "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
      "severity": "Média"
    },
    {
      "category": "Identidade",
      "subcategory": "Identidade",
      "text": "As permissões do RBAC devem ser concedidas em grupos de ADDS e não em usuários específicos",
      "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
      "severity": "Média"
    },
    {
      "category": "Identidade",
      "subcategory": "Identidade",
      "text": "As permissões da RBAC sobre o recurso Azure VMware Solution no Azure são 'bloqueadas' para um conjunto limitado de proprietários",
      "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
      "severity": "Alto"
    },
    {
      "category": "Rede",
      "subcategory": "Arquitetura",
      "text": "É o modelo correto de conectividade Azure VMware Solution selecionado para o caso de uso do cliente em questão",
      "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
      "severity": "Alto",
      "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking"
    },
    {
      "category": "Rede",
      "subcategory": "Monitorização",
      "text": "Certifique-se de que as conexões ExpressRoute ou VPN do local para o Azure sejam monitoradas usando o 'monitor de conexão'",
      "guid": "dbf590ce-65de-48e0-9f9c-cbd468266abc",
      "severity": "Alto"
    },
    {
      "category": "Rede",
      "subcategory": "Monitorização",
      "text": "Certifique-se de que um monitor de conexão seja criado a partir de um recurso nativo do Azure para uma máquina virtual da Azure VMware Solution para monitorar a conexão expressroute back-end da Azure VMware Solution",
      "guid": "e6a84de5-df43-4d19-a248-1718d5d1e5f6",
      "severity": "Média"
    },
    {
      "category": "Rede",
      "subcategory": "Monitorização",
      "text": "Certifique-se de que um monitor de conexão seja criado a partir de um recurso no local para uma máquina virtual Azure VMware Solution para monitorar a conectividade final de 2 extremidades",
      "guid": "25659d35-58fd-4772-99c9-31112d027fe4",
      "severity": "Média"
    },
    {
      "category": "Rede",
      "subcategory": "Roteamento",
      "text": "Quando o servidor de rota for usado, certifique-se de que não mais 200 rotas sejam propagadas do servidor de rota para o gateway ExR para o limite ars (limite ARS). Importante ao usar o MoN",
      "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
      "severity": "Alto"
    },
    {
      "category": "Governança",
      "subcategory": "Segurança (identidade)",
      "text": "É o Gerenciamento de Identidade Privilegiado implementado para funções que gerenciam o recurso Azure VMware Solution no Portal Azure (sem permissões permanentes permitidas)",
      "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
      "severity": "Alto"
    },
    {
      "category": "Governança",
      "subcategory": "Segurança (identidade)",
      "text": "É o relatório de auditoria privileged Identity Management implementado para as funções PIM da Azure VMware Solution",
      "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
      "severity": "Alto"
    },
    {
      "category": "Governança",
      "subcategory": "Segurança (identidade)",
      "text": "Limitar o uso da conta CloudAdmin apenas para acesso de emergência",
      "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
      "severity": "Alto"
    },
    {
      "category": "Governança",
      "subcategory": "Segurança (identidade)",
      "text": "Crie funções rbac personalizadas no vCenter para implementar um modelo de menor privilégio dentro do vCenter",
      "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
      "severity": "Média"
    },
    {
      "category": "Governança",
      "subcategory": "Segurança (identidade)",
      "text": "É um processo definido para girar regularmente as credenciais de cloudadmin (vCenter) e admin (NSX)",
      "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
      "severity": "Média"
    },
    {
      "category": "Governança",
      "subcategory": "Segurança (identidade)",
      "text": "Use um provedor de identidade centralizado para ser usado para cargas de trabalho (VM's) em execução na Solução Azure VMware",
      "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
      "severity": "Alto"
    },
    {
      "category": "Governança",
      "subcategory": "Segurança (rede)",
      "text": "É a filtragem de tráfego Leste-Oeste implementada dentro do NSX-T",
      "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
      "severity": "Média"
    },
    {
      "category": "Governança",
      "subcategory": "Segurança (rede)",
      "text": "As cargas de trabalho no Azure VMware Solution não estão diretamente expostas à internet. O tráfego é filtrado e inspecionado por soluções do Azure Application Gateway, Azure Firewall ou 3ª parte",
      "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
      "severity": "Alto"
    },
    {
      "category": "Governança",
      "subcategory": "Segurança (rede)",
      "text": "Auditoria e registro é implementado para solicitações de internet de entrada para a Azure VMware Solution e a Azure VMware Solution cargas de trabalho baseadas",
      "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
      "severity": "Alto"
    },
    {
      "category": "Governança",
      "subcategory": "Segurança (rede)",
      "text": "O monitoramento de sessões é implementado para conexões de internet de saída da Azure VMware Solution ou do Azure VMware Solution para identificar atividades suspeitas/maliciosas",
      "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
      "severity": "Média"
    },
    {
      "category": "Governança",
      "subcategory": "Segurança (rede)",
      "text": "É a proteção padrão DDoS habilitada na sub-rede ExR/VPN Gateway no Azure",
      "guid": "334fdf91-c234-4182-a652-75269440b4be",
      "severity": "Média"
    },
    {
      "category": "Governança",
      "subcategory": "Segurança (rede)",
      "text": "Use uma estação de trabalho de acesso privilegiado dedicada (PAW) para gerenciar a Solução VMware Azure, o vCenter, o gerente da NSX e o gerenciador HCX",
      "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
      "severity": "Média"
    },
    {
      "category": "Governança",
      "subcategory": "Segurança (convidado/VM)",
      "text": "Habilite a detecção avançada de ameaças (MDfC aka ASC) para cargas de trabalho em execução na Solução Azure VMware",
      "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
      "severity": "Média"
    },
    {
      "category": "Governança",
      "subcategory": "Segurança (convidado/VM)",
      "text": "Use o Azure ARC for Servers para governar adequadamente as cargas de trabalho em execução na Solução Azure VMware usando tecnologias nativas do Azure (O Azure ARC for Azure VMware Solution ainda não está disponível)",
      "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
      "severity": "Média"
    },
    {
      "category": "Governança",
      "subcategory": "Segurança (convidado/VM)",
      "text": "Certifique-se de que as cargas de trabalho no Azure VMware Solution usem criptografia de dados suficiente durante o tempo de execução (como criptografia de disco no hóspede e SQL TDE). (a criptografia vSAN em repouso é padrão)",
      "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
      "severity": "Baixo"
    },
    {
      "category": "Governança",
      "subcategory": "Segurança (convidado/VM)",
      "text": "Quando a criptografia no hóspede é usada, armazene chaves de criptografia no cofre do Azure Key quando possível",
      "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
      "severity": "Baixo"
    },
    {
      "category": "Governança",
      "subcategory": "Segurança (convidado/VM)",
      "text": "Certifique-se de que o suporte a atualização de segurança estendida esteja configurado para cargas de trabalho em execução na Solução Azure VMware (Azure VMware Solution é elegível para a ESU)",
      "guid": "5ac94222-3e13-4810-9230-81a941741583",
      "severity": "Alto"
    },
    {
      "category": "Governança",
      "subcategory": "Governança (plataforma)",
      "text": "Certifique-se de que a política de armazenamento de modelo VM apropriada seja usada",
      "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
      "severity": "Alto"
    },
    {
      "category": "Governança",
      "subcategory": "Governança (plataforma)",
      "text": "Certifique-se de que você solicitou cota suficiente, garantindo que você tenha considerado o requisito de crescimento e recuperação de desastres",
      "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
      "severity": "Baixo"
    },
    {
      "category": "Governança",
      "subcategory": "Governança (plataforma)",
      "text": "Certifique-se de que a política de não tolerar está em vigor para atender às suas necessidades de armazenamento vSAN",
      "guid": "d88408f3-7273-44c8-96ba-280214590146",
      "severity": "Alto"
    },
    {
      "category": "Governança",
      "subcategory": "Governança (plataforma)",
      "text": "Certifique-se de que as restrições de acesso ao ESXi sejam compreendidas, existem limites de acesso que podem afetar soluções de terceiros.",
      "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
      "severity": "Média"
    },
    {
      "category": "Governança",
      "subcategory": "Governança (plataforma)",
      "text": "Certifique-se de que você tenha uma política em torno da densidade e eficiência do host ESXi, tendo em mente o tempo de liderança para solicitar novos nódulos",
      "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
      "severity": "Baixo"
    },
    {
      "category": "Governança",
      "subcategory": "Governança (plataforma)",
      "text": "Certifique-se de que um bom processo de gerenciamento de custos esteja em vigor para a Solução Azure VMware - Azure Cost Management pode ser usado",
      "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
      "severity": "Média"
    },
    {
      "category": "Governança",
      "subcategory": "Governança (plataforma)",
      "text": "São instâncias reservadas do Azure usadas para otimizar custos para o uso da Solução VMware Azure",
      "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
      "severity": "Baixo"
    },
    {
      "category": "Governança",
      "subcategory": "Governança (plataforma)",
      "text": "Considere o uso do Azure Private-Link ao usar outros Serviços Nativos do Azure",
      "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
      "severity": "Média"
    },
    {
      "category": "Governança",
      "subcategory": "Governança (convidado/VM)",
      "text": "Habilite o Microsoft Defender for Cloud for Azure VMware Solution com cargas de trabalho VM",
      "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
      "severity": "Média"
    },
    {
      "category": "Governança",
      "subcategory": "Governança (convidado/VM)",
      "text": "Use servidores habilitados para ARC do Azure para gerenciar suas cargas de trabalho VM convidadas da Azure VMware Solution",
      "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
      "severity": "Média"
    },
    {
      "category": "Governança",
      "subcategory": "Governança (convidado/VM)",
      "text": "Habilite o diagnóstico e o registro métrico na solução Azure VMware",
      "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
      "severity": "Alto"
    },
    {
      "category": "Governança",
      "subcategory": "Governança (convidado/VM)",
      "text": "Implante os agentes de análise de log para as cargas de trabalho VM convidadas da Azure VMware Solution",
      "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
      "severity": "Média"
    },
    {
      "category": "Governança",
      "subcategory": "Governança (convidado/VM)",
      "text": "Certifique-se de ter uma política de backup documentada e implementada e uma solução para cargas de trabalho VM da Azure VMware Solution",
      "guid": "589d457a-927c-4397-9d11-02cad6aa11e",
      "severity": "Média"
    },
    {
      "category": "Governança",
      "subcategory": "Conformidade",
      "text": "Use o MDfC para monitorar a conformidade das cargas de trabalho em execução na Solução VMware Azure",
      "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
      "severity": "Média"
    },
    {
      "category": "Governança",
      "subcategory": "Conformidade",
      "text": "As linhas de base de conformidade aplicáveis são adicionadas ao MDfC",
      "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
      "severity": "Média"
    },
    {
      "category": "Governança",
      "subcategory": "Conformidade",
      "text": "Foi avaliada a residência de dados ao selecionar regiões do Azure para usar para implantação da Solução VMware Azure",
      "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
      "severity": "Alto"
    },
    {
      "category": "Governança",
      "subcategory": "Conformidade",
      "text": "As implicações do processamento de dados (modelo de consumidor de serviços/ prestador de serviços) são claras e documentadas",
      "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
      "severity": "Alto"
    },
    {
      "category": "Gestão",
      "subcategory": "Monitorização",
      "text": "Crie dashboards para habilitar insights principais de monitoramento da Solução VMware do Azure",
      "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
      "severity": "Alto"
    },
    {
      "category": "Gestão",
      "subcategory": "Monitorização",
      "text": "Crie alertas para limiares críticos para alerta automático sobre o desempenho da solução Azure VMware (CPU >80%, Avg Memory >80%, vSAN >70%)",
      "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
      "severity": "Alto"
    },
    {
      "category": "Gestão",
      "subcategory": "Monitorização",
      "text": "Certifique-se de que o alerta crítico seja criado para monitorar se o consumo de vSAN estiver abaixo de 75%, pois este é um limite de suporte da VMware",
      "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
      "severity": "Alto"
    },
    {
      "category": "Gestão",
      "subcategory": "Monitorização",
      "text": "Certifique-se de que os alertas sejam configurados para alertas e notificações do Azure Service Health",
      "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
      "severity": "Alto"
    },
    {
      "category": "Gestão",
      "subcategory": "Monitorização",
      "text": "Configure o login da Solução VMware Azure para ser enviado para uma conta de armazenamento azure ou Azure EventHub para processamento",
      "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
      "severity": "Média"
    },
    {
      "category": "Gestão",
      "subcategory": "Monitorização",
      "text": "Se for necessário um insight profundo no VMware vSphere: o vRealize Operations e/ou o vRealize Network Insights são usados na solução?",
      "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
      "severity": "Baixo"
    },
    {
      "category": "Gestão",
      "subcategory": "Operações",
      "text": "Certifique-se de que a política de armazenamento vSAN para VM's NÃO é a política de armazenamento padrão, pois esta política aplica um provisionamento espesso",
      "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
      "severity": "Alto"
    },
    {
      "category": "Gestão",
      "subcategory": "Operações",
      "text": "Certifique-se de que as bibliotecas de conteúdo vSphere não sejam colocadas no vSAN, pois o vSAN é um recurso finito",
      "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
      "severity": "Média"
    },
    {
      "category": "Gestão",
      "subcategory": "Operações",
      "text": "Certifique-se de que os repositórios de dados para a solução de backup sejam armazenados fora do armazenamento vSAN. Seja em nativo do Azure ou em um armazenamento de dados apoiado por pool de discos",
      "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
      "severity": "Média"
    },
    {
      "category": "Gestão",
      "subcategory": "Operações",
      "text": "Certifique-se de que as cargas de trabalho em execução no Azure VMware Solution sejam gerenciadas por híbridos usando o Azure ARC for Servers (ARC for Azure VMware Solution ainda não está disponível)",
      "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
      "severity": "Média"
    },
    {
      "category": "Gestão",
      "subcategory": "Operações",
      "text": "Certifique-se de que as cargas de trabalho em execução no Azure VMware Solution sejam monitoradas usando a Azure Log Analytics e o Azure Monitor",
      "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
      "severity": "Média"
    },
    {
      "category": "Gestão",
      "subcategory": "Operações",
      "text": "Inclua cargas de trabalho em execução no Azure VMware Solution na ferramenta de gerenciamento de atualizações existente ou no Azure Update Management",
      "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
      "severity": "Média"
    },
    {
      "category": "Gestão",
      "subcategory": "Operações",
      "text": "Use a política do Azure para a bordo das cargas de trabalho da Azure VMware Solution nas soluções de Gerenciamento, Monitoramento e Segurança do Azure",
      "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
      "severity": "Média"
    },
    {
      "category": "Gestão",
      "subcategory": "Operações",
      "text": "Quando o ANF for usado para estender o armazenamento para o Azure VMware Solution, certifique-se de que ele seja usado no nível VM apenas por enquanto (ANF como o datastore NFS ainda está em visualização privada)",
      "guid": "ab79b188-dab8-4193-8c9f-c9d1bb77036f",
      "severity": "Alto"
    },
    {
      "category": "Gestão",
      "subcategory": "Segurança",
      "text": "Certifique-se de que as cargas de trabalho em execução no Azure VMware Solution estejam embarcadas no Microsoft Defender for Cloud",
      "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
      "severity": "Média"
    },
    {
      "category": "BCDR",
      "subcategory": "Backup",
      "text": "Certifique-se de que os backups não sejam armazenados no vSAN, pois o vSAN é um recurso finito",
      "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
      "severity": "Média"
    },
    {
      "category": "BCDR",
      "subcategory": "Recuperação de desastres",
      "text": "Use o VMware Site Recovery Manager quando ambos os sites são a solução Azure VMware",
      "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
      "severity": "Média"
    },
    {
      "category": "BCDR",
      "subcategory": "Recuperação de desastres",
      "text": "Use a recuperação do local do Azure quando a tecnologia de recuperação de desastres for nativa do Azure IaaS",
      "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
      "severity": "Média"
    },
    {
      "category": "BCDR",
      "subcategory": "Recuperação de desastres",
      "text": "Use planos de recuperação automatizados com qualquer uma das soluções de desastre, evite tarefas manuais tanto quanto possível",
      "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
      "severity": "Alto"
    },
    {
      "category": "BCDR",
      "subcategory": "Recuperação de desastres",
      "text": "Use o par de região geopolítica como ambiente secundário de recuperação de desastres",
      "guid": "8255461e-2aee-4345-9aec-8339248b262d",
      "severity": "Média"
    },
    {
      "category": "BCDR",
      "subcategory": "Recuperação de desastres",
      "text": "Utilize 2 espaços de endereço diferentes entre as regiões, por exemplo: 10.0.0.0/16 e 192.168.0.0/16 para as diferentes regiões",
      "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
      "severity": "Alto"
    },
    {
      "category": "BCDR",
      "subcategory": "Recuperação de desastres",
      "text": "O ExpressRoute Global Reach será usado para conectividade entre as nuvens privadas da solução principal e secundária Azure VMware ou o roteamento é feito através de aparelhos virtuais de rede?",
      "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
      "severity": "Média"
    },
    {
      "category": "BCDR",
      "subcategory": "Continuidade de Negócios",
      "text": "Use o MABS como sua solução de backup",
      "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
      "severity": "Média"
    },
    {
      "category": "BCDR",
      "subcategory": "Continuidade de Negócios",
      "text": "Implante sua solução de backup na mesma região que sua nuvem privada Azure VMware Solution",
      "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
      "severity": "Média"
    },
    {
      "category": "BCDR",
      "subcategory": "Continuidade de Negócios",
      "text": "Preferencialmente implantar MABS fora do SDDC como Azure IaaS nativo",
      "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
      "severity": "Média"
    },
    {
      "category": "BCDR",
      "subcategory": "Continuidade de Negócios",
      "text": "É um processo em vigor para solicitar uma restauração dos componentes VMware gerenciados pela Plataforma Azure?",
      "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
      "severity": "Baixo"
    },
    {
      "category": "Automação de plataformas",
      "subcategory": "Estratégia de implantação",
      "text": "Para implantações manuais, todas as configurações e implantações devem ser documentadas",
      "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
      "severity": "Baixo"
    },
    {
      "category": "Automação de plataformas",
      "subcategory": "Estratégia de implantação",
      "text": "Para implantações manuais, considere implementar bloqueios de recursos para evitar ações acidentais em sua Azure VMware Solution Private Cloud",
      "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
      "severity": "Baixo"
    },
    {
      "category": "Automação de plataformas",
      "subcategory": "Implantação automatizada",
      "text": "Para implantações automatizadas, implante uma nuvem e escala privada mínimas conforme necessário",
      "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
      "severity": "Baixo"
    },
    {
      "category": "Automação de plataformas",
      "subcategory": "Implantação automatizada",
      "text": "Para implantações automatizadas, solicite ou reserve cota antes de iniciar a implantação",
      "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
      "severity": "Baixo"
    },
    {
      "category": "Automação de plataformas",
      "subcategory": "Implantação automatizada",
      "text": "Para implantação automatizada, certifique-se de que os bloqueios de recursos relevantes sejam criados através da automação ou através da Política Azure para uma governança adequada",
      "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
      "severity": "Baixo"
    },
    {
      "category": "Automação de plataformas",
      "subcategory": "Conectividade automatizada",
      "text": "Implementar nomes compreensível humanos para chaves de autorização ExR para permitir a fácil identificação do propósito/uso das chaves",
      "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
      "severity": "Baixo"
    },
    {
      "category": "Automação de plataformas",
      "subcategory": "Conectividade automatizada",
      "text": "Use o cofre key para armazenar segredos e chaves de autorização quando os princípios de serviço separados forem usados para implantar a Solução Azure VMware e o ExpressRoute",
      "guid": "255461e2-aee3-4553-afc8-339248b262d6",
      "severity": "Baixo"
    },
    {
      "category": "Automação de plataformas",
      "subcategory": "Conectividade automatizada",
      "text": "Defina dependências de recursos para ações serializadoras no IaC quando muitos recursos precisam ser implantados em/no Azure VMware Solution, pois o Azure VMware Solution só suporta um número limitado de operações paralelas.",
      "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
      "severity": "Baixo"
    },
    {
      "category": "Automação de plataformas",
      "subcategory": "Conectividade automatizada",
      "text": "Ao executar a configuração automatizada dos segmentos NSX-T com um único gateway Tier-1, use APIs do Portal Azure em vez de APIs NSX-Manager",
      "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
      "severity": "Baixo"
    },
    {
      "category": "Automação de plataformas",
      "subcategory": "Escala automatizada",
      "text": "Ao pretender usar scale-out automatizado, certifique-se de solicitar a cota suficiente da Solução Azure VMware para as assinaturas que executam a Solução Azure VMware",
      "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
      "severity": "Média"
    },
    {
      "category": "Automação de plataformas",
      "subcategory": "Escala automatizada",
      "text": "Ao pretender usar o scale-in automatizado, certifique-se de levar em conta os requisitos da política de armazenamento antes de realizar tal ação",
      "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
      "severity": "Média"
    },
    {
      "category": "Automação de plataformas",
      "subcategory": "Escala automatizada",
      "text": "As operações de dimensionamento sempre precisam ser serializadas dentro de um único SDDC, pois apenas uma operação de escala pode ser realizada de cada vez (mesmo quando vários clusters são usados)",
      "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
      "severity": "Média"
    },
    {
      "category": "Automação de plataformas",
      "subcategory": "Escala automatizada",
      "text": "Considere e valide as operações de dimensionamento em soluções de terceiros usadas na arquitetura (suportadas ou não)",
      "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
      "severity": "Média"
    },
    {
      "category": "Automação de plataformas",
      "subcategory": "Escala automatizada",
      "text": "Defina e imponha limites máximos de entrada/saída de escala para o seu ambiente nas automações",
      "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
      "severity": "Média"
    },
    {
      "category": "Automação de plataformas",
      "subcategory": "Escala automatizada",
      "text": "Implementar regras de monitoramento para monitorar operações automatizadas de dimensionamento e monitorar o sucesso e a falha para permitir respostas apropriadas (automatizadas)",
      "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
      "severity": "Média"
    }
  ]
}

checklists/avs_checklist.ko.json METASEP
{
  "metadata": {
    "name": "Azure VMware Solution Review"
  },
  "severities": [
    {
      "name": "높다"
    },
    {
      "name": "보통"
    },
    {
      "name": "낮다"
    }
  ],
  "status": [
    {
      "name": "확인되지 않음",
      "description": "이 검사는 아직 검토되지 않았습니다."
    },
    {
      "name": "열다",
      "description": "이 검사와 연관된 작업 항목이 있습니다."
    },
    {
      "name": "성취",
      "description": "이 검사가 확인되었으며 연관된 추가 작업 항목이 없습니다."
    },
    {
      "name": "필요하지 않음",
      "description": "권장 사항은 이해되었지만 현재 요구 사항에는 필요하지 않습니다."
    },
    {
      "name": "해당 없음",
      "description": "현재 설계에는 적용되지 않음"
    }
  ],
  "categories": [
    {
      "name": "신원"
    },
    {
      "name": "네트워킹"
    },
    {
      "name": "거버넌스"
    },
    {
      "name": "경영"
    },
    {
      "name": "증권 시세 표시기"
    },
    {
      "name": "플랫폼 자동화"
    }
  ],
  "items": [
    {
      "category": "신원",
      "subcategory": "신원",
      "text": "ADD 도메인 컨트롤러가 네이티브 Azure의 ID 구독에 배포되었는지 확인",
      "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
      "severity": "높다"
    },
    {
      "category": "신원",
      "subcategory": "신원",
      "text": "ADD 사이트 및 서비스가 Azure 기반 리소스(Azure VMware 솔루션 포함)의 인증 요청을 Azure에 로컬로 유지하도록 구성되었는지 확인",
      "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
      "severity": "보통"
    },
    {
      "category": "신원",
      "subcategory": "신원",
      "text": "vCenter가 ADS에 연결되어 '명명된 사용자 계정'을 기반으로 인증을 사용하도록 설정되어 있는지 확인합니다.",
      "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
      "severity": "높다"
    },
    {
      "category": "신원",
      "subcategory": "신원",
      "text": "vCenter에서 ADADDS로의 연결이 LDAPS(보안 프로토콜)를 사용하고 있는지 확인합니다.",
      "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
      "severity": "보통"
    },
    {
      "category": "신원",
      "subcategory": "신원",
      "text": "vCenter IdP의 CloudAdmin 계정은 긴급 계정으로만 사용됩니다(브레이크 글래스).",
      "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
      "severity": "보통"
    },
    {
      "category": "신원",
      "subcategory": "신원",
      "text": "NSX-Manager가 외부 IdP와 통합되지 않았는지 확인하십시오 (기술적으로 가능하더라도) 현재 지원되지 않습니다.",
      "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
      "severity": "높다"
    },
    {
      "category": "신원",
      "subcategory": "신원",
      "text": "VMware vSphere 내에서 사용할 RBAC 모델이 생성되었습니다.",
      "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
      "severity": "보통"
    },
    {
      "category": "신원",
      "subcategory": "신원",
      "text": "RBAC 권한은 특정 사용자가 아닌 ADD 그룹에 부여되어야 합니다.",
      "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
      "severity": "보통"
    },
    {
      "category": "신원",
      "subcategory": "신원",
      "text": "Azure의 Azure VMware 솔루션 리소스에 대한 RBAC 권한은 제한된 소유자 집합에게만 '잠겨' 있습니다.",
      "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
      "severity": "높다"
    },
    {
      "category": "네트워킹",
      "subcategory": "건축학",
      "text": "고객 사용 사례에 대해 올바른 Azure VMware 솔루션 연결 모델이 선택되었습니까?",
      "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
      "severity": "높다",
      "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking"
    },
    {
      "category": "네트워킹",
      "subcategory": "모니터링",
      "text": "'연결 모니터'를 사용하여 온-프레미스에서 Azure로의 ExpressRoute 또는 VPN 연결이 모니터링되는지 확인",
      "guid": "dbf590ce-65de-48e0-9f9c-cbd468266abc",
      "severity": "높다"
    },
    {
      "category": "네트워킹",
      "subcategory": "모니터링",
      "text": "Azure VMware 솔루션 백 엔드 ExpressRoute 연결을 모니터링하기 위해 Azure 네이티브 리소스에서 Azure VMware 솔루션 가상 머신으로의 연결 모니터가 생성되었는지 확인합니다.",
      "guid": "e6a84de5-df43-4d19-a248-1718d5d1e5f6",
      "severity": "보통"
    },
    {
      "category": "네트워킹",
      "subcategory": "모니터링",
      "text": "온-프레미스 리소스에서 Azure VMware 솔루션 가상 머신으로 연결 모니터가 생성되어 종단 2-엔드 연결을 모니터링하는지 확인합니다.",
      "guid": "25659d35-58fd-4772-99c9-31112d027fe4",
      "severity": "보통"
    },
    {
      "category": "네트워킹",
      "subcategory": "라우팅",
      "text": "경로 서버를 사용하는 경우 경로 서버에서 ExR 게이트웨이로 200개의 경로가 온-프레미스(ARS 제한)로 전파되지 않도록 합니다. MoN을 사용할 때 중요합니다.",
      "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
      "severity": "높다"
    },
    {
      "category": "거버넌스",
      "subcategory": "보안(신원)",
      "text": "Azure 포털에서 Azure VMware 솔루션 리소스를 관리하는 역할에 대해 권한 있는 ID 관리가 구현됩니까(고정 권한이 허용되지 않음).",
      "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
      "severity": "높다"
    },
    {
      "category": "거버넌스",
      "subcategory": "보안(신원)",
      "text": "Azure VMware 솔루션 PIM 역할에 대해 권한 있는 ID 관리 감사 보고가 구현되어 있습니까?",
      "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
      "severity": "높다"
    },
    {
      "category": "거버넌스",
      "subcategory": "보안(신원)",
      "text": "CloudAdmin 계정의 사용을 긴급 액세스로만 제한",
      "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
      "severity": "높다"
    },
    {
      "category": "거버넌스",
      "subcategory": "보안(신원)",
      "text": "vCenter에서 사용자 지정 RBAC 역할을 만들어 vCenter 내에서 최소 권한 모델을 구현합니다.",
      "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
      "severity": "보통"
    },
    {
      "category": "거버넌스",
      "subcategory": "보안(신원)",
      "text": "클라우드 관리자(vCenter) 및 관리자(NSX) 자격 증명을 정기적으로 교체하도록 정의된 프로세스입니다.",
      "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
      "severity": "보통"
    },
    {
      "category": "거버넌스",
      "subcategory": "보안(신원)",
      "text": "중앙 집중식 ID 공급자를 사용하여 Azure VMware 솔루션에서 실행되는 워크로드(VM)에 사용됩니다.",
      "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
      "severity": "높다"
    },
    {
      "category": "거버넌스",
      "subcategory": "보안(네트워크)",
      "text": "동서 트래픽 필터링이 NSX-T 내에서 구현되고 있습니까?",
      "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
      "severity": "보통"
    },
    {
      "category": "거버넌스",
      "subcategory": "보안(네트워크)",
      "text": "Azure VMware 솔루션의 워크로드는 인터넷에 직접 노출되지 않습니다. 트래픽은 Azure 응용 프로그램 게이트웨이, Azure 방화벽 또는 제3자 솔루션에 의해 필터링되고 검사됩니다.",
      "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
      "severity": "높다"
    },
    {
      "category": "거버넌스",
      "subcategory": "보안(네트워크)",
      "text": "감사 및 로깅은 Azure VMware 솔루션 및 Azure VMware 솔루션 기반 워크로드에 대한 인바운드 인터넷 요청에 대해 구현됩니다.",
      "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
      "severity": "높다"
    },
    {
      "category": "거버넌스",
      "subcategory": "보안(네트워크)",
      "text": "세션 모니터링은 의심스럽거나 악의적인 활동을 식별하기 위해 Azure VMware 솔루션 또는 Azure VMware 솔루션 기반 워크로드의 아웃바운드 인터넷 연결에 대해 구현됩니다.",
      "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
      "severity": "보통"
    },
    {
      "category": "거버넌스",
      "subcategory": "보안(네트워크)",
      "text": "Azure의 ExR/VPN 게이트웨이 서브넷에서 DDoS 표준 보호를 사용하도록 설정되어 있습니까?",
      "guid": "334fdf91-c234-4182-a652-75269440b4be",
      "severity": "보통"
    },
    {
      "category": "거버넌스",
      "subcategory": "보안(네트워크)",
      "text": "전용 PAW(권한 있는 액세스 워크스테이션)를 사용하여 Azure VMware 솔루션, vCenter, NSX 관리자 및 HCX 관리자를 관리합니다.",
      "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
      "severity": "보통"
    },
    {
      "category": "거버넌스",
      "subcategory": "보안(게스트/VM)",
      "text": "Azure VMware 솔루션에서 실행되는 워크로드에 대해 고급 위협 탐지(MDfC 일명 ASC)를 사용하도록 설정합니다.",
      "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
      "severity": "보통"
    },
    {
      "category": "거버넌스",
      "subcategory": "보안(게스트/VM)",
      "text": "서버용 Azure ARC를 사용하여 Azure 네이티브 기술을 사용하여 Azure VMware 솔루션에서 실행되는 워크로드를 적절하게 제어합니다(Azure VMware 솔루션용 Azure ARC는 아직 사용할 수 없음).",
      "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
      "severity": "보통"
    },
    {
      "category": "거버넌스",
      "subcategory": "보안(게스트/VM)",
      "text": "Azure VMware 솔루션의 워크로드가 런타임 중에 충분한 데이터 암호화(예: 게스트 내 디스크 암호화 및 SQL TDE)를 사용하는지 확인합니다. (미사용 vSAN 암호화가 기본값임)",
      "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
      "severity": "낮다"
    },
    {
      "category": "거버넌스",
      "subcategory": "보안(게스트/VM)",
      "text": "게스트 내 암호화가 사용되는 경우 가능한 경우 암호화 키를 Azure Key 자격 증명 모음에 저장합니다.",
      "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
      "severity": "낮다"
    },
    {
      "category": "거버넌스",
      "subcategory": "보안(게스트/VM)",
      "text": "Azure VMware 솔루션에서 실행되는 워크로드에 대해 확장된 보안 업데이트 지원이 구성되었는지 확인(Azure VMware 솔루션은 ESU에 적합함)",
      "guid": "5ac94222-3e13-4810-9230-81a941741583",
      "severity": "높다"
    },
    {
      "category": "거버넌스",
      "subcategory": "거버넌스(플랫폼)",
      "text": "적절한 VM 템플릿 저장소 정책이 사용되는지 확인",
      "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
      "severity": "높다"
    },
    {
      "category": "거버넌스",
      "subcategory": "거버넌스(플랫폼)",
      "text": "충분한 할당량을 요청했는지 확인하여 성장 및 재해 복구 요구 사항을 고려했는지 확인하십시오.",
      "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
      "severity": "낮다"
    },
    {
      "category": "거버넌스",
      "subcategory": "거버넌스(플랫폼)",
      "text": "허용 실패 허용 정책이 vSAN 스토리지 요구 사항을 충족하는지 확인합니다.",
      "guid": "d88408f3-7273-44c8-96ba-280214590146",
      "severity": "높다"
    },
    {
      "category": "거버넌스",
      "subcategory": "거버넌스(플랫폼)",
      "text": "ESXi에 대한 액세스 제약 조건을 이해하고 제3자 솔루션에 영향을 줄 수 있는 액세스 제한이 있는지 확인합니다.",
      "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
      "severity": "보통"
    },
    {
      "category": "거버넌스",
      "subcategory": "거버넌스(플랫폼)",
      "text": "ESXi 호스트 밀도 및 효율성에 대한 정책이 있는지 확인하고 새 노드를 요청하는 리드 타임을 염두에 두어야 합니다.",
      "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
      "severity": "낮다"
    },
    {
      "category": "거버넌스",
      "subcategory": "거버넌스(플랫폼)",
      "text": "Azure VMware 솔루션에 대한 우수한 비용 관리 프로세스가 마련되어 있는지 확인 - Azure 비용 관리를 사용할 수 있습니다.",
      "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
      "severity": "보통"
    },
    {
      "category": "거버넌스",
      "subcategory": "거버넌스(플랫폼)",
      "text": "Azure VMware 솔루션 사용 비용을 최적화하는 데 사용되는 Azure 예약 인스턴스입니까?",
      "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
      "severity": "낮다"
    },
    {
      "category": "거버넌스",
      "subcategory": "거버넌스(플랫폼)",
      "text": "다른 Azure 네이티브 서비스를 사용할 때 Azure 개인 링크의 사용을 고려하십시오.",
      "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
      "severity": "보통"
    },
    {
      "category": "거버넌스",
      "subcategory": "거버넌스(게스트/VM)",
      "text": "Microsoft Defender for Cloud for Azure VMware Solution 게스트 VM 워크로드 사용",
      "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
      "severity": "보통"
    },
    {
      "category": "거버넌스",
      "subcategory": "거버넌스(게스트/VM)",
      "text": "Azure ARC 사용 서버를 사용하여 Azure VMware 솔루션 게스트 VM 워크로드 관리",
      "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
      "severity": "보통"
    },
    {
      "category": "거버넌스",
      "subcategory": "거버넌스(게스트/VM)",
      "text": "Azure VMware 솔루션에서 진단 및 메트릭 로깅 사용",
      "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
      "severity": "높다"
    },
    {
      "category": "거버넌스",
      "subcategory": "거버넌스(게스트/VM)",
      "text": "로그 분석 에이전트를 Azure VMware 솔루션 게스트 VM 워크로드에 배포",
      "guid": "4ed90대-2cc8-44c4-9b6b-781cbafe6c46",
      "severity": "보통"
    },
    {
      "category": "거버넌스",
      "subcategory": "거버넌스(게스트/VM)",
      "text": "Azure VMware 솔루션 VM 워크로드에 대해 문서화되고 구현된 백업 정책 및 솔루션이 있는지 확인합니다.",
      "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
      "severity": "보통"
    },
    {
      "category": "거버넌스",
      "subcategory": "컴플라이언스",
      "text": "Azure VMware 솔루션에서 실행되는 워크로드의 규정 준수 모니터링을 위해 MDfC를 사용합니다.",
      "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
      "severity": "보통"
    },
    {
      "category": "거버넌스",
      "subcategory": "컴플라이언스",
      "text": "적용 가능한 규정 준수 기준선이 MDfC에 추가되었는지 여부",
      "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
      "severity": "보통"
    },
    {
      "category": "거버넌스",
      "subcategory": "컴플라이언스",
      "text": "Azure VMware 솔루션 배포에 사용할 Azure 지역을 선택할 때 데이터 상주가 평가되었습니까?",
      "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
      "severity": "높다"
    },
    {
      "category": "거버넌스",
      "subcategory": "컴플라이언스",
      "text": "데이터 처리 함의(서비스 공급자/서비스 소비자 모델)가 명확하고 문서화되어 있습니까?",
      "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
      "severity": "높다"
    },
    {
      "category": "경영",
      "subcategory": "모니터링",
      "text": "핵심 Azure VMware 솔루션 모니터링 인사이트를 사용하도록 대시보드 만들기",
      "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
      "severity": "높다"
    },
    {
      "category": "경영",
      "subcategory": "모니터링",
      "text": "Azure VMware 솔루션 성능에 대한 자동 경고에 대한 중요 임계값에 대한 경고 경고 만들기(CPU >80%, 평균 메모리 >80%, vSAN >70%)",
      "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
      "severity": "높다"
    },
    {
      "category": "경영",
      "subcategory": "모니터링",
      "text": "VMware의 지원 임계값이므로 vSAN 사용량이 75% 미만인지 모니터링하기 위해 중요 경고가 생성되었는지 확인합니다.",
      "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
      "severity": "높다"
    },
    {
      "category": "경영",
      "subcategory": "모니터링",
      "text": "Azure 서비스 상태 경고 및 알림에 대해 경고가 구성되었는지 확인",
      "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
      "severity": "높다"
    },
    {
      "category": "경영",
      "subcategory": "모니터링",
      "text": "처리를 위해 Azure 저장소 계정 또는 Azure EventHub로 보내도록 Azure VMware 솔루션 로깅을 구성합니다.",
      "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
      "severity": "보통"
    },
    {
      "category": "경영",
      "subcategory": "모니터링",
      "text": "VMware vSphere에 대한 심층적인 통찰력이 필요한 경우: vRealize Operations 및/또는 vRealize Network Insights가 솔루션에 사용됩니까?",
      "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
      "severity": "낮다"
    },
    {
      "category": "경영",
      "subcategory": "작업",
      "text": "이 정책이 씩 프로비저닝을 적용하므로 VM에 대한 vSAN 스토리지 정책이 기본 스토리지 정책이 아닌지 확인합니다.",
      "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
      "severity": "높다"
    },
    {
      "category": "경영",
      "subcategory": "작업",
      "text": "vSAN이 유한 리소스이므로 vSphere 콘텐츠 라이브러리가 vSAN에 배치되지 않는지 확인",
      "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
      "severity": "보통"
    },
    {
      "category": "경영",
      "subcategory": "작업",
      "text": "백업 솔루션에 대한 데이터 저장소가 vSAN 스토리지 외부에 저장되는지 확인합니다. Azure 네이티브 또는 디스크 풀 지원 데이터스토어에서",
      "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
      "severity": "보통"
    },
    {
      "category": "경영",
      "subcategory": "작업",
      "text": "Azure VMware 솔루션에서 실행되는 워크로드가 서버용 Azure ARC를 사용하여 하이브리드 관리되는지 확인(Azure VMware 솔루션용 ARC는 아직 사용할 수 없음)",
      "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
      "severity": "보통"
    },
    {
      "category": "경영",
      "subcategory": "작업",
      "text": "Azure VMware 솔루션에서 실행되는 워크로드가 Azure 로그 분석 및 Azure 모니터를 사용하여 모니터링되는지 확인",
      "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
      "severity": "보통"
    },
    {
      "category": "경영",
      "subcategory": "작업",
      "text": "Azure VMware 솔루션에서 실행되는 워크로드를 기존 업데이트 관리 도구 또는 Azure 업데이트 관리에 포함",
      "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
      "severity": "보통"
    },
    {
      "category": "경영",
      "subcategory": "작업",
      "text": "Azure 정책을 사용하여 Azure 관리, 모니터링 및 보안 솔루션에서 Azure VMware 솔루션 워크로드를 온보딩합니다.",
      "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
      "severity": "보통"
    },
    {
      "category": "경영",
      "subcategory": "작업",
      "text": "ANF를 사용하여 Azure VMware 솔루션에 대한 저장소를 확장하는 경우 지금은 VM 수준에서만 사용되는지 확인합니다(NFS 데이터스토어가 아직 비공개 미리 보기이므로 ANF).",
      "guid": "ab79b188-dab8-4193-8c9f-c9d1bb77036f",
      "severity": "높다"
    },
    {
      "category": "경영",
      "subcategory": "안전",
      "text": "Azure VMware 솔루션에서 실행되는 워크로드가 클라우드용 Microsoft Defender에 온보딩되었는지 확인",
      "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
      "severity": "보통"
    },
    {
      "category": "증권 시세 표시기",
      "subcategory": "백업",
      "text": "vSAN이 유한 리소스이므로 백업이 vSAN에 저장되지 않는지 확인",
      "guid": "25398e6D-B9D3-47Da-A43B-C6CD1D79A9B2",
      "severity": "보통"
    },
    {
      "category": "증권 시세 표시기",
      "subcategory": "재해 복구",
      "text": "두 사이트가 모두 Azure VMware 솔루션인 경우 VMware 사이트 복구 관리자 사용",
      "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
      "severity": "보통"
    },
    {
      "category": "증권 시세 표시기",
      "subcategory": "재해 복구",
      "text": "재해 복구 기술이 네이티브 Azure IaaS인 경우 Azure 사이트 복구 사용",
      "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
      "severity": "보통"
    },
    {
      "category": "증권 시세 표시기",
      "subcategory": "재해 복구",
      "text": "재해 솔루션 중 하나와 함께 자동 복구 계획을 사용하고 가능한 한 수동 작업을 피하십시오.",
      "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
      "severity": "높다"
    },
    {
      "category": "증권 시세 표시기",
      "subcategory": "재해 복구",
      "text": "지정학적 지역 쌍을 보조 재해 복구 환경으로 사용",
      "guid": "8255461e-2aee-4345-9aec-8339248b262d",
      "severity": "보통"
    },
    {
      "category": "증권 시세 표시기",
      "subcategory": "재해 복구",
      "text": "지역 간에 2개의 서로 다른 주소 공간 사용(예: 서로 다른 지역에 대해 10.0.0.0/16 및 192.168.0.0/16)",
      "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
      "severity": "높다"
    },
    {
      "category": "증권 시세 표시기",
      "subcategory": "재해 복구",
      "text": "ExpressRoute 글로벌 리치가 기본 및 보조 Azure VMware 솔루션 프라이빗 클라우드 간의 연결에 사용됩니까, 아니면 네트워크 가상 어플라이언스를 통해 라우팅이 수행됩니까?",
      "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
      "severity": "보통"
    },
    {
      "category": "증권 시세 표시기",
      "subcategory": "비즈니스 연속성",
      "text": "MABS를 백업 솔루션으로 사용",
      "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
      "severity": "보통"
    },
    {
      "category": "증권 시세 표시기",
      "subcategory": "비즈니스 연속성",
      "text": "Azure VMware 솔루션 프라이빗 클라우드와 동일한 지역에 백업 솔루션을 배포합니다.",
      "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
      "severity": "보통"
    },
    {
      "category": "증권 시세 표시기",
      "subcategory": "비즈니스 연속성",
      "text": "SDDC 외부에 MABS를 네이티브 Azure IaaS로 배포하는 것이 좋습니다.",
      "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
      "severity": "보통"
    },
    {
      "category": "증권 시세 표시기",
      "subcategory": "비즈니스 연속성",
      "text": "Azure 플랫폼에서 관리하는 VMware 구성 요소의 복원을 요청하는 프로세스가 마련되어 있습니까?",
      "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
      "severity": "낮다"
    },
    {
      "category": "플랫폼 자동화",
      "subcategory": "배포 전략",
      "text": "수동 배포의 경우 모든 구성 및 배포를 문서화해야 합니다.",
      "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
      "severity": "낮다"
    },
    {
      "category": "플랫폼 자동화",
      "subcategory": "배포 전략",
      "text": "수동 배포의 경우 Azure VMware 솔루션 프라이빗 클라우드에서 우발적 인 작업을 방지하기 위해 리소스 잠금을 구현하는 것이 좋습니다.",
      "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
      "severity": "낮다"
    },
    {
      "category": "플랫폼 자동화",
      "subcategory": "자동 배포",
      "text": "자동화된 배포의 경우 최소한의 프라이빗 클라우드를 배포하고 필요에 따라 확장합니다.",
      "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
      "severity": "낮다"
    },
    {
      "category": "플랫폼 자동화",
      "subcategory": "자동 배포",
      "text": "자동화된 배포의 경우 배포를 시작하기 전에 할당량을 요청하거나 예약합니다.",
      "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
      "severity": "낮다"
    },
    {
      "category": "플랫폼 자동화",
      "subcategory": "자동 배포",
      "text": "자동화된 배포의 경우 적절한 거버넌스를 위해 자동화 또는 Azure Policy를 통해 관련 리소스 잠금이 생성되는지 확인합니다.",
      "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
      "severity": "낮다"
    },
    {
      "category": "플랫폼 자동화",
      "subcategory": "자동화된 연결",
      "text": "ExR 인증 키에 대해 사람이 이해할 수 있는 이름을 구현하여 키 용도/사용을 쉽게 식별할 수 있도록 합니다.",
      "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
      "severity": "낮다"
    },
    {
      "category": "플랫폼 자동화",
      "subcategory": "자동화된 연결",
      "text": "Azure VMware 솔루션 및 ExpressRoute를 배포하는 데 별도의 서비스 원칙을 사용하는 경우 키 자격 증명 모음을 사용하여 비밀 및 권한 부여 키를 저장합니다.",
      "guid": "255461e2-aee3-4553-afc8-339248b262d6",
      "severity": "낮다"
    },
    {
      "category": "플랫폼 자동화",
      "subcategory": "자동화된 연결",
      "text": "Azure VMware 솔루션이 제한된 수의 병렬 작업만 지원하므로 Azure VMware 솔루션에 많은 리소스를 배포해야 하는 경우 IaC에서 작업을 직렬화하기 위한 리소스 종속성을 정의합니다.",
      "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
      "severity": "낮다"
    },
    {
      "category": "플랫폼 자동화",
      "subcategory": "자동화된 연결",
      "text": "단일 Tier-1 게이트웨이를 사용하여 NSX-T 세그먼트의 자동화된 구성을 수행하는 경우 NSX-Manager API 대신 Azure Portal API를 사용합니다.",
      "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
      "severity": "낮다"
    },
    {
      "category": "플랫폼 자동화",
      "subcategory": "자동화된 확장",
      "text": "자동화된 확장을 사용하려는 경우 Azure VMware 솔루션을 실행하는 구독에 대해 충분한 Azure VMware 솔루션 할당량을 신청해야 합니다.",
      "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
      "severity": "보통"
    },
    {
      "category": "플랫폼 자동화",
      "subcategory": "자동화된 확장",
      "text": "자동화된 스케일 인을 사용하려는 경우 이러한 작업을 수행하기 전에 스토리지 정책 요구 사항을 고려해야 합니다.",
      "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
      "severity": "보통"
    },
    {
      "category": "플랫폼 자동화",
      "subcategory": "자동화된 확장",
      "text": "한 번에 하나의 스케일 작업만 수행할 수 있으므로(여러 클러스터가 사용되는 경우에도) 스케일링 작업은 항상 단일 SDDC 내에서 직렬화되어야 합니다.",
      "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
      "severity": "보통"
    },
    {
      "category": "플랫폼 자동화",
      "subcategory": "자동화된 확장",
      "text": "아키텍처에서 사용되는 제3자 솔루션에 대한 크기 조정 작업을 고려하고 유효성을 검사합니다(지원 여부).",
      "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
      "severity": "보통"
    },
    {
      "category": "플랫폼 자동화",
      "subcategory": "자동화된 확장",
      "text": "자동화에서 환경에 대한 스케일 인/아웃 최대 제한을 정의하고 적용합니다.",
      "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
      "severity": "보통"
    },
    {
      "category": "플랫폼 자동화",
      "subcategory": "자동화된 확장",
      "text": "모니터링 규칙을 구현하여 자동화된 크기 조정 작업을 모니터링하고 성공 및 실패를 모니터링하여 적절한(자동화된) 응답을 사용하도록 설정합니다.",
      "guid": "1DC15A1C-075E-4E9F-841A-CCCD579376BC",
      "severity": "보통"
    }
  ]
}

checklists/avs_checklist.ja.json METASEP
{
  "metadata": {
    "name": "Azure VMware Solution Review"
  },
  "severities": [
    {
      "name": "高い"
    },
    {
      "name": "中程度"
    },
    {
      "name": "低い"
    }
  ],
  "status": [
    {
      "name": "未検証",
      "description": "このチェックはまだ見ていません"
    },
    {
      "name": "開ける",
      "description": "このチェックに関連付けられているアクションアイテムがあります"
    },
    {
      "name": "達成",
      "description": "このチェックは検証済みであり、それに関連付けられたアクションアイテムはこれ以上ありません。"
    },
    {
      "name": "必須ではありません",
      "description": "推奨事項は理解しているが、現在の要件では必要ではない"
    },
    {
      "name": "該当なし",
      "description": "現在の設計には適用されません"
    }
  ],
  "categories": [
    {
      "name": "同一性"
    },
    {
      "name": "ネットワーキング"
    },
    {
      "name": "統治"
    },
    {
      "name": "管理"
    },
    {
      "name": "ティッカー"
    },
    {
      "name": "プラットフォームの自動化"
    }
  ],
  "items": [
    {
      "category": "同一性",
      "subcategory": "同一性",
      "text": "ADD ドメイン コントローラーがネイティブ Azure の ID サブスクリプションにデプロイされていることを確認する",
      "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
      "severity": "高い"
    },
    {
      "category": "同一性",
      "subcategory": "同一性",
      "text": "Azure ベースのリソース (Azure VMware ソリューションを含む) からの認証要求を Azure に対してローカルに保持するように ADD サイトとサービスが構成されていることを確認する",
      "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
      "severity": "中程度"
    },
    {
      "category": "同一性",
      "subcategory": "同一性",
      "text": "vCenter が ADD に接続されていることを確認し、「名前付きユーザー アカウント」に基づく認証を有効にします。",
      "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
      "severity": "高い"
    },
    {
      "category": "同一性",
      "subcategory": "同一性",
      "text": "vCenter から ADD への接続がセキュア プロトコル (LDAPS) を使用していることを確認します。",
      "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
      "severity": "中程度"
    },
    {
      "category": "同一性",
      "subcategory": "同一性",
      "text": "vCenter IdP の CloudAdmin アカウントは、緊急アカウントとしてのみ使用されます (防犯用)。",
      "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
      "severity": "中程度"
    },
    {
      "category": "同一性",
      "subcategory": "同一性",
      "text": "NSX-Managerが外部IdPと統合されていないことを確認してください(技術的には可能ですが)、これは現時点ではサポートされていません。",
      "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
      "severity": "高い"
    },
    {
      "category": "同一性",
      "subcategory": "同一性",
      "text": "VMware vSphere内で使用するためにRBACモデルが作成されているか",
      "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
      "severity": "中程度"
    },
    {
      "category": "同一性",
      "subcategory": "同一性",
      "text": "RBAC アクセス許可は、特定のユーザーではなく、ADD グループに対して付与する必要があります。",
      "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
      "severity": "中程度"
    },
    {
      "category": "同一性",
      "subcategory": "同一性",
      "text": "Azure の Azure VMware ソリューション リソースに対する RBAC アクセス許可は、限られた所有者セットにのみ \"ロックダウン\" されます。",
      "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
      "severity": "高い"
    },
    {
      "category": "ネットワーキング",
      "subcategory": "建築",
      "text": "お客様のユース ケースに適した Azure VMware ソリューション接続モデルが選択されているか",
      "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
      "severity": "高い",
      "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking"
    },
    {
      "category": "ネットワーキング",
      "subcategory": "モニタリング",
      "text": "オンプレミスから Azure への ExpressRoute または VPN 接続が \"接続モニター\" を使用して監視されていることを確認する",
      "guid": "dbf590ce-65de-48e0-9f9c-cbd468266abc",
      "severity": "高い"
    },
    {
      "category": "ネットワーキング",
      "subcategory": "モニタリング",
      "text": "Azure ネイティブ リソースから Azure VMware ソリューション仮想マシンへの接続モニターが作成され、Azure VMware ソリューション バックエンドの ExpressRoute 接続が監視されていることを確認します。",
      "guid": "e6a84de5-df43-4d19-a248-1718d5d1e5f6",
      "severity": "中程度"
    },
    {
      "category": "ネットワーキング",
      "subcategory": "モニタリング",
      "text": "オンプレミスのリソースから Azure VMware Solution 仮想マシンへの接続モニターが作成され、エンド 2 エンドの接続が監視されるようにします。",
      "guid": "25659d35-58fd-4772-99c9-31112d027fe4",
      "severity": "中程度"
    },
    {
      "category": "ネットワーキング",
      "subcategory": "ルーティング",
      "text": "ルート サーバーを使用する場合は、ルート サーバーからオンプレミスへの ExR ゲートウェイへの伝達ルートが 200 個を超えないようにします (ARS 制限)。MoNを使用する際に重要",
      "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
      "severity": "高い"
    },
    {
      "category": "統治",
      "subcategory": "セキュリティ (ID)",
      "text": "特権 ID 管理は、Azure ポータルで Azure VMware ソリューション リソースを管理するロールに実装されていますか (永続的なアクセス許可は許可されていません)。",
      "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
      "severity": "高い"
    },
    {
      "category": "統治",
      "subcategory": "セキュリティ (ID)",
      "text": "特権 ID 管理監査レポートは、Azure VMware ソリューションの PIM ロールに対して実装されていますか。",
      "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
      "severity": "高い"
    },
    {
      "category": "統治",
      "subcategory": "セキュリティ (ID)",
      "text": "CloudAdmin アカウントの使用を緊急アクセスのみに制限する",
      "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
      "severity": "高い"
    },
    {
      "category": "統治",
      "subcategory": "セキュリティ (ID)",
      "text": "vCenter でカスタム RBAC ロールを作成して、vCenter 内に最小特権モデルを実装する",
      "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
      "severity": "中程度"
    },
    {
      "category": "統治",
      "subcategory": "セキュリティ (ID)",
      "text": "クラウド管理者 (vCenter) と管理者 (NSX) の資格情報を定期的にローテーションするように定義されたプロセス",
      "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
      "severity": "中程度"
    },
    {
      "category": "統治",
      "subcategory": "セキュリティ (ID)",
      "text": "Azure VMware ソリューションで実行されているワークロード (VM) に使用する一元化された ID プロバイダーを使用する",
      "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
      "severity": "高い"
    },
    {
      "category": "統治",
      "subcategory": "セキュリティ (ネットワーク)",
      "text": "東西トラフィックフィルタリングはNSX-T内に実装されていますか?",
      "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
      "severity": "中程度"
    },
    {
      "category": "統治",
      "subcategory": "セキュリティ (ネットワーク)",
      "text": "Azure VMware ソリューションのワークロードは、インターネットに直接公開されません。トラフィックは、Azure Application Gateway、Azure Firewall、またはサード パーティのソリューションによってフィルター処理および検査されます。",
      "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
      "severity": "高い"
    },
    {
      "category": "統治",
      "subcategory": "セキュリティ (ネットワーク)",
      "text": "監査とログ記録は、Azure VMware Solution および Azure VMware Solution ベースのワークロードへの受信インターネット要求に対して実装されます。",
      "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
      "severity": "高い"
    },
    {
      "category": "統治",
      "subcategory": "セキュリティ (ネットワーク)",
      "text": "セッション監視は、Azure VMware Solution または Azure VMware Solution ベースのワークロードからの送信インターネット接続に対して実装され、疑わしい/悪意のあるアクティビティを識別する",
      "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
      "severity": "中程度"
    },
    {
      "category": "統治",
      "subcategory": "セキュリティ (ネットワーク)",
      "text": "Azure の ExR/VPN ゲートウェイ サブネットで DDoS 標準保護が有効になっているか",
      "guid": "334fdf91-c234-4182-a652-75269440b4be",
      "severity": "中程度"
    },
    {
      "category": "統治",
      "subcategory": "セキュリティ (ネットワーク)",
      "text": "専用の特権アクセス ワークステーション (PAW) を使用して、Azure VMware Solution、vCenter、NSX マネージャー、HCX マネージャーを管理する",
      "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
      "severity": "中程度"
    },
    {
      "category": "統治",
      "subcategory": "セキュリティ (ゲスト/VM)",
      "text": "Azure VMware ソリューションで実行されているワークロードの高度な脅威検出 (MDfC 別名 ASC) を有効にする",
      "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
      "severity": "中程度"
    },
    {
      "category": "統治",
      "subcategory": "セキュリティ (ゲスト/VM)",
      "text": "Azure ARC for Server を使用して、Azure ネイティブ テクノロジを使用して Azure VMware Solution で実行されているワークロードを適切に管理します (Azure ARC for Azure VMware Solution はまだ利用できません)。",
      "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
      "severity": "中程度"
    },
    {
      "category": "統治",
      "subcategory": "セキュリティ (ゲスト/VM)",
      "text": "Azure VMware ソリューションのワークロードで、実行時に十分なデータ暗号化 (ゲスト内ディスク暗号化や SQL TDE など) が使用されることを確認します。(保存時の vSAN 暗号化はデフォルトです)",
      "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
      "severity": "低い"
    },
    {
      "category": "統治",
      "subcategory": "セキュリティ (ゲスト/VM)",
      "text": "ゲスト内暗号化を使用する場合は、可能であれば、暗号化キーを Azure Key コンテナーに格納します。",
      "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
      "severity": "低い"
    },
    {
      "category": "統治",
      "subcategory": "セキュリティ (ゲスト/VM)",
      "text": "Azure VMware Solution で実行されているワークロードに対して拡張セキュリティ更新プログラムのサポートが構成されていることを確認する (Azure VMware Solution は ESU の対象となります)。",
      "guid": "5ac94222-3e13-4810-9230-81a941741583",
      "severity": "高い"
    },
    {
      "category": "統治",
      "subcategory": "ガバナンス (プラットフォーム)",
      "text": "適切な VM テンプレート ストレージ ポリシーが使用されていることを確認します。",
      "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
      "severity": "高い"
    },
    {
      "category": "統治",
      "subcategory": "ガバナンス (プラットフォーム)",
      "text": "十分なクォータを要求し、拡張と災害復旧の要件を考慮していることを確認する",
      "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
      "severity": "低い"
    },
    {
      "category": "統治",
      "subcategory": "ガバナンス (プラットフォーム)",
      "text": "vSANストレージのニーズを満たすために、許容できないポリシーが設定されていることを確認する",
      "guid": "d88408f3-7273-44c8-96ba-280214590146",
      "severity": "高い"
    },
    {
      "category": "統治",
      "subcategory": "ガバナンス (プラットフォーム)",
      "text": "ESXi へのアクセス制約が理解されていることを確認し、サードパーティのソリューションに影響を与える可能性のあるアクセス制限があります。",
      "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
      "severity": "中程度"
    },
    {
      "category": "統治",
      "subcategory": "ガバナンス (プラットフォーム)",
      "text": "ESXiホストの密度と効率に関するポリシーを作成し、新しいノードを要求するためのリードタイムを念頭に置いてください。",
      "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
      "severity": "低い"
    },
    {
      "category": "統治",
      "subcategory": "ガバナンス (プラットフォーム)",
      "text": "Azure VMware ソリューションで適切なコスト管理プロセスが実施されていることを確認する - Azure コスト管理を使用できます。",
      "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
      "severity": "中程度"
    },
    {
      "category": "統治",
      "subcategory": "ガバナンス (プラットフォーム)",
      "text": "Azure リザーブド インスタンスは、Azure VMware Solution を使用するためのコストを最適化するために使用されますか",
      "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
      "severity": "低い"
    },
    {
      "category": "統治",
      "subcategory": "ガバナンス (プラットフォーム)",
      "text": "他の Azure ネイティブ サービスを使用する場合は、Azure プライベート リンクの使用を検討してください。",
      "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
      "severity": "中程度"
    },
    {
      "category": "統治",
      "subcategory": "ガバナンス (ゲスト/VM)",
      "text": "Microsoft Defender for Cloud for Azure VMware Solution guest VM ワークロードを有効にする",
      "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
      "severity": "中程度"
    },
    {
      "category": "統治",
      "subcategory": "ガバナンス (ゲスト/VM)",
      "text": "Azure ARC 対応サーバーを使用して、Azure VMware ソリューションのゲスト VM ワークロードを管理する",
      "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
      "severity": "中程度"
    },
    {
      "category": "統治",
      "subcategory": "ガバナンス (ゲスト/VM)",
      "text": "Azure VMware ソリューションでの診断ログとメトリック ログの有効化",
      "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
      "severity": "高い"
    },
    {
      "category": "統治",
      "subcategory": "ガバナンス (ゲスト/VM)",
      "text": "ログ分析エージェントを Azure VMware ソリューション ゲスト VM ワークロードにデプロイする",
      "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
      "severity": "中程度"
    },
    {
      "category": "統治",
      "subcategory": "ガバナンス (ゲスト/VM)",
      "text": "Azure VMware Solution VM ワークロードのバックアップ ポリシーとソリューションが文書化され、実装されていることを確認する",
      "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
      "severity": "中程度"
    },
    {
      "category": "統治",
      "subcategory": "コンプライアンス",
      "text": "MDfC を使用して、Azure VMware ソリューションで実行されているワークロードのコンプライアンス監視を行う",
      "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
      "severity": "中程度"
    },
    {
      "category": "統治",
      "subcategory": "コンプライアンス",
      "text": "適用可能なコンプライアンスベースラインがMDfCに追加されているか",
      "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
      "severity": "中程度"
    },
    {
      "category": "統治",
      "subcategory": "コンプライアンス",
      "text": "Azure VMware ソリューションのデプロイに使用する Azure リージョンを選択するときに、データの常駐性が評価されましたか",
      "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
      "severity": "高い"
    },
    {
      "category": "統治",
      "subcategory": "コンプライアンス",
      "text": "データ処理の影響(サービスプロバイダー/サービス消費者モデル)が明確で文書化されているか",
      "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
      "severity": "高い"
    },
    {
      "category": "管理",
      "subcategory": "モニタリング",
      "text": "Azure VMware ソリューションのコア監視インサイトを有効にするダッシュボードを作成する",
      "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
      "severity": "高い"
    },
    {
      "category": "管理",
      "subcategory": "モニタリング",
      "text": "Azure VMware ソリューションのパフォーマンス (CPU >80%、平均メモリ >80%、vSAN >70%) に関する自動アラートの重大なしきい値に関する警告アラートを作成します。",
      "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
      "severity": "高い"
    },
    {
      "category": "管理",
      "subcategory": "モニタリング",
      "text": "vSANの消費量が75%を下回っているかどうかを監視するために、重要なアラートが作成されていることを確認します。これはVMwareのサポートしきい値です。",
      "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
      "severity": "高い"
    },
    {
      "category": "管理",
      "subcategory": "モニタリング",
      "text": "アラートが Azure サービス正常性のアラートと通知用に構成されていることを確認する",
      "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
      "severity": "高い"
    },
    {
      "category": "管理",
      "subcategory": "モニタリング",
      "text": "Azure VMware ソリューションのログ記録を、処理のために Azure Storage アカウントまたは Azure EventHub に送信するように構成する",
      "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
      "severity": "中程度"
    },
    {
      "category": "管理",
      "subcategory": "モニタリング",
      "text": "VMware vSphere に関する深い洞察が必要な場合: vRealize Operations や vRealize Network Insights はソリューションで使用されていますか?",
      "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
      "severity": "低い"
    },
    {
      "category": "管理",
      "subcategory": "オペレーションズ",
      "text": "このポリシーはシックプロビジョニングを適用するため、VMのvSANストレージポリシーがデフォルトのストレージポリシーではないことを確認してください",
      "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
      "severity": "高い"
    },
    {
      "category": "管理",
      "subcategory": "オペレーションズ",
      "text": "vSANは有限のリソースであるため、vSphereコンテンツライブラリがvSANに配置されていないことを確認する",
      "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
      "severity": "中程度"
    },
    {
      "category": "管理",
      "subcategory": "オペレーションズ",
      "text": "バックアップ ソリューションのデータ リポジトリが vSAN ストレージの外部に格納されていることを確認します。Azure ネイティブまたはディスク プールでバックアップされたデータ ストアのいずれか",
      "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
      "severity": "中程度"
    },
    {
      "category": "管理",
      "subcategory": "オペレーションズ",
      "text": "Azure VMware Solution で実行されているワークロードが、Azure ARC for Server を使用してハイブリッド マネージドされていることを確認します (Azure VMware Solution の ARC はまだ利用できません)。",
      "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
      "severity": "中程度"
    },
    {
      "category": "管理",
      "subcategory": "オペレーションズ",
      "text": "Azure VMware Solution で実行されているワークロードが、Azure Log Analytics と Azure Monitor を使用して監視されるようにする",
      "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
      "severity": "中程度"
    },
    {
      "category": "管理",
      "subcategory": "オペレーションズ",
      "text": "Azure VMware ソリューションで実行されているワークロードを既存のパッチ管理ツールまたは Azure Update Management に含める",
      "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
      "severity": "中程度"
    },
    {
      "category": "管理",
      "subcategory": "オペレーションズ",
      "text": "Azure Policy を使用して、Azure 管理、監視、およびセキュリティ ソリューションに Azure VMware ソリューションのワークロードをオンボードする",
      "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
      "severity": "中程度"
    },
    {
      "category": "管理",
      "subcategory": "オペレーションズ",
      "text": "Azure VMware ソリューションのストレージを拡張するために ANF を使用する場合は、現時点では VM レベルでのみ使用されていることを確認してください (NFS データストアとしての ANF はまだプライベート プレビュー段階です)。",
      "guid": "ab79b188-dab8-4193-8c9f-c9d1bb77036f",
      "severity": "高い"
    },
    {
      "category": "管理",
      "subcategory": "安全",
      "text": "Azure VMware Solution で実行されているワークロードが Microsoft Defender for Cloud にオンボードされていることを確認する",
      "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
      "severity": "中程度"
    },
    {
      "category": "ティッカー",
      "subcategory": "バックアップ",
      "text": "vSANは有限のリソースであるため、バックアップがvSANに保存されていないことを確認する",
      "guid": "25398e6D - B9D3 - 47ダ - A43B - C6CD1D79A9B2",
      "severity": "中程度"
    },
    {
      "category": "ティッカー",
      "subcategory": "災害復旧",
      "text": "VMware Site Recovery Manager は、両方のサイトが Azure VMware Solution である場合に使用します。",
      "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
      "severity": "中程度"
    },
    {
      "category": "ティッカー",
      "subcategory": "災害復旧",
      "text": "Azure Site Recovery は、ディザスター リカバリー テクノロジがネイティブの Azure IaaS である場合に使用します。",
      "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
      "severity": "中程度"
    },
    {
      "category": "ティッカー",
      "subcategory": "災害復旧",
      "text": "いずれかの災害ソリューションで自動復旧計画を使用し、手作業は可能な限り回避します。",
      "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
      "severity": "高い"
    },
    {
      "category": "ティッカー",
      "subcategory": "災害復旧",
      "text": "地政学的な地域のペアを二次災害復旧環境として使用する",
      "guid": "8255461e-2aee-4345-9aec-8339248b262d",
      "severity": "中程度"
    },
    {
      "category": "ティッカー",
      "subcategory": "災害復旧",
      "text": "リージョン間で 2 つの異なるアドレス・スペースを使用します (例えば、異なるリージョンの場合は 10.0.0.0/16 と 192.168.0.0/16 など)。",
      "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
      "severity": "高い"
    },
    {
      "category": "ティッカー",
      "subcategory": "災害復旧",
      "text": "ExpressRoute グローバル リーチは、プライマリとセカンダリの Azure VMware ソリューション プライベート クラウド間の接続に使用されますか、それともルーティングはネットワーク仮想アプライアンスを介して行われますか。",
      "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
      "severity": "中程度"
    },
    {
      "category": "ティッカー",
      "subcategory": "ビジネス継続性",
      "text": "バックアップソリューションとしてMABSを使用する",
      "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
      "severity": "中程度"
    },
    {
      "category": "ティッカー",
      "subcategory": "ビジネス継続性",
      "text": "バックアップ ソリューションを Azure VMware ソリューション プライベート クラウドと同じリージョンにデプロイする",
      "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
      "severity": "中程度"
    },
    {
      "category": "ティッカー",
      "subcategory": "ビジネス継続性",
      "text": "できれば、ネイティブの Azure IaaS として SDDC の外部に MABS をデプロイする",
      "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
      "severity": "中程度"
    },
    {
      "category": "ティッカー",
      "subcategory": "ビジネス継続性",
      "text": "Azure プラットフォームによって管理されている VMware コンポーネントのリストアを要求するプロセスが整っていますか。",
      "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
      "severity": "低い"
    },
    {
      "category": "プラットフォームの自動化",
      "subcategory": "展開戦略",
      "text": "手動展開の場合、すべての構成と展開を文書化する必要があります。",
      "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
      "severity": "低い"
    },
    {
      "category": "プラットフォームの自動化",
      "subcategory": "展開戦略",
      "text": "手動によるデプロイの場合は、リソース ロックの実装を検討して、Azure VMware ソリューション プライベート クラウドでの偶発的な操作を防ぐことを検討してください。",
      "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaaa",
      "severity": "低い"
    },
    {
      "category": "プラットフォームの自動化",
      "subcategory": "自動展開",
      "text": "自動デプロイの場合は、最小限のプライベートクラウドを展開し、必要に応じて拡張します。",
      "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
      "severity": "低い"
    },
    {
      "category": "プラットフォームの自動化",
      "subcategory": "自動展開",
      "text": "自動展開の場合は、展開を開始する前にクォータを要求または予約します。",
      "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
      "severity": "低い"
    },
    {
      "category": "プラットフォームの自動化",
      "subcategory": "自動展開",
      "text": "デプロイを自動化するには、適切なガバナンスのために、自動化または Azure Policy を使用して関連するリソース ロックが作成されていることを確認します。",
      "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
      "severity": "低い"
    },
    {
      "category": "プラットフォームの自動化",
      "subcategory": "自動接続",
      "text": "ExR認証キーに人間が理解できる名前を実装して、キーの目的/使用を簡単に識別できるようにする",
      "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
      "severity": "低い"
    },
    {
      "category": "プラットフォームの自動化",
      "subcategory": "自動接続",
      "text": "Azure VMware ソリューションと ExpressRoute のデプロイに個別のサービス原則が使用されている場合は、Key Vault を使用してシークレットと承認キーを格納する",
      "guid": "255461e2-aee3-4553-afc8-339248b262d6",
      "severity": "低い"
    },
    {
      "category": "プラットフォームの自動化",
      "subcategory": "自動接続",
      "text": "Azure VMware Solution は限られた数の並列操作しかサポートしないため、Azure VMware ソリューション内または Azure VMware ソリューションに多くのリソースをデプロイする必要がある場合に、IaC でアクションをシリアル化するためのリソース依存関係を定義します。",
      "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
      "severity": "低い"
    },
    {
      "category": "プラットフォームの自動化",
      "subcategory": "自動接続",
      "text": "単一の層 1 ゲートウェイで NSX-T セグメントの自動構成を実行する場合は、NSX-Manager API の代わりに Azure Portal API を使用します。",
      "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
      "severity": "低い"
    },
    {
      "category": "プラットフォームの自動化",
      "subcategory": "自動スケール",
      "text": "自動スケールアウトを使用する場合は、Azure VMware Solution を実行しているサブスクリプションに十分な Azure VMware ソリューション クォータを必ず適用してください。",
      "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
      "severity": "中程度"
    },
    {
      "category": "プラットフォームの自動化",
      "subcategory": "自動スケール",
      "text": "自動スケールインを使用する場合は、このようなアクションを実行する前に、ストレージ ポリシーの要件を必ず考慮してください。",
      "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
      "severity": "中程度"
    },
    {
      "category": "プラットフォームの自動化",
      "subcategory": "自動スケール",
      "text": "スケーリング操作は、一度に 1 つのスケール操作しか実行できないため (複数のクラスターが使用されている場合でも)、常に 1 つの SDDC 内でシリアル化する必要があります。",
      "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
      "severity": "中程度"
    },
    {
      "category": "プラットフォームの自動化",
      "subcategory": "自動スケール",
      "text": "アーキテクチャで使用されるサードパーティのソリューションでのスケーリング操作を検討し、検証する(サポートされているかどうか)",
      "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
      "severity": "中程度"
    },
    {
      "category": "プラットフォームの自動化",
      "subcategory": "自動スケール",
      "text": "自動化における環境のスケールイン/アウト最大制限を定義して適用する",
      "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
      "severity": "中程度"
    },
    {
      "category": "プラットフォームの自動化",
      "subcategory": "自動スケール",
      "text": "監視ルールを実装して、自動スケーリング操作を監視し、成功と失敗を監視して適切な (自動化された) 応答を有効にする",
      "guid": "1DC15A1C-075E-4E9F-841A-CCCD579376BC",
      "severity": "中程度"
    }
  ]
}

checklists/avs_checklist.es.json METASEP
{
  "metadata": {
    "name": "Revisión de la solución Azure VMware"
  },
  "severities": [
    {
      "name": "Alto"
    },
    {
      "name": "Medio"
    },
    {
      "name": "Bajo"
    }
  ],
  "status": [
    {
      "name": "No verificado",
      "description": "Esta comprobación aún no se ha analizado"
    },
    {
      "name": "Abrir",
      "description": "Hay un elemento de acción asociado a esta comprobación"
    },
    {
      "name": "Cumplido",
      "description": "Esta comprobación se ha verificado y no hay más elementos de acción asociados a ella"
    },
    {
      "name": "No es necesario",
      "description": "Recomendación entendida, pero no necesaria por los requisitos actuales"
    },
    {
      "name": "N/A",
      "description": "No aplicable para el diseño actual"
    }
  ],
  "categories": [
    {
      "name": "Identidad"
    },
    {
      "name": "Gestión de redes"
    },
    {
      "name": "Gobernanza"
    },
    {
      "name": "Administración"
    },
    {
      "name": "BCDR"
    },
    {
      "name": "Automatización de la plataforma"
    }
  ],
  "items": [
    {
      "category": "Identidad",
      "subcategory": "Identidad",
      "text": "Asegúrese de que los controladores de dominio ADDS se implementan en la suscripción de identidad en Azure nativo",
      "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
      "severity": "Alto"
    },
    {
      "category": "Identidad",
      "subcategory": "Identidad",
      "text": "Asegúrese de que los sitios y servicios de ADDS estén configurados para mantener las solicitudes de autenticación de los recursos basados en Azure (incluida Azure VMware Solution) locales en Azure",
      "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
      "severity": "Medio"
    },
    {
      "category": "Identidad",
      "subcategory": "Identidad",
      "text": "Asegúrese de que vCenter esté conectado a ADDS para habilitar la autenticación basada en \"cuentas de usuario nominales\"",
      "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
      "severity": "Alto"
    },
    {
      "category": "Identidad",
      "subcategory": "Identidad",
      "text": "Asegúrese de que la conexión de vCenter a ADDS utiliza un protocolo seguro (LDAPS)",
      "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
      "severity": "Medio"
    },
    {
      "category": "Identidad",
      "subcategory": "Identidad",
      "text": "La cuenta de CloudAdmin en vCenter IdP solo se usa como una cuenta de emergencia (break-glass)",
      "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
      "severity": "Medio"
    },
    {
      "category": "Identidad",
      "subcategory": "Identidad",
      "text": "Asegúrese de que NSX-Manager no esté integrado con idP externo, ya que esto NO es compatible en este momento (aunque sea técnicamente posible)",
      "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
      "severity": "Alto"
    },
    {
      "category": "Identidad",
      "subcategory": "Identidad",
      "text": "¿Se ha creado un modelo RBAC para su uso en VMware vSphere?",
      "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
      "severity": "Medio"
    },
    {
      "category": "Identidad",
      "subcategory": "Identidad",
      "text": "Los permisos RBAC deben concederse en grupos ADDS y no en usuarios específicos",
      "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
      "severity": "Medio"
    },
    {
      "category": "Identidad",
      "subcategory": "Identidad",
      "text": "Los permisos RBAC en el recurso de Azure VMware Solution en Azure están \"bloqueados\" solo para un conjunto limitado de propietarios",
      "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
      "severity": "Alto"
    },
    {
      "category": "Gestión de redes",
      "subcategory": "Arquitectura",
      "text": "¿Está seleccionado el modelo de conectividad de Azure VMware Solution correcto para el caso de uso del cliente en cuestión?",
      "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
      "severity": "Alto",
      "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking"
    },
    {
      "category": "Gestión de redes",
      "subcategory": "Monitorización",
      "text": "Asegúrese de que las conexiones de ExpressRoute o VPN desde el entorno local a Azure se supervisen mediante el \"monitor de conexión\"",
      "guid": "dbf590ce-65de-48e0-9f9c-cbd468266abc",
      "severity": "Alto"
    },
    {
      "category": "Gestión de redes",
      "subcategory": "Monitorización",
      "text": "Asegúrese de que se crea un monitor de conexión desde un recurso nativo de Azure a una máquina virtual de Azure VMware Solution para supervisar la conexión ExpressRoute back-end de Azure VMware Solution",
      "guid": "e6a84de5-df43-4d19-a248-1718d5d1e5f6",
      "severity": "Medio"
    },
    {
      "category": "Gestión de redes",
      "subcategory": "Monitorización",
      "text": "Asegúrese de que se crea un monitor de conexión desde un recurso local a una máquina virtual de Azure VMware Solution para supervisar la conectividad de extremo 2",
      "guid": "25659d35-58fd-4772-99c9-31112d027fe4",
      "severity": "Medio"
    },
    {
      "category": "Gestión de redes",
      "subcategory": "Enrutamiento",
      "text": "Cuando se utilice el servidor de rutas, asegúrese de que no se propagan más de 200 rutas desde el servidor de rutas a la puerta de enlace de ExR a las instalaciones (límite de ARS). Importante al usar MoN",
      "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
      "severity": "Alto"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Seguridad (identidad)",
      "text": "¿Se implementa Privileged Identity Management para los roles que administran el recurso de Azure VMware Solution en Azure Portal (no se permiten permisos permanentes)?",
      "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
      "severity": "Alto"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Seguridad (identidad)",
      "text": "¿Se implementan los informes de auditoría de Privileged Identity Management para los roles de PIM de Azure VMware Solution?",
      "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
      "severity": "Alto"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Seguridad (identidad)",
      "text": "Limite el uso de la cuenta de CloudAdmin solo al acceso de emergencia",
      "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
      "severity": "Alto"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Seguridad (identidad)",
      "text": "Crear roles RBAC personalizados en vCenter para implementar un modelo de privilegios mínimos dentro de vCenter",
      "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
      "severity": "Medio"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Seguridad (identidad)",
      "text": "Es un proceso definido para rotar regularmente las credenciales de administrador de la nube (vCenter) y administrador (NSX)",
      "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
      "severity": "Medio"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Seguridad (identidad)",
      "text": "Usar un proveedor de identidades centralizado para usarlo en cargas de trabajo (VM) que se ejecutan en Azure VMware Solution",
      "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
      "severity": "Alto"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Seguridad (red)",
      "text": "¿Se implementa el filtrado de tráfico Este-Oeste dentro de NSX-T?",
      "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
      "severity": "Medio"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Seguridad (red)",
      "text": "Las cargas de trabajo en Azure VMware Solution no se exponen directamente a Internet. El tráfico se filtra e inspecciona mediante Azure Application Gateway, Azure Firewall o soluciones de terceros",
      "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
      "severity": "Alto"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Seguridad (red)",
      "text": "La auditoría y el registro se implementan para las solicitudes entrantes de Internet a Azure VMware Solution y azure VMware Solution basadas en cargas de trabajo basadas en Azure VMware Solution",
      "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
      "severity": "Alto"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Seguridad (red)",
      "text": "La supervisión de sesiones se implementa para las conexiones salientes a Internet desde Azure VMware Solution o cargas de trabajo basadas en Azure VMware Solution para identificar actividades sospechosas o malintencionadas",
      "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
      "severity": "Medio"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Seguridad (red)",
      "text": "¿Está habilitada la protección estándar DDoS en la subred ExR/VPN Gateway en Azure?",
      "guid": "334fdf91-c234-4182-a652-75269440b4be",
      "severity": "Medio"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Seguridad (red)",
      "text": "Usar una estación de trabajo de acceso privilegiado (PAW) dedicada para administrar Azure VMware Solution, vCenter, NSX Manager y HCX Manager",
      "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
      "severity": "Medio"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Seguridad (invitado/VM)",
      "text": "Habilitar la detección avanzada de amenazas (MDfC, también conocida como ASC) para cargas de trabajo que se ejecutan en Azure VMware Solution",
      "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
      "severity": "Medio"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Seguridad (invitado/VM)",
      "text": "Usar Azure ARC for Servers para gobernar correctamente las cargas de trabajo que se ejecutan en Azure VMware Solution con tecnologías nativas de Azure (Azure ARC para Azure VMware Solution aún no está disponible)",
      "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
      "severity": "Medio"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Seguridad (invitado/VM)",
      "text": "Asegúrese de que las cargas de trabajo en Azure VMware Solution usen suficiente cifrado de datos durante el tiempo de ejecución (como el cifrado de disco en el invitado y SQL TDE). (el cifrado de vSAN en reposo es predeterminado)",
      "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
      "severity": "Bajo"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Seguridad (invitado/VM)",
      "text": "Cuando se usa el cifrado en el invitado, almacene las claves de cifrado en el almacén de claves de Azure cuando sea posible",
      "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
      "severity": "Bajo"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Seguridad (invitado/VM)",
      "text": "Asegúrese de que la compatibilidad ampliada con actualizaciones de seguridad esté configurada para las cargas de trabajo que se ejecutan en Azure VMware Solution (Azure VMware Solution es elegible para ESU)",
      "guid": "5ac94222-3e13-4810-9230-81a941741583",
      "severity": "Alto"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Gobernanza (plataforma)",
      "text": "Asegúrese de que se utiliza la directiva de almacenamiento de plantillas de máquina virtual adecuada",
      "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
      "severity": "Alto"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Gobernanza (plataforma)",
      "text": "Asegúrese de haber solicitado suficiente cuota, asegurándose de haber considerado el crecimiento y el requisito de recuperación ante desastres",
      "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
      "severity": "Bajo"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Gobernanza (plataforma)",
      "text": "Asegúrese de que la directiva de no tolerar esté implementada para satisfacer sus necesidades de almacenamiento de vSAN",
      "guid": "d88408f3-7273-44c8-96ba-280214590146",
      "severity": "Alto"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Gobernanza (plataforma)",
      "text": "Asegúrese de que se comprenden las restricciones de acceso a ESXi, existen límites de acceso que pueden afectar a las soluciones de 3rd party.",
      "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
      "severity": "Medio"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Gobernanza (plataforma)",
      "text": "Asegúrese de que tiene una política en torno a la densidad y eficiencia del host ESXi, teniendo en cuenta el tiempo de entrega para solicitar nuevos nodos",
      "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
      "severity": "Bajo"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Gobernanza (plataforma)",
      "text": "Asegúrese de que existe un buen proceso de administración de costos para Azure VMware Solution: se puede usar Azure Cost Management",
      "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
      "severity": "Medio"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Gobernanza (plataforma)",
      "text": "¿Se usan instancias reservadas de Azure para optimizar el costo del uso de Azure VMware Solution?",
      "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
      "severity": "Bajo"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Gobernanza (plataforma)",
      "text": "Considere el uso de Azure Private-Link cuando use otros Servicios nativos de Azure",
      "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
      "severity": "Medio"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Gobernanza (invitado/VM)",
      "text": "Habilitar las cargas de trabajo de máquina virtual invitada de Microsoft Defender for Cloud for Azure VMware Solution",
      "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
      "severity": "Medio"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Gobernanza (invitado/VM)",
      "text": "Uso de servidores habilitados para ARC de Azure para administrar las cargas de trabajo de máquina virtual invitada de Azure VMware Solution",
      "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
      "severity": "Medio"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Gobernanza (invitado/VM)",
      "text": "Habilitar el registro de métricas y diagnósticos en Azure VMware Solution",
      "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
      "severity": "Alto"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Gobernanza (invitado/VM)",
      "text": "Implementación de los agentes de Log Analytics en cargas de trabajo de máquinas virtuales invitadas de Azure VMware Solution",
      "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
      "severity": "Medio"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Gobernanza (invitado/VM)",
      "text": "Asegúrese de tener una directiva y una solución de copia de seguridad documentadas e implementadas para las cargas de trabajo de máquina virtual de Azure VMware Solution",
      "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
      "severity": "Medio"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Conformidad",
      "text": "Uso de MDfC para la supervisión del cumplimiento de las cargas de trabajo que se ejecutan en Azure VMware Solution",
      "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
      "severity": "Medio"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Conformidad",
      "text": "¿Se agregan las líneas de base de cumplimiento aplicables a MDfC?",
      "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
      "severity": "Medio"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Conformidad",
      "text": "Se evaluó la residencia de datos al seleccionar las regiones de Azure para usarlas en la implementación de Azure VMware Solution",
      "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
      "severity": "Alto"
    },
    {
      "category": "Gobernanza",
      "subcategory": "Conformidad",
      "text": "¿Son claras y documentadas las implicaciones del procesamiento de datos (proveedor de servicios / modelo de consumidor de servicios)",
      "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
      "severity": "Alto"
    },
    {
      "category": "Administración",
      "subcategory": "Monitorización",
      "text": "Creación de paneles para habilitar la información básica de supervisión de Azure VMware Solution",
      "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
      "severity": "Alto"
    },
    {
      "category": "Administración",
      "subcategory": "Monitorización",
      "text": "Cree alertas de advertencia para umbrales críticos para alertas automáticas sobre el rendimiento de Azure VMware Solution (CPU >80 %, memoria media >80 %, vSAN >70 %)",
      "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
      "severity": "Alto"
    },
    {
      "category": "Administración",
      "subcategory": "Monitorización",
      "text": "Asegúrese de que se cree una alerta crítica para supervisar si el consumo de vSAN es inferior al 75 %, ya que se trata de un umbral de soporte de VMware",
      "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
      "severity": "Alto"
    },
    {
      "category": "Administración",
      "subcategory": "Monitorización",
      "text": "Asegúrese de que las alertas estén configuradas para las alertas y notificaciones de Azure Service Health",
      "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
      "severity": "Alto"
    },
    {
      "category": "Administración",
      "subcategory": "Monitorización",
      "text": "Configurar el registro de Azure VMware Solution para que se envíe a una cuenta de Almacenamiento de Azure o Azure EventHub para su procesamiento",
      "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
      "severity": "Medio"
    },
    {
      "category": "Administración",
      "subcategory": "Monitorización",
      "text": "Si se requiere una visión profunda de VMware vSphere: ¿Se utiliza vRealize Operations y/o vRealize Network Insights en la solución?",
      "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
      "severity": "Bajo"
    },
    {
      "category": "Administración",
      "subcategory": "Operaciones",
      "text": "Asegúrese de que la directiva de almacenamiento de vSAN para máquinas virtuales NO es la directiva de almacenamiento predeterminada, ya que esta directiva aplica un aprovisionamiento grueso",
      "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
      "severity": "Alto"
    },
    {
      "category": "Administración",
      "subcategory": "Operaciones",
      "text": "Asegúrese de que las bibliotecas de contenido de vSphere no se coloquen en vSAN, ya que vSAN es un recurso finito",
      "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
      "severity": "Medio"
    },
    {
      "category": "Administración",
      "subcategory": "Operaciones",
      "text": "Asegúrese de que los repositorios de datos para la solución de copia de seguridad se almacenen fuera del almacenamiento de vSAN. En Azure nativo o en un almacén de datos respaldado por un pool de discos",
      "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
      "severity": "Medio"
    },
    {
      "category": "Administración",
      "subcategory": "Operaciones",
      "text": "Asegúrese de que las cargas de trabajo que se ejecutan en Azure VMware Solution se administran de forma híbrida mediante Azure ARC for Servers (ARC para Azure VMware Solution aún no está disponible)",
      "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
      "severity": "Medio"
    },
    {
      "category": "Administración",
      "subcategory": "Operaciones",
      "text": "Asegúrese de que las cargas de trabajo que se ejecutan en Azure VMware Solution se supervisan mediante Azure Log Analytics y Azure Monitor",
      "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
      "severity": "Medio"
    },
    {
      "category": "Administración",
      "subcategory": "Operaciones",
      "text": "Incluir cargas de trabajo que se ejecutan en Azure VMware Solution en herramientas de administración de actualizaciones existentes o en Azure Update Management",
      "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
      "severity": "Medio"
    },
    {
      "category": "Administración",
      "subcategory": "Operaciones",
      "text": "Uso de Azure Policy para incorporar cargas de trabajo de Azure VMware Solution en las soluciones de administración, supervisión y seguridad de Azure",
      "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
      "severity": "Medio"
    },
    {
      "category": "Administración",
      "subcategory": "Operaciones",
      "text": "Cuando se usa ANF para ampliar el almacenamiento de Azure VMware Solution, asegúrese de que se usa solo en el nivel de máquina virtual por ahora (ANF como almacén de datos NFS todavía está en versión preliminar privada)",
      "guid": "ab79b188-dab8-4193-8c9f-c9d1bb77036f",
      "severity": "Alto"
    },
    {
      "category": "Administración",
      "subcategory": "Seguridad",
      "text": "Asegúrese de que las cargas de trabajo que se ejecutan en Azure VMware Solution estén integradas en Microsoft Defender for Cloud",
      "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
      "severity": "Medio"
    },
    {
      "category": "BCDR",
      "subcategory": "Copia de seguridad",
      "text": "Asegúrese de que las copias de seguridad no se almacenen en vSAN, ya que vSAN es un recurso finito",
      "guid": "25398e6D-B9D3-47Da-A43B-C6CD1D79A9B2",
      "severity": "Medio"
    },
    {
      "category": "BCDR",
      "subcategory": "Recuperación ante desastres",
      "text": "Usar VMware Site Recovery Manager cuando ambos sitios son Azure VMware Solution",
      "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
      "severity": "Medio"
    },
    {
      "category": "BCDR",
      "subcategory": "Recuperación ante desastres",
      "text": "Usar Azure Site Recovery cuando la tecnología de recuperación ante desastres es IaaS de Azure nativa",
      "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
      "severity": "Medio"
    },
    {
      "category": "BCDR",
      "subcategory": "Recuperación ante desastres",
      "text": "Utilice planes de recuperación automatizados con cualquiera de las soluciones de desastres, evite las tareas manuales tanto como sea posible",
      "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
      "severity": "Alto"
    },
    {
      "category": "BCDR",
      "subcategory": "Recuperación ante desastres",
      "text": "Usar el par de regiones geopolíticas como entorno secundario de recuperación ante desastres",
      "guid": "8255461e-2aee-4345-9aec-8339248b262d",
      "severity": "Medio"
    },
    {
      "category": "BCDR",
      "subcategory": "Recuperación ante desastres",
      "text": "Utilice 2 espacios de direcciones diferentes entre las regiones, por ejemplo: 10.0.0.0/16 y 192.168.0.0/16 para las diferentes regiones",
      "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
      "severity": "Alto"
    },
    {
      "category": "BCDR",
      "subcategory": "Recuperación ante desastres",
      "text": "¿Se usará ExpressRoute Global Reach para la conectividad entre las nubes privadas de Azure VMware Solution principal y secundaria o el enrutamiento se realiza a través de dispositivos virtuales de red?",
      "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
      "severity": "Medio"
    },
    {
      "category": "BCDR",
      "subcategory": "Continuidad del negocio",
      "text": "Utilice MABS como su solución de copia de seguridad",
      "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
      "severity": "Medio"
    },
    {
      "category": "BCDR",
      "subcategory": "Continuidad del negocio",
      "text": "Implemente la solución de copia de seguridad en la misma región que la nube privada de Azure VMware Solution",
      "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
      "severity": "Medio"
    },
    {
      "category": "BCDR",
      "subcategory": "Continuidad del negocio",
      "text": "Preferiblemente, implemente MABS fuera del SDDC como IaaS de Azure nativo",
      "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
      "severity": "Medio"
    },
    {
      "category": "BCDR",
      "subcategory": "Continuidad del negocio",
      "text": "¿Existe un proceso para solicitar una restauración de los componentes de VMware administrados por la plataforma Azure?",
      "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
      "severity": "Bajo"
    },
    {
      "category": "Automatización de la plataforma",
      "subcategory": "Estrategia de implementación",
      "text": "Para las implementaciones manuales, toda la configuración y las implementaciones deben documentarse",
      "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
      "severity": "Bajo"
    },
    {
      "category": "Automatización de la plataforma",
      "subcategory": "Estrategia de implementación",
      "text": "Para implementaciones manuales, considere la posibilidad de implementar bloqueos de recursos para evitar acciones accidentales en Azure VMware Solution Private Cloud",
      "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
      "severity": "Bajo"
    },
    {
      "category": "Automatización de la plataforma",
      "subcategory": "Implementación automatizada",
      "text": "Para implementaciones automatizadas, implemente una nube privada mínima y escale según sea necesario",
      "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
      "severity": "Bajo"
    },
    {
      "category": "Automatización de la plataforma",
      "subcategory": "Implementación automatizada",
      "text": "Para implementaciones automatizadas, solicite o reserve una cuota antes de iniciar la implementación",
      "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
      "severity": "Bajo"
    },
    {
      "category": "Automatización de la plataforma",
      "subcategory": "Implementación automatizada",
      "text": "Para la implementación automatizada, asegúrese de que se crean bloqueos de recursos relevantes a través de la automatización o a través de Azure Policy para una gobernanza adecuada",
      "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
      "severity": "Bajo"
    },
    {
      "category": "Automatización de la plataforma",
      "subcategory": "Conectividad automatizada",
      "text": "Implementar nombres comprensibles para las claves de autorización de ExR para permitir una fácil identificación del propósito/ uso de las claves",
      "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e5588",
      "severity": "Bajo"
    },
    {
      "category": "Automatización de la plataforma",
      "subcategory": "Conectividad automatizada",
      "text": "Usar el almacén de claves para almacenar secretos y claves de autorización cuando se usan principios de servicio independientes para implementar Azure VMware Solution y ExpressRoute",
      "guid": "255461e2-aee3-4553-afc8-339248b262d6",
      "severity": "Bajo"
    },
    {
      "category": "Automatización de la plataforma",
      "subcategory": "Conectividad automatizada",
      "text": "Defina dependencias de recursos para serializar acciones en IaC cuando sea necesario implementar muchos recursos en Azure VMware Solution o en Azure, ya que Azure VMware Solution solo admite un número limitado de operaciones paralelas.",
      "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
      "severity": "Bajo"
    },
    {
      "category": "Automatización de la plataforma",
      "subcategory": "Conectividad automatizada",
      "text": "Al realizar la configuración automatizada de segmentos de NSX-T con una única puerta de enlace de nivel 1, use las API del Portal de Azure en lugar de las API de NSX-Manager",
      "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
      "severity": "Bajo"
    },
    {
      "category": "Automatización de la plataforma",
      "subcategory": "Báscula automatizada",
      "text": "Cuando tenga la intención de usar el escalado horizontal automatizado, asegúrese de solicitar una cuota suficiente de Azure VMware Solution para las suscripciones que ejecutan Azure VMware Solution",
      "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
      "severity": "Medio"
    },
    {
      "category": "Automatización de la plataforma",
      "subcategory": "Báscula automatizada",
      "text": "Cuando tenga la intención de utilizar el escalado automático, asegúrese de tener en cuenta los requisitos de la política de almacenamiento de información antes de realizar dicha acción.",
      "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
      "severity": "Medio"
    },
    {
      "category": "Automatización de la plataforma",
      "subcategory": "Báscula automatizada",
      "text": "Las operaciones de escalado siempre deben serializarse dentro de un único SDDC, ya que solo se puede realizar una operación de escala a la vez (incluso cuando se utilizan varios clústeres)",
      "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
      "severity": "Medio"
    },
    {
      "category": "Automatización de la plataforma",
      "subcategory": "Báscula automatizada",
      "text": "Considerar y validar las operaciones de escalado en soluciones de 3ª parte utilizadas en la arquitectura (admitidas o no)",
      "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
      "severity": "Medio"
    },
    {
      "category": "Automatización de la plataforma",
      "subcategory": "Báscula automatizada",
      "text": "Defina y aplique límites máximos de escalabilidad horizontal para su entorno en las automatizaciones",
      "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
      "severity": "Medio"
    },
    {
      "category": "Automatización de la plataforma",
      "subcategory": "Báscula automatizada",
      "text": "Implementar reglas de supervisión para supervisar las operaciones de escalado automatizadas y supervisar el éxito y el fracaso para permitir respuestas apropiadas (automatizadas)",
      "guid": "1DC15A1C-075E-4E9F-841A-CCCD579376BC",
      "severity": "Medio"
    }
  ]
}

checklists/avs_checklist.en.json METASEP
{
  "$schema": "checklist.schema.json",
  "items": [
    {
      "category": "Identity",
      "subcategory": "Identity",
      "text": "Ensure ADDS domain controller(s) are deployed in the identity subscription in native Azure",
      "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9",
      "severity": "High"
    },
    {
      "category": "Identity",
      "subcategory": "Identity",
      "text": "Ensure ADDS sites and services is configured to keep authentication requests from Azure-based resources (including Azure VMware Solution) local to Azure",
      "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
      "severity": "Medium"
    },
    {
      "category": "Identity",
      "subcategory": "Identity",
      "text": "Ensure that vCenter is connected to ADDS to enable authentication based on 'named user accounts'",
      "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80",
      "severity": "High"
    },
    {
      "category": "Identity",
      "subcategory": "Identity",
      "text": "Ensure that the connection from vCenter to ADDS is using a secure protocol (LDAPS)",
      "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a",
      "severity": "Medium"
    },
    {
      "category": "Identity",
      "subcategory": "Identity",
      "text": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)",
      "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a",
      "severity": "Medium"
    },
    {
      "category": "Identity",
      "subcategory": "Identity",
      "text": "Ensure that NSX-Manager is not integrated with external IdP as this is NOT supported at the moment (even though technically possible)",
      "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3",
      "severity": "High"
    },
    {
      "category": "Identity",
      "subcategory": "Identity",
      "text": "Has an RBAC model been created for use within VMware vSphere",
      "guid": "ae0e37ce-e297-411b-b352-caaab79b198d",
      "severity": "Medium"
    },
    {
      "category": "Identity",
      "subcategory": "Identity",
      "text": "RBAC permissions should be granted on ADDS groups and not on specific users",
      "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e",
      "severity": "Medium"
    },
    {
      "category": "Identity",
      "subcategory": "Identity",
      "text": "RBAC permissions on the Azure VMware Solution resource in Azure are 'locked down' to a limited set of owners only",
      "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d",
      "severity": "High"
    },
    {
      "category": "Networking",
      "subcategory": "Architecture",
      "text": "Is the correct Azure VMware Solution connectivity model selected for the customer use case at hand",
      "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510",
      "severity": "High",
      "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking"
    },
    {
      "category": "Networking",
      "subcategory": "Monitoring",
      "text": "Ensure ExpressRoute or VPN connections from on-premises to Azure are monitored using 'connection monitor'",
      "guid": "dbf590ce-65de-48e0-9f9c-cbd468266abc",
      "severity": "High"
    },
    {
      "category": "Networking",
      "subcategory": "Monitoring",
      "text": "Ensure a connection monitor is created from an Azure native resource to an Azure VMware Solution virtual machine to monitor the Azure VMware Solution back-end ExpressRoute connection",
      "guid": "e6a84de5-df43-4d19-a248-1718d5d1e5f6",
      "severity": "Medium"
    },
    {
      "category": "Networking",
      "subcategory": "Monitoring",
      "text": "Ensure a connection monitor is created from an on-premises resource to an Azure VMware Solution virtual machine to monitor end-2-end connectivity",
      "guid": "25659d35-58fd-4772-99c9-31112d027fe4",
      "severity": "Medium"
    },
    {
      "category": "Networking",
      "subcategory": "Routing",
      "text": "When route server is used, ensure no more then 200 routes are propagated from route server to ExR gateway to on-premises (ARS limit). Important when using MoN",
      "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649",
      "severity": "High"
    },
    {
      "category": "Governance",
      "subcategory": "Security (identity)",
      "text": "Is Privileged Identity Management implemented for roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)",
      "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3",
      "severity": "High"
    },
    {
      "category": "Governance",
      "subcategory": "Security (identity)",
      "text": "Is Privileged Identity Management audit reporting implemented for the Azure VMware Solution PIM roles",
      "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c",
      "severity": "High"
    },
    {
      "category": "Governance",
      "subcategory": "Security (identity)",
      "text": "Limit use of CloudAdmin account to emergency access only",
      "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e",
      "severity": "High"
    },
    {
      "category": "Governance",
      "subcategory": "Security (identity)",
      "text": "Create custom RBAC roles in vCenter to implement a least-privilege model inside vCenter",
      "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1",
      "severity": "Medium"
    },
    {
      "category": "Governance",
      "subcategory": "Security (identity)",
      "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials",
      "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18",
      "severity": "Medium"
    },
    {
      "category": "Governance",
      "subcategory": "Security (identity)",
      "text": "Use a centralized identity provider to be used for workloads (VM's) running on Azure VMware Solution",
      "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5",
      "severity": "High"
    },
    {
      "category": "Governance",
      "subcategory": "Security (network)",
      "text": "Is East-West traffic filtering implemented within NSX-T",
      "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4",
      "severity": "Medium"
    },
    {
      "category": "Governance",
      "subcategory": "Security (network)",
      "text": "Workloads on Azure VMware Solution are not directly exposed to the internet. Traffic is filtered and inspected by Azure Application Gateway, Azure Firewall or 3rd party solutions",
      "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd",
      "severity": "High"
    },
    {
      "category": "Governance",
      "subcategory": "Security (network)",
      "text": "Auditing and logging is implemented for inbound internet requests to Azure VMware Solution and Azure VMware Solution based workloads",
      "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938",
      "severity": "High"
    },
    {
      "category": "Governance",
      "subcategory": "Security (network)",
      "text": "Session monitoring is implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity",
      "guid": "29e3eec2-1836-487a-8077-a2b5945bda43",
      "severity": "Medium"
    },
    {
      "category": "Governance",
      "subcategory": "Security (network)",
      "text": "Is DDoS standard protection enabled on ExR/VPN Gateway subnet in Azure",
      "guid": "334fdf91-c234-4182-a652-75269440b4be",
      "severity": "Medium"
    },
    {
      "category": "Governance",
      "subcategory": "Security (network)",
      "text": "Use a dedicated privileged access workstation (PAW) to manage Azure VMware Solution, vCenter, NSX manager and HCX manager",
      "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb",
      "severity": "Medium"
    },
    {
      "category": "Governance",
      "subcategory": "Security (guest/VM)",
      "text": "Enable Advanced Threat Detection (MDfC aka ASC) for workloads running on Azure VMware Solution",
      "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d",
      "severity": "Medium"
    },
    {
      "category": "Governance",
      "subcategory": "Security (guest/VM)",
      "text": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)",
      "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45",
      "severity": "Medium"
    },
    {
      "category": "Governance",
      "subcategory": "Security (guest/VM)",
      "text": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)",
      "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a",
      "severity": "Low"
    },
    {
      "category": "Governance",
      "subcategory": "Security (guest/VM)",
      "text": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible",
      "guid": "a3592718-e6e2-4051-9267-6ae46691e883",
      "severity": "Low"
    },
    {
      "category": "Governance",
      "subcategory": "Security (guest/VM)",
      "text": "Ensure extended security update support is configured for workloads running on Azure VMware Solution (Azure VMware Solution is eligible for ESU)",
      "guid": "5ac94222-3e13-4810-9230-81a941741583",
      "severity": "High"
    },
    {
      "category": "Governance",
      "subcategory": "Governance (platform)",
      "text": "Ensure that the appropriate VM template storage policy is used",
      "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609",
      "severity": "High"
    },
    {
      "category": "Governance",
      "subcategory": "Governance (platform)",
      "text": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement",
      "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a",
      "severity": "Low"
    },
    {
      "category": "Governance",
      "subcategory": "Governance (platform)",
      "text": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs",
      "guid": "d88408f3-7273-44c8-96ba-280214590146",
      "severity": "High"
    },
    {
      "category": "Governance",
      "subcategory": "Governance (platform)",
      "text": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.",
      "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19",
      "severity": "Medium"
    },
    {
      "category": "Governance",
      "subcategory": "Governance (platform)",
      "text": "Ensure that you have a policy around ESXi host density and efficiency, keeping in mind the lead time for requesting new nodes",
      "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52",
      "severity": "Low"
    },
    {
      "category": "Governance",
      "subcategory": "Governance (platform)",
      "text": "Ensure a good cost management process is in place for Azure VMware Solution - Azure Cost Management can be used",
      "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef",
      "severity": "Medium"
    },
    {
      "category": "Governance",
      "subcategory": "Governance (platform)",
      "text": "Are Azure reserved instances used to optimize cost for using Azure VMware Solution",
      "guid": "6e043e2a-a359-4271-ae6e-205172676ae4",
      "severity": "Low"
    },
    {
      "category": "Governance",
      "subcategory": "Governance (platform)",
      "text": "Consider the use of Azure Private-Link when using other Azure Native Services",
      "guid": "6691e883-5ac9-4422-83e1-3810523081a9",
      "severity": "Medium"
    },
    {
      "category": "Governance",
      "subcategory": "Governance (guest/VM)",
      "text": "Enable Microsoft Defender for Cloud for Azure VMware Solution guest VM workloads",
      "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da",
      "severity": "Medium"
    },
    {
      "category": "Governance",
      "subcategory": "Governance (guest/VM)",
      "text": "Use Azure ARC enabled servers to manage your Azure VMware Solution guest VM workloads",
      "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe",
      "severity": "Medium"
    },
    {
      "category": "Governance",
      "subcategory": "Governance (guest/VM)",
      "text": "Enable Diagnostic and metric logging on Azure VMware Solution",
      "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a",
      "severity": "High"
    },
    {
      "category": "Governance",
      "subcategory": "Governance (guest/VM)",
      "text": "Deploy the Log Analytics Agents to Azure VMware Solution guest VM workloads",
      "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46",
      "severity": "Medium"
    },
    {
      "category": "Governance",
      "subcategory": "Governance (guest/VM)",
      "text": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads",
      "guid": "589d457a-927c-4397-9d11-02cad6aae11e",
      "severity": "Medium"
    },
    {
      "category": "Governance",
      "subcategory": "Compliance",
      "text": "Use MDfC for compliance monitoring of workloads running on Azure VMware Solution",
      "guid": "ee29711b-d352-4caa-ab79-b198dab81932",
      "severity": "Medium"
    },
    {
      "category": "Governance",
      "subcategory": "Compliance",
      "text": "Are the applicable compliance baselines added to MDfC",
      "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547",
      "severity": "Medium"
    },
    {
      "category": "Governance",
      "subcategory": "Compliance",
      "text": "Was data residency evaluated when selecting Azure regions to use for Azure VMware Solution deployment",
      "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e",
      "severity": "High"
    },
    {
      "category": "Governance",
      "subcategory": "Compliance",
      "text": "Are data processing implications (service provider / service consumer model) clear and documented",
      "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a",
      "severity": "High"
    },
    {
      "category": "Management",
      "subcategory": "Monitoring",
      "text": "Create dashboards to enable core Azure VMware Solution monitoring insights",
      "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2",
      "severity": "High"
    },
    {
      "category": "Management",
      "subcategory": "Monitoring",
      "text": "Create warning alerts for critical thresholds for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)",
      "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2",
      "severity": "High"
    },
    {
      "category": "Management",
      "subcategory": "Monitoring",
      "text": "Ensure critical alert is created to monitor if vSAN consumption is below 75% as this is a support threshold from VMware",
      "guid": "9659e396-80e7-4828-ac93-5657d02bff45",
      "severity": "High"
    },
    {
      "category": "Management",
      "subcategory": "Monitoring",
      "text": "Ensure alerts are configured for Azure Service Health alerts and notifications",
      "guid": "64b0d934-a348-4726-be79-d6b5c3a36495",
      "severity": "High"
    },
    {
      "category": "Management",
      "subcategory": "Monitoring",
      "text": "Configure Azure VMware Solution logging to be send to an Azure Storage account or Azure EventHub for processing",
      "guid": "b6abad38-aad5-43cc-99e1-d86667357c54",
      "severity": "Medium"
    },
    {
      "category": "Management",
      "subcategory": "Monitoring",
      "text": "If deep insight in VMware vSphere is required: Is vRealize Operations and/or vRealize Network Insights used in the solution?",
      "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775",
      "severity": "Low"
    },
    {
      "category": "Management",
      "subcategory": "Operations",
      "text": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning",
      "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682",
      "severity": "High"
    },
    {
      "category": "Management",
      "subcategory": "Operations",
      "text": "Ensure vSphere content libraries are not placed on vSAN as vSAN is a finite resource",
      "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51",
      "severity": "Medium"
    },
    {
      "category": "Management",
      "subcategory": "Operations",
      "text": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore",
      "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e",
      "severity": "Medium"
    },
    {
      "category": "Management",
      "subcategory": "Operations",
      "text": "Ensure workloads running on Azure VMware Solution are hybrid managed using Azure ARC for Servers (ARC for Azure VMware Solution is not yet available)",
      "guid": "2aee3453-aec8-4339-848b-262d6cc5f512",
      "severity": "Medium"
    },
    {
      "category": "Management",
      "subcategory": "Operations",
      "text": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor",
      "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b",
      "severity": "Medium"
    },
    {
      "category": "Management",
      "subcategory": "Operations",
      "text": "Include workloads running on Azure VMware Solution in existing update management tooling or in Azure Update Management",
      "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09",
      "severity": "Medium"
    },
    {
      "category": "Management",
      "subcategory": "Operations",
      "text": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions",
      "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa",
      "severity": "Medium"
    },
    {
      "category": "Management",
      "subcategory": "Operations",
      "text": "When ANF is used to extend storage for Azure VMware Solution, ensure it is used at the VM level only for now (ANF as NFS datastore is still in private preview)",
      "guid": "ab79b188-dab8-4193-8c9f-c9d1bb77036f",
      "severity": "High"
    },
    {
      "category": "Management",
      "subcategory": "Security",
      "text": "Ensure workloads running on Azure VMware Solution are onboarded to Microsoft Defender for Cloud",
      "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129",
      "severity": "Medium"
    },
    {
      "category": "BCDR",
      "subcategory": "Backup",
      "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource",
      "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2",
      "severity": "Medium"
    },
    {
      "category": "BCDR",
      "subcategory": "Disaster Recovery",
      "text": "Use VMware Site Recovery Manager when both sites are Azure VMware Solution",
      "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71",
      "severity": "Medium"
    },
    {
      "category": "BCDR",
      "subcategory": "Disaster Recovery",
      "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS",
      "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818",
      "severity": "Medium"
    },
    {
      "category": "BCDR",
      "subcategory": "Disaster Recovery",
      "text": "Use Automated recovery plans with either of the Disaster solutions, avoid manual tasks as much as possible",
      "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db",
      "severity": "High"
    },
    {
      "category": "BCDR",
      "subcategory": "Disaster Recovery",
      "text": "Use the geopolitical region pair as the secondary disaster recovery environment",
      "guid": "8255461e-2aee-4345-9aec-8339248b262d",
      "severity": "Medium"
    },
    {
      "category": "BCDR",
      "subcategory": "Disaster Recovery",
      "text": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions",
      "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c",
      "severity": "High"
    },
    {
      "category": "BCDR",
      "subcategory": "Disaster Recovery",
      "text": "Will ExpressRoute Global Reach be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or is routing done through network virtual appliances?",
      "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a",
      "severity": "Medium"
    },
    {
      "category": "BCDR",
      "subcategory": "Business Continuity",
      "text": "Use MABS as your backup solution",
      "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711",
      "severity": "Medium"
    },
    {
      "category": "BCDR",
      "subcategory": "Business Continuity",
      "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud",
      "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1",
      "severity": "Medium"
    },
    {
      "category": "BCDR",
      "subcategory": "Business Continuity",
      "text": "Preferably deploy MABS outside of the SDDC as native Azure IaaS",
      "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8",
      "severity": "Medium"
    },
    {
      "category": "BCDR",
      "subcategory": "Business Continuity",
      "text": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?",
      "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e",
      "severity": "Low"
    },
    {
      "category": "Platform Automation",
      "subcategory": "Deployment strategy",
      "text": "For manual deployments, all configuration and deployments must be documented",
      "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1",
      "severity": "Low"
    },
    {
      "category": "Platform Automation",
      "subcategory": "Deployment strategy",
      "text": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud",
      "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa",
      "severity": "Low"
    },
    {
      "category": "Platform Automation",
      "subcategory": "Automated Deployment",
      "text": "For automated deployments, deploy a minimal private cloud and scale as needed",
      "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5",
      "severity": "Low"
    },
    {
      "category": "Platform Automation",
      "subcategory": "Automated Deployment",
      "text": "For automated deployments,  request or reserve quota prior to starting the deployment",
      "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f",
      "severity": "Low"
    },
    {
      "category": "Platform Automation",
      "subcategory": "Automated Deployment",
      "text": "For automated deployment, ensure that relevant resource locks are created through the automation or through Azure Policy for proper governance",
      "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b",
      "severity": "Low"
    },
    {
      "category": "Platform Automation",
      "subcategory": "Automated Connectivity",
      "text": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use",
      "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558",
      "severity": "Low"
    },
    {
      "category": "Platform Automation",
      "subcategory": "Automated Connectivity",
      "text": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute",
      "guid": "255461e2-aee3-4553-afc8-339248b262d6",
      "severity": "Low"
    },
    {
      "category": "Platform Automation",
      "subcategory": "Automated Connectivity",
      "text": "Define resource dependencies for serializing actions in IaC when many resources need to be deployed in/on Azure VMware Solution as Azure VMware Solution only supports a limited number of parallel operations.",
      "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd",
      "severity": "Low"
    },
    {
      "category": "Platform Automation",
      "subcategory": "Automated Connectivity",
      "text": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs",
      "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3",
      "severity": "Low"
    },
    {
      "category": "Platform Automation",
      "subcategory": "Automated Scale",
      "text": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution",
      "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b",
      "severity": "Medium"
    },
    {
      "category": "Platform Automation",
      "subcategory": "Automated Scale",
      "text": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action",
      "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b",
      "severity": "Medium"
    },
    {
      "category": "Platform Automation",
      "subcategory": "Automated Scale",
      "text": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)",
      "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82",
      "severity": "Medium"
    },
    {
      "category": "Platform Automation",
      "subcategory": "Automated Scale",
      "text": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)",
      "guid": "bf15bce2-19e4-4a0e-a588-79424d226786",
      "severity": "Medium"
    },
    {
      "category": "Platform Automation",
      "subcategory": "Automated Scale",
      "text": "Define and enforce scale in/out maximum limits for your environment in the automations",
      "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29",
      "severity": "Medium"
    },
    {
      "category": "Platform Automation",
      "subcategory": "Automated Scale",
      "text": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses",
      "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc",
      "severity": "Medium"
    }
  ],
  "categories": [
    {
      "name": "Identity"
    },
    {
      "name": "Networking"
    },
    {
      "name": "Governance"
    },
    {
      "name": "Management"
    },
    {
      "name": "BCDR"
    },
    {
      "name": "Platform Automation"
    }
  ],
  "status": [
    {
      "name": "Not verified",
      "description": "This check has not been looked at yet"
    },
    {
      "name": "Open",
      "description": "There is an action item associated to this check"
    },
    {
      "name": "Fulfilled",
      "description": "This check has been verified, and there are no further action items associated to it"
    },
    {
      "name": "Not required",
      "description": "Recommendation understood, but not needed by current requirements"
    },
    {
      "name": "N/A",
      "description": "Not applicable for current design"
    }
  ],
  "severities": [
    {
      "name": "High"
    },
    {
      "name": "Medium"
    },
    {
      "name": "Low"
    }
  ],
  "metadata": {
    "name": "Azure VMware Solution Review",
    "state": "preview",
    "timestamp": "Apr 9, 2022"
  }
}


checklists/avd_checklist.pt.json METASEP
{
    "$schema": "checklist.schema.json",
    "categories": [
        {
            "name": "Fundação"
        },
        {
            "name": "Identidade"
        },
        {
            "name": "Rede"
        },
        {
            "name": "Calcular"
        },
        {
            "name": "Armazenamento"
        },
        {
            "name": "Segurança"
        },
        {
            "name": "Monitoramento e Gerenciamento"
        },
        {
            "name": "BC/DR"
        }
    ],
    "items": [
        {
            "category": "BC/DR",
            "description": "O plano de controle AVD não oferece um contrato de nível de serviço com suporte financeiro. Nós nos esforçamos para obter pelo menos 99,9% de disponibilidade para as URLs de serviço de Área de Trabalho Virtual do Windows. A disponibilidade das máquinas virtuais do host de sessão em sua assinatura é coberta pelo SLA de Máquinas Virtuais. Recursos/serviços dependentes e disponibilidade de infraestrutura também devem ser considerados para satisfazer adequadamente os requisitos globais de alta disponibilidade. ",
            "guid": "56c57ba5-9119-4bf8-b8f5-c586c7d9cdc1",
            "link": "https://azure.microsoft.com/support/legal/sla/virtual-desktop/v1_0/",
            "severity": "Alto",
            "subcategory": "Calcular",
            "text": "Determinar o SLA de alta disponibilidade esperado para aplicativos/desktops publicados por meio do AVD"
        },
        {
            "category": "BC/DR",
            "description": "O modelo Active-Active' pode ser alcançado com vários pools de hosts em diferentes regiões. Um único Pool de Hosts com VMs de diferentes regiões não é recomendado. Se vários pools para os mesmos usuários forem usados, o problema de como sincronizar/replicar perfis de usuário deverá ser resolvido. O FSLogix Cloud Cache pode ser usado, mas precisa ser cuidadosamente revisado e planejado, ou os clientes podem decidir não sincronizar/replicar. 'Ativo-Passivo' pode ser alcançado usando o Azure Site Recovery (ASR) ou a implantação de Pool sob demanda com mecanismo automatizado.",
            "guid": "6acc076e-f9b1-441a-a989-579e76b897e7",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "Média",
            "subcategory": "Calcular",
            "text": "Avaliar a região de recuperação de desastres geográficos para pools de hosts AVD"
        },
        {
            "category": "BC/DR",
            "description": "Antes de abordar o planejamento e o design do BCDR da Área de Trabalho Virtual do Windows, é importante considerar inicialmente quais aplicativos são consumidos por meio do AVD são críticos. Talvez você queira separá-los de aplicativos não críticos e usar um Pool de Hosts separado com uma abordagem e recursos de recuperação de desastres diferentes.",
            "guid": "10a7da7b-e996-46e1-9d3c-4ada97cc3d13",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "Média",
            "subcategory": "Calcular",
            "text": "Separe aplicativos críticos em diferentes pools de hosts AVD"
        },
        {
            "category": "BC/DR",
            "description": "? Você selecionou o nível de resiliência adequado para suas VMs de Pool de Hosts (Conjunto de Disponibilidade vs. Zonas de Disponibilidade)?? Você está ciente das implicações no SLA de HA e nos limites de escalabilidade que acompanham o AS ou o AZ? Atualmente, você pode implantar 399 VMs por implantação de modelo ARM da Área de Trabalho Virtual do Windows sem Conjuntos de Disponibilidade ou 200 VMs por Conjunto de Disponibilidade.? Você pode aumentar o número de VMs por implantação desativando os Conjuntos de Disponibilidade no modelo ARM ou no registro do pool de hosts do portal do Azure. A implantação do AZ agora é possível, um AZ de cada vez no momento, precisa criar manualmente uma fração de VMs em cada AZ desejada. ",
            "guid": "25ab225c-6f4e-4168-9fdd-dea8a4b7cdeb",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/faq",
            "severity": "Alto",
            "subcategory": "Calcular",
            "text": "Planejar a melhor opção de resiliência para a implantação do Pool de Hosts AVD"
        },
        {
            "category": "BC/DR",
            "description": "O Backup do Azure também pode ser usado para proteger VMs de Pool de Hosts, essa prática é suportada, mesmo que as VMs de Pool de Hosts devam ser sem monitoração de estado. Essa opção pode ser considerada para Pools de Host Pessoais. ",
            "guid": "4c61fc3f-c14e-4ea6-b69e-8d9a3eec218e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "Média",
            "subcategory": "Calcular",
            "text": "Avaliar o requisito para fazer backup de hosts de sessão AVD"
        },
        {
            "category": "BC/DR",
            "description": "Se imagens personalizadas forem usadas para implantar VMs do Pool de Hosts do AVD, é importante garantir que esses artefatos estejam disponíveis em todas as regiões, mesmo que em caso de um grande desastre. O serviço Galeria de Computação do Azure pode ser usado para replicar imagens em todas as regiões onde um Pool de Hosts é implantado, com armazenamento redundante e em várias cópias.",
            "guid": "dd2e0d5d-771d-441e-9610-cc57b4a4a141",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/shared-images-portal",
            "severity": "Baixo",
            "subcategory": "Dependências",
            "text": "Planejar a disponibilidade da Golden Image em várias regiões"
        },
        {
            "category": "BC/DR",
            "description": "Se os usuários da infraestrutura AVD precisarem de acesso a recursos locais, a alta disponibilidade da infraestrutura de rede necessária para se conectar também é crítica e deve ser considerada. A resiliência da infraestrutura de autenticação precisa ser avaliada e avaliada. Os aspectos do BCDR para aplicativos dependentes e outros recursos precisam ser considerados para garantir a disponibilidade no local de DR secundário.",
            "guid": "fd339489-8c12-488b-9c6a-57cfb644451e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "Média",
            "subcategory": "Dependências",
            "text": "Avalie as dependências de infraestrutura e aplicativos "
        },
        {
            "category": "BC/DR",
            "description": "Nem todos os dados dentro dos perfis de usuário do FSLogix podem merecer proteção contra desastres. Além disso, se o armazenamento externo for usado, por exemplo, OneDrive ou Servidores/Compartilhamentos de Arquivos, o que resta no perfil FSLogix é mínimo e pode ser perdido em algumas circunstâncias extremas. Em outros casos, os dados dentro do perfil podem ser recriados a partir de outros armazenamentos (por exemplo, a Caixa de Entrada do Outlook no modo em cache). ",
            "guid": "687ab077-adb5-49e5-a960-3334fdf8cc23",
            "link": "https://learn.microsoft.com/fslogix/manage-profile-content-cncpt",
            "severity": "Média",
            "subcategory": "Armazenamento",
            "text": "Avaliar quais dados precisam ser protegidos dentro dos contêineres de perfil e do Office"
        },
        {
            "category": "BC/DR",
            "description": "Evitar a perda de dados para dados críticos do usuário é importante, o primeiro passo é avaliar quais dados precisam ser salvos e protegidos. Se estiver usando o OneDrive ou outro armazenamento externo, talvez não seja necessário salvar dados de Perfil de usuário e/ou Contêineres do Office. Deve ser considerado um mecanismo adequado para fornecer proteção aos dados críticos do usuário. O serviço de Backup do Azure pode ser usado para proteger os dados de Perfil e Contêineres do Office quando armazenados nas camadas Padrão e Premium do Azure Files. Os Instantâneos e Políticas de Arquivos NetApp do Azure podem ser usados para Arquivos NetApp do Azure (todas as camadas).",
            "guid": "fc4972cc-3cd2-45bf-a707-6e9eab4bed32",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "Média",
            "subcategory": "Armazenamento",
            "text": "Criar uma estratégia de proteção de backup para contêineres de perfil e do Office"
        },
        {
            "category": "BC/DR",
            "description": "No AVD, vários mecanismos e estratégias de replicação podem ser usados para dados do usuário que residem em contêineres FSLogix:? Padrão de Perfil #1: Mecanismos nativos de replicação de armazenamento do Azure, por exemplo, replicação GRS do Azure Files Standard, Replicação entre Regiões de Arquivos NetApp do Azure ou Sincronização de Arquivos do Azure para servidores de arquivos baseados em VM? É recomendável usar o ZRS (Armazenamento Replicado de Zona) ou o GRS (Armazenamento Replicado Geo) para Arquivos do Azure.Use Zone Replicated Storage (ZRS) or Geo replicated storage (GRS) for Azure Files é recomendado.? O LRS com resiliência apenas local pode ser usado se nenhuma proteção de zona/região for necessária.? NOTA: O Padrão de Compartilhamento de Arquivos do Azure é LRS/ZRS/GRS, mas com suporte grande de 100 TB habilitado, somente o LRS/ZRS é suportado. ? Padrão de perfil #2: O FSLogix Cloud Cache é criado em mecanismo automático para replicar contêineres entre diferentes (até 4) contas de armazenamento. O Cloud Cache deve ser usado somente quando:? A disponibilidade de dados de perfis de usuário ou contêineres do Office exigida SLA de alta disponibilidade é crítica e precisa ser resiliente a falhas na região.? A opção de armazenamento selecionada não é capaz de atender aos requisitos de BCDR. Por exemplo, com a camada Premium do Compartilhamento de Arquivos do Azure ou o Padrão de Compartilhamento de Arquivos do Azure com Suporte a Arquivos Grandes habilitado, o GRS não está disponível.? Quando a replicação entre armazenamentos diferentes é necessária.? Padrão de perfil #3: Configure apenas a recuperação de desastres geográficos para dados de aplicativos e não para contêineres de dados/perfis de usuários: armazene dados importantes de aplicativos em armazenamentos separados, como o OneDrive ou outro armazenamento externo com seu próprio mecanismo de DR interno.",
            "guid": "9f7547c1-746d-4c56-868a-714435bd09dd",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "Média",
            "subcategory": "Armazenamento",
            "text": "Avaliar os requisitos de replicação e resiliência do armazenamento de contêiner de perfil para fins de BCDR"
        },
        {
            "category": "BC/DR",
            "description": "Geo Disaster Recovery: O Azure NetApp Files é essencialmente LRS (armazenamento replicado localmente), então você precisa arquitetar algo mais se quiser replicação entre regiões. A recomendação para várias regiões no momento é o NetApp Cloud Sync, replicando para outra região do Azure (e NetApp Volume). Backup: Os backups são tratados por instantâneos, mas não são automáticos, precisam ser agendados usando políticas. https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-manage-snapshots. Há um limite máximo de instantâneos (255) por volume, conforme documentado aqui: https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-resource-limits.",
            "guid": "23429db7-2281-4376-85cc-57b4a4b18142",
            "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-manage-snapshots",
            "severity": "Média",
            "subcategory": "Armazenamento",
            "text": "Revise a estratégia de DR do Azure NetApp Files"
        },
        {
            "category": "BC/DR",
            "description": "Recuperação de desastres geográficos: o GRS para Arquivos do Azure só está disponível com SKU padrão e sem suporte a compartilhamento grande, não sendo adequado na maioria dos cenários de clientes. Se a replicação geográfica for necessária, ao usar o Azure File Share Premium, a replicação com o FSLogix Cloud Cache deve ser avaliada ou a resiliência somente da Zona de Disponibilidade (AZ) 'na região' deve ser considerada. Backup: o Backup do Azure dá suporte total ao Compartilhamento de Arquivos do Azure em todas as SKUs e é a solução recomendada para proteger os Contêineres de Perfil. Se estiver usando o OneDrive ou outro armazenamento externo, talvez não seja necessário salvar dados de Perfil de usuário e/ou Contêineres do Office.",
            "guid": "3d4f3537-c134-46dc-9602-7a71efe1bd05",
            "link": "https://learn.microsoft.com/azure/backup/backup-afs",
            "severity": "Média",
            "subcategory": "Armazenamento",
            "text": "Revise a estratégia de DR do Azure Files"
        },
        {
            "category": "Calcular",
            "description": "Os aplicativos podem ser pré-instalados na(s) imagem(ns) dourada(s), podem ser anexados usando o recurso MSIX & AppAttach ou distribuindo para hosts após a implantação do pool usando métodos tradicionais de distribuição de SW.",
            "guid": "86ba2802-1459-4014-95d3-8e5309ccbd97",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-customize-master-image",
            "severity": "Alto",
            "subcategory": "Imagem/s dourada(s)",
            "text": "Determinar como os aplicativos serão implantados nos pools de hosts do AVD"
        },
        {
            "category": "Calcular",
            "description": "Eles usarão mascaramento de aplicativos fslogix, que se prestariam a uma única imagem, ou várias imagens com diferentes aplicativos embutidos: o que é necessário mais de uma imagem para ser usada?",
            "guid": "9266bcca-274f-4aa1-abf3-9d95d44c7c89",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace",
            "severity": "Média",
            "subcategory": "Imagem/s dourada(s)",
            "text": "Estimar o número de imagens douradas que serão necessárias"
        },
        {
            "category": "Calcular",
            "description": "Determine qual sistema operacional convidado será usado para implantar cada Pool de Hosts: Windows 10 versus Windows Server, Marketplace versus Imagens personalizadas",
            "guid": "19ca1f6d-5315-4ae5-84ba-34d4585e2213",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "Média",
            "subcategory": "Imagem/s dourada(s)",
            "text": "Determine qual(is) imagem(ns) do sistema operacional você usará para a implantação do Pool de Hosts"
        },
        {
            "category": "Calcular",
            "description": "Se não houver nada, considere usar o Construtor de Imagens do Azure para automatizar o processo de compilação. ",
            "guid": "9bd7bb01-2f7b-495e-86e1-54e2aa359282",
            "link": "https://learn.microsoft.com/azure/virtual-machines/image-builder-overview",
            "severity": "Baixo",
            "subcategory": "Imagem/s dourada(s)",
            "text": "Se uma imagem personalizada for usada, determine se há um processo de compilação automatizado?"
        },
        {
            "category": "Calcular",
            "description": "Avalie a Galeria de Computação do Azure.",
            "guid": "5a2adb2c-3e23-426b-b225-ca44e1696fdd",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/shared-image-galleries",
            "severity": "Baixo",
            "subcategory": "Imagem/s dourada(s)",
            "text": "Se uma imagem personalizada for usada, existe um plano para organizar e gerenciar o ciclo de vida de suas imagens?"
        },
        {
            "category": "Calcular",
            "description": "Existem algumas práticas recomendadas conhecidas e recomendações para a personalização da imagem dourada, certifique-se de verificar o artigo referenciado. ",
            "guid": "deace4cb-1dec-44c6-90c3-fc14eebb36a3",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-customize-master-image",
            "severity": "Média",
            "subcategory": "Imagem/s dourada(s)",
            "text": "Se a imagem personalizada for usada, verifique as práticas recomendadas para AVD sobre como criar uma imagem mestra"
        },
        {
            "category": "Calcular",
            "description": "Este conjunto de ferramentas foi criado para aplicar automaticamente a configuração referenciada no white paper 'Otimizando o Windows 10, versão 2004 para uma função de VDI (Virtual Desktop Infrastructure)': https://learn.microsoft.com/windows-server/remote/remote-desktop-services/rds-vdi-recommendations-2004. O uso da ferramenta e/ou otimizações mencionadas no white-paper devem ser considerados. ",
            "guid": "829e3fec-2183-4687-a017-7a2b5945bda4",
            "link": "https://github.com/The-Virtual-Desktop-Team/Virtual-Desktop-Optimization-Tool",
            "severity": "Média",
            "subcategory": "Imagem/s dourada(s)",
            "text": "Avaliar o uso do Virtual-Desktop-Optimization-Tool"
        },
        {
            "category": "Calcular",
            "description": "Determine se uma ferramenta de gerenciamento de configuração já está em vigor para gerenciar a configuração da VM do Pool de Hosts após a implantação inicial, por exemplo, SCCM, MEM/Intune, GPO, soluções de 3rd-party.",
            "guid": "3334fdf9-1c23-4418-8b65-285269440b4b",
            "link": "https://learn.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop-multi-session",
            "severity": "Baixo",
            "subcategory": "Imagem/s dourada(s)",
            "text": "Planejar/avaliar a estratégia de gerenciamento de configuração do AVD Session Host"
        },
        {
            "category": "Calcular",
            "description": "Revise o artigo fornecido e verifique se os recursos do OneDrive 'Redirecionamento de Pasta Conhecida' e 'Arquivos sob Demanda' devem ser considerados e, eventualmente, adotados.",
            "guid": "e3d3e084-4276-4d4b-bc01-5bcf219e4a1e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/install-office-on-AVD-master-image",
            "severity": "Média",
            "subcategory": "Imagem/s dourada(s)",
            "text": "Determine se o Microsoft OneDrive fará parte da implantação do AVD"
        },
        {
            "category": "Calcular",
            "description": "Certifique-se de revisar este artigo e usar a versão mais recente, revisar e avaliar as exclusões do Teams para reduzir o tamanho do perfil.",
            "guid": "b5887953-5d22-4788-9d30-b66c67be5951",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/teams-on-AVD",
            "severity": "Média",
            "subcategory": "Imagem/s dourada(s)",
            "text": "Determine se o Microsoft Teams fará parte da implantação do AVD"
        },
        {
            "category": "Calcular",
            "description": "É altamente recomendável usar contas/compartilhamentos de armazenamento separados para armazenar pacotes MSIX. Se necessário, o armazenamento pode ser dimensionado de forma independente e não ser afetado por atividades de E/S de perfil. O Azure oferece várias opções de armazenamento que podem ser usadas para anexação de aplicativo MISX. Recomendamos o uso do Azure Files ou do Azure NetApp Files, pois essas opções oferecem o melhor valor entre custo e sobrecarga de gerenciamento. ",
            "guid": "90083845-c587-4cb3-a1ec-16a1d076ef9f",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-file-share",
            "severity": "Alto",
            "subcategory": "MSIX & AppAttach",
            "text": "Não use a mesma conta/compartilhamento de armazenamento que os contêineres de perfil/Office "
        },
        {
            "category": "Calcular",
            "description": "No artigo referenciado, relatamos poucas, mas importantes considerações de desempenho para o uso de MSIX no contexto da AVD, certifique-se de revisar cuidadosamente.",
            "guid": "241addce-5793-477b-adb3-751ab2ac1fad",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-file-share",
            "severity": "Alto",
            "subcategory": "MSIX & AppAttach",
            "text": "Analisar as considerações de desempenho para o MSIX"
        },
        {
            "category": "Calcular",
            "description": "A anexação de aplicativo MSIX requer permissões somente leitura para acessar o compartilhamento de arquivos. Se você estiver armazenando seus aplicativos MSIX nos Arquivos do Azure, para seus hosts de sessão, precisará atribuir a todas as VMs de host de sessão permissões RBAC (controle de acesso baseado em função) de conta de armazenamento e NTFS (Sistema de Arquivos de Nova Tecnologia) no compartilhamento.",
            "guid": "66e15d4d-5a2a-4db2-a3e2-326bf225ca41",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-file-share",
            "severity": "Média",
            "subcategory": "MSIX & AppAttach",
            "text": "Verifique as permissões de host de sessão adequadas para o compartilhamento MSIX"
        },
        {
            "category": "Calcular",
            "description": "O fornecedor de software de 3ª parte deve fornecer um pacote MSY, não é recomendável que o cliente tente o procedimento de conversão sem o suporte adequado do proprietário do aplicativo.",
            "guid": "bd362caa-ab79-4b19-adab-81932c9fc9d1",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-faq",
            "severity": "Média",
            "subcategory": "MSIX & AppAttach",
            "text": "Pacotes MSIX para aplicativos 3rd-party"
        },
        {
            "category": "Calcular",
            "description": "A anexação de aplicativo MSIX não oferece suporte à atualização automática para aplicativos MSIX e, em seguida, deve ser desabilitada.",
            "guid": "bb88037f-5e6b-4fbb-aed5-03547cc447e8",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-faq",
            "severity": "Baixo",
            "subcategory": "MSIX & AppAttach",
            "text": "Desabilitar a atualização automática para pacotes MSIX"
        },
        {
            "category": "Calcular",
            "description": "Para aproveitar o MSIX & App Attach, a imagem do sistema operacional convidado para o pool de hosts AVD deve ser Windows 10 Enterprise ou Windows 10 Enterprise Multi-session, versão 2004 ou posterior.",
            "guid": "26128a71-f0f1-4cac-9d9e-f1d5e832e42e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-faq",
            "severity": "Média",
            "subcategory": "MSIX & AppAttach",
            "text": "Revisar o suporte a sistemas operacionais"
        },
        {
            "category": "Calcular",
            "description": "Depois de selecionada a SKU da VM que será usada para a implantação do Pool de Hosts, recomenda-se usar o tipo Gen2 da SKU para maior segurança e recursos aprimorados.",
            "guid": "e4633254-3185-40a1-b120-bd563a1c8e9d",
            "link": "https://learn.microsoft.com/azure/virtual-machines/generation-2",
            "severity": "Média",
            "subcategory": "Host da Sessão",
            "text": "Avaliar o uso da VM Gen2 para implantação do Pool de Hosts"
        },
        {
            "category": "Fundação",
            "description": "Compartilhado/Agrupado ou Dedicado/Pessoal",
            "guid": "8468c55a-775c-46ee-a5b8-6ad8844ce3b2",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace",
            "severity": "Alto",
            "subcategory": "Planejamento de capacidade",
            "text": "Determinar o tipo de Pool de Hosts a ser usado"
        },
        {
            "category": "Fundação",
            "description": "Confirme se a diferença entre atribuição automática e direta é bem compreendida e que a opção selecionada é apropriada para o cenário em questão.",
            "guid": "b38b875b-a1cf-4204-a901-3a5d3ce474db",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type",
            "severity": "Média",
            "subcategory": "Planejamento de capacidade",
            "text": "Para o tipo de Pool de Hosts Pessoais, decida sobre o tipo de atribuição"
        },
        {
            "category": "Fundação",
            "description": "Verifique qual deles usar e as opções disponíveis, esteja ciente de que, se o dimensionamento automático for usado, ele o definirá como amplitude primeiro. ",
            "guid": "cbd8682a-6abc-4a2a-9fda-1dbf3dc95d48",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/host-pool-load-balancing",
            "severity": "Média",
            "subcategory": "Planejamento de capacidade",
            "text": "Para o tipo Pool de Hosts em Pool, decida sobre o método de balanceamento de carga"
        },
        {
            "category": "Fundação",
            "description": "Com base em seus critérios de seleção, quantos Pools de Hosts você precisaria? Você deve considerar ter vários se:? Várias imagens do sistema operacional? Várias regiões? Diferente HW necessário? Tipo diferente de Pool de Hosts (compartilhado versus pessoal)? Diferentes requisitos de usuário e SLA (Principais usuários, Executivos, Office Worker vs. Desenvolvedores, etc.)? Diferentes configurações de RDP (aplicadas no nível do Pool de Hosts), consulte https://learn.microsoft.com/azure/virtual-desktop/customize-rdp-properties? Número necessário de VMs no pool de hosts que excede os recursos máximos",
            "guid": "c7c791dc-a1f6-4d56-999e-558b937d4985",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/environment-setup",
            "severity": "Alto",
            "subcategory": "Planejamento de capacidade",
            "text": "Estimar o número de pools de hosts diferentes a serem implantados "
        },
        {
            "category": "Fundação",
            "description": "Use o link fornecido para definir um ponto de partida para a decisão de SKU e, em seguida, valide usando um teste de desempenho. Certifique-se de que um mínimo de 4 núcleos para Produção seja selecionado por Host da Sessão (várias sessões)",
            "guid": "e1112dbd-7ba0-412e-9b94-ef6e047d2ea2",
            "link": "https://learn.microsoft.com/windows-server/remote/remote-desktop-services/virtual-machine-recs",
            "severity": "Média",
            "subcategory": "Planejamento de capacidade",
            "text": "Execute o teste de desempenho da carga de trabalho para determinar a melhor SKU e o tamanho da VM do Azure a serem usados (determine o número de hosts por pool)"
        },
        {
            "category": "Fundação",
            "description": "É fundamental verificar a capacidade e os limites de AVD relatados no artigo referenciado. ",
            "guid": "992b1cd6-d2f5-44b2-a769-e3a691e8838a",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop",
            "severity": "Alto",
            "subcategory": "Planejamento de capacidade",
            "text": "Verificar os limites de escalabilidade do AVD para o ambiente"
        },
        {
            "category": "Fundação",
            "description": "Pools de hosts com GPU exigem configuração especial, por favor, certifique-se de rever o artigo referenciado. ",
            "guid": "c936667e-13c0-4056-94b1-e945a459837e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/configure-vm-gpu",
            "severity": "Média",
            "subcategory": "Planejamento de capacidade",
            "text": "Determine se os hosts de sessão exigirão GPU"
        },
        {
            "category": "Fundação",
            "description": "Sempre que possível, recomenda-se aproveitar as SKUs de VM com o recurso de Rede Acelerada. Hoje pnly Windows Server OS são suportados (veja a lista no artigo), no futuro Windows Client OS também pode incluído. ",
            "guid": "b47a393a-0803-4272-a479-8b1578b219a4",
            "link": "https://learn.microsoft.com/azure/virtual-network/create-vm-accelerated-networking-powershell",
            "severity": "Baixo",
            "subcategory": "Planejamento de capacidade",
            "text": "Recomendado o uso de SKUs de VM capazes de aproveitar o recurso de Rede Acelerada no Azure."
        },
        {
            "category": "Fundação",
            "description": "Para um planejamento e implantação adequados, é importante avaliar o número máximo de usuários e a média de sessões simultâneas. ",
            "guid": "bb91a33d-90ca-4e2c-a881-3706f7c0cb9f",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/faq",
            "severity": "Média",
            "subcategory": "Clientes & Usuários",
            "text": "Avalie quantos usuários se conectarão ao AVD e de quais regiões"
        },
        {
            "category": "Fundação",
            "description": "Vários pools de hosts podem ser necessários para suportar diferentes conjuntos de usuários, recomenda-se estimar quantos serão necessários. ",
            "guid": "a1cf2049-9013-4a5d-9ce4-74dbcbd8682a",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/environment-setup",
            "severity": "Média",
            "subcategory": "Clientes & Usuários",
            "text": "Determine se todos os usuários terão o mesmo conjunto de aplicativos e/ou diferentes configurações do Pool de Hosts e/ou imagens do sistema operacional"
        },
        {
            "category": "Fundação",
            "description": "As dependências de recursos externos ao pool AVD devem ser avaliadas e revisadas, por exemplo, Active Directory, compartilhamentos de arquivos externos ou outro armazenamento, serviços e recursos locais, componentes de infraestrutura de rede como VPN e ou Rota Expressa, serviços externos e componentes de terceiros. Para todos esses recursos, a latência do Pool de Hosts AVD precisa ser avaliada e a conectividade considerada. Além disso, as considerações de BCDR também precisam ser aplicadas a essas dependências.",
            "guid": "6abca2a4-fda1-4dbf-9dc9-5d48c7c791dc",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "Baixo",
            "subcategory": "Clientes & Usuários",
            "text": "Avaliar dependências externas para cada Pool de Hosts"
        },
        {
            "category": "Fundação",
            "description": "Revise as limitações de cada cliente e compare várias opções quando possível.",
            "guid": "a1f6d565-99e5-458b-a37d-4985e1112dbd",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/connect-windows-7-10",
            "severity": "Média",
            "subcategory": "Clientes & Usuários",
            "text": "Revise o sistema operacional do cliente usado e o tipo de cliente AVD"
        },
        {
            "category": "Fundação",
            "description": "Os clientes devidamente licenciados para executar cargas de trabalho da Área de Trabalho Virtual do Windows estão qualificados para aplicar uma licença do Windows às máquinas virtuais do host da sessão e executá-las sem pagar por outra licença.",
            "guid": "7ba012e7-b94e-4f6e-847d-2ea2992b1cd6",
            "link": "https://azure.microsoft.com/pricing/details/virtual-desktop/",
            "severity": "Baixo",
            "subcategory": "Clientes & Usuários",
            "text": "Verificar os requisitos de licenciamento"
        },
        {
            "category": "Fundação",
            "description": "Dependendo dos locais do usuário e da implantação da região AVD, os usuários podem ter uma experiência não ideal, portanto, é importante testar o mais rápido possível em um ambiente PoC pequeno. ",
            "guid": "d2f54b29-769e-43a6-a1e8-838ac936667e",
            "link": "https://azure.microsoft.com/services/virtual-desktop/assessment/",
            "severity": "Alto",
            "subcategory": "Clientes & Usuários",
            "text": "Execute um PoC para testar a experiência do usuário de ponta a ponta para verificar o impacto causado pela latência da rede"
        },
        {
            "category": "Fundação",
            "description": "Determine se os usuários receberão áreas de trabalho completas e/ou Grupos de Aplicativos Remotos. ",
            "guid": "13c00567-4b1e-4945-a459-837ee7ad6c6d",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/manage-app-groups",
            "severity": "Baixo",
            "subcategory": "Clientes & Usuários",
            "text": "Determine se os usuários acessarão o AVD usando desktops completos e/ou aplicativos remotos "
        },
        {
            "category": "Fundação",
            "description": "No momento, as configurações de RDP só podem ser definidas no nível do pool de hosts, não por usuário/grupo.",
            "guid": "3b365a5c-7acb-4e48-abe5-4cd79f2e8776",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/customize-rdp-properties",
            "severity": "Baixo",
            "subcategory": "Clientes & Usuários",
            "text": "Todos os usuários terão as mesmas configurações de RDP? "
        },
        {
            "category": "Fundação",
            "description": "O Shortpath RDP para redes gerenciadas é um recurso da Área de Trabalho Virtual do Azure que estabelece um transporte direto baseado em UDP entre o Cliente de Área de Trabalho Remota e o host da Sessão. A remoção do relé extra reduz o tempo de ida e volta, o que melhora a experiência do usuário com aplicativos sensíveis à latência e métodos de entrada. Para dar suporte ao RDP Shortpath, o cliente da Área de Trabalho Virtual do Azure precisa de uma linha de visão direta para o host da sessão e deve estar executando o Windows 10 ou o Windows 7 e ter o cliente da Área de Trabalho do Windows instalado.",
            "guid": "b2074747-d01a-4f61-b1aa-92ad793d9ff4",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/shortpath",
            "severity": "Média",
            "subcategory": "Clientes & Usuários",
            "text": "Avaliar o RDP ShortPath para clientes que se conectam a partir de redes internas gerenciadas"
        },
        {
            "category": "Fundação",
            "description": "O AVD é um serviço não regional, os Pools de Hosts podem ser criados em qualquer região, o redirecionamento automático do front-end mais próximo acontecerá automaticamente.",
            "guid": "42e52f47-21d9-428c-8b1b-d521e44a29a9",
            "link": "https://azure.microsoft.com/global-infrastructure/services/?products=virtual-desktop",
            "severity": "Alto",
            "subcategory": "Geral",
            "text": "Determine em qual região do Azure os Pools de Host AVD serão implantados."
        },
        {
            "category": "Fundação",
            "description": "Se necessário para se conectar ao ambiente local, avalie a opção de conectividade atual ou planeje a conectividade necessária. ",
            "guid": "dd399cfd-7b28-4dc8-9555-6202bfe4563b",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/",
            "severity": "Média",
            "subcategory": "Geral",
            "text": "Determinar se a conectividade híbrida é necessária para se conectar ao ambiente local"
        },
        {
            "category": "Fundação",
            "description": "Execute a ferramenta 'Estimador da Experiência Desktop Virtual do Windows' para selecionar a melhor região do Azure para implantar Pools de Hosts. Além da latência de 150ms, a experiência do usuário pode não ser a ideal. ",
            "guid": "0d834a34-8b26-43e6-bc60-512a26498f6d",
            "link": "https://azure.microsoft.com/services/virtual-desktop/assessment/",
            "severity": "Alto",
            "subcategory": "Geral",
            "text": "Você avaliou a latência entre o local dos usuários e a infraestrutura do AVD do Azure?"
        },
        {
            "category": "Fundação",
            "description": "O AVD armazena metadados apenas para executar o serviço em localizações geográficas específicas, determinar o que está disponível hoje e se for adequado com base nos requisitos do cliente. ",
            "guid": "bad37ead-53cc-47ce-8d7a-aab3571449ab",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/data-locations",
            "severity": "Média",
            "subcategory": "Geral",
            "text": "Determinar o local dos metadados do serviço AVD"
        },
        {
            "category": "Fundação",
            "description": "Verifique se há SKUs de VM específicas, especialmente se você precisar de SKUs de GPU ou de alta especificação e, eventualmente, disponibilidade do Azure NetApp Files, se usado. ",
            "guid": "8053d89e-89dc-47b3-9be2-a1a27f7a9e91",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
            "severity": "Baixo",
            "subcategory": "Geral",
            "text": "Verificar as cotas e a disponibilidade do Azure para tamanhos específicos de VM nas regiões selecionadas"
        },
        {
            "category": "Fundação",
            "description": "Consulte a seção BCDR para obter mais detalhes.",
            "guid": "be1f38ce-f398-412b-b463-cbbac89c199d",
            "link": "https://learn.microsoft.com/azure/availability-zones/az-region",
            "severity": "Média",
            "subcategory": "Geral",
            "text": "Verificar a disponibilidade da zona de disponibilidade (AZ) na região selecionada"
        },
        {
            "category": "Identidade",
            "description": "Os DCs do AD no Azure são recomendados para reduzir a latência para usuários que fazem logon em hosts de sessão do AVD e, eventualmente, para Arquivos NetApp do Azure e integração com o AD. O ADC precisa ser capaz de falar com DCs para TODOS os domínios filho. Como alternativa, a conectividade local deve ser usada para alcançar os DCs do AD. ",
            "guid": "c14aea7e-65e8-4d9a-9aec-218e6436b073",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
            "severity": "Média",
            "subcategory": "Diretório ativo",
            "text": "Criar pelo menos dois controladores de domínio (DCs) do Active Directory no ambiente VNET do Azure próximo ao Pool de Hosts AVD"
        },
        {
            "category": "Identidade",
            "description": "Recomendado para criar uma UO separada por Pool de Hosts em uma hierarquia de UO separada. Essas UOs conterão contas de máquina de hosts de sessão AVD. ",
            "guid": "6db55f57-9603-4334-adf9-cc23418db612",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace",
            "severity": "Baixo",
            "subcategory": "Diretório ativo",
            "text": "Criar uma UO específica no Active Directory para cada Pool de Hosts"
        },
        {
            "category": "Identidade",
            "description": "Revise cuidadosamente e, eventualmente, bloqueie/filtre a herança de GPOs para as UOs que contêm Pools de Host AVD. ",
            "guid": "7126504b-b47a-4393-a080-327294798b15",
            "link": "https://learn.microsoft.com/previous-versions/windows/desktop/Policy/group-policy-hierarchy",
            "severity": "Média",
            "subcategory": "Diretório ativo",
            "text": "Revise o GPO de domínio que será aplicado à UO e afetará as funcionalidades da VM do Pool de Hosts"
        },
        {
            "category": "Identidade",
            "description": "Recomendado ter uma conta dedicada específica com permissões específicas e sem a limitação padrão de 10 ingressos. ",
            "guid": "347dc560-28a7-41ff-b1cd-15dd2f0d5e77",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace",
            "severity": "Média",
            "subcategory": "Diretório ativo",
            "text": "Criar uma conta de usuário dedicada com apenas permissões para ingressar a VM no domínio"
        },
        {
            "category": "Identidade",
            "description": "Evite conceder acesso por usuário, em vez disso, use grupos do AD e replique-os usando o ADC no Azure AD. ",
            "guid": "2d41e361-1cc5-47b4-a4b1-410d43958a8c",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/manage-app-groups",
            "severity": "Média",
            "subcategory": "Diretório ativo",
            "text": "Criar um grupo de usuários de domínio para cada conjunto de usuários que receberão acesso a cada Grupo de Aplicativos de Pool de Hosts (DAG ou RAG)"
        },
        {
            "category": "Identidade",
            "description": "Como parte do procedimento para integrar o Compartilhamento de Arquivos do Azure e a autenticação do Active Directory, uma conta do AD para representar a conta de armazenamento (compartilhamento de arquivos) será criada. Você pode optar por se registrar como uma conta de computador ou conta de logon de serviço, consulte Perguntas frequentes para obter detalhes. Para contas de computador, há uma idade de expiração de senha padrão definida no AD em 30 dias. Da mesma forma, a conta de logon de serviço pode ter uma idade de expiração de senha padrão definida no domínio do AD ou na Unidade Organizacional (UO). Para ambos os tipos de conta, recomendamos que você verifique a idade de expiração da senha configurada em seu ambiente do AD e planeje atualizar a senha da identidade da conta de armazenamento da conta do AD antes da idade máxima da senha. Você pode considerar a criação de uma nova Unidade Organizacional (UO) do AD no AD e desabilitar a diretiva de expiração de senha em contas de computador ou contas de logon de serviço de acordo.",
            "guid": "2289b3d6-b57c-4fc6-9546-1e1a3e3453a3",
            "link": "https://learn.microsoft.com/azure/storage/files/storage-files-identity-ad-ds-enable",
            "severity": "Baixo",
            "subcategory": "Diretório ativo",
            "text": "Revisar a política de expiração de senha da sua organização para contas usadas pela integração do AD do Azure Files"
        },
        {
            "category": "Identidade",
            "description": "Uma assinatura do Azure deve ser parente para o mesmo locatário do Azure AD, que contém uma rede virtual que contém ou está conectada ao Active Directory do Windows Server ou à instância do Azure AD DS.",
            "guid": "6ceb5443-5125-4922-9442-93bb628537a5",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "Alto",
            "subcategory": "Requisitos",
            "text": "Um locatário do Active Directory do Azure deve estar disponível com pelo menos uma assinatura vinculada"
        },
        {
            "category": "Identidade",
            "description": "Você pode configurar isso usando o Azure AD Connect (para organizações híbridas) ou os Serviços de Domínio do Azure AD (para organizações híbridas ou de nuvem).",
            "guid": "5119bf8e-8f58-4542-a7d9-cec166cd072a",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "Alto",
            "subcategory": "Requisitos",
            "text": "Uma floresta/domínio do Active Directory do Windows Server está sincronizado com o Active Directory do Azure"
        },
        {
            "category": "Identidade",
            "description": "(1) O usuário deve ser originado do mesmo Active Directory que está conectado ao Azure AD. A Área de Trabalho Virtual do Windows não oferece suporte a contas B2B ou MSA. (2) O UPN que você usa para assinar a Área de Trabalho Virtual do Windows deve existir no domínio do Active Directory ao qual a VM está associada.",
            "guid": "f9b141a8-98a5-435e-9378-97e71ca7da7b",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "Média",
            "subcategory": "Requisitos",
            "text": "Verificar os requisitos da Conta de Usuário para se conectar à Área de Trabalho Virtual do Windows"
        },
        {
            "category": "Identidade",
            "description": "As VMs devem ser ingressadas no domínio Padrão ou Híbridas associadas ao AD. As máquinas virtuais não podem ser associadas ao Azure AD.",
            "guid": "ea962a15-9394-46da-a7cc-3923266b2258",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "Média",
            "subcategory": "Requisitos",
            "text": "Verifique os requisitos de VM para hosts de sessão AVD que serão criados"
        },
        {
            "category": "Identidade",
            "description": "Comparar os Serviços de Domínio Active Directory autogerenciados, o Active Directory do Azure e os Serviços de Domínio do Active Directory gerenciados",
            "guid": "6f4a1651-bddd-4ea8-a487-cdeb4861bc3b",
            "link": "https://learn.microsoft.com/azure/active-directory-domain-services/compare-identity-solutions",
            "severity": "Baixo",
            "subcategory": "Requisitos",
            "text": "Antes de usar os Serviços de Domínio Active Directory do Azure (AAD-DS) para AVD, verifique as limitações. "
        },
        {
            "category": "Monitoramento e Gerenciamento",
            "description": "A ferramenta de dimensionamento fornece uma opção de automação de baixo custo para clientes que desejam otimizar seus custos de VM de host de sessão. Você pode usar a ferramenta de dimensionamento para agendar VMs para iniciar e parar com base no horário comercial de pico e fora de pico, expandir VMs com base no número de sessões por núcleo de CPU, dimensionar em VMs durante o horário de pico fora de pico, deixando o número mínimo de VMs de host de sessão em execução. Ainda não disponível para o tipo de Pool de Host Pessoal, recomenda-se ter uma configuração separada para cada pool de hosts. ",
            "guid": "7138b820-102c-4e16-be30-1e6e872e52e3",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-scaling-script",
            "severity": "Baixo",
            "subcategory": "Gestão",
            "text": "Avaliar o requisito de capacidade de dimensionamento automático do pool de hosts"
        },
        {
            "category": "Monitoramento e Gerenciamento",
            "description": "O Supervisor do Azure analisa suas configurações e telemetria para oferecer recomendações personalizadas para resolver problemas comuns. Com essas recomendações, você pode otimizar seus recursos do Azure para confiabilidade, segurança, excelência operacional, desempenho e custo.",
            "guid": "611dd68c-5a4b-4252-8e44-a59a9c2399c4",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/azure-advisor",
            "severity": "Baixo",
            "subcategory": "Gestão",
            "text": "Verifique periodicamente as recomendações do Azure Advisor para AVD"
        },
        {
            "category": "Monitoramento e Gerenciamento",
            "description": "Prepare uma estratégia para gerenciar atualizações para imagens douradas, por exemplo, para aplicar hotfixes de segurança e/ou atualizar aplicativos instalados dentro da imagem. O Serviço Construtor de Imagens do Azure é uma solução de 1ª parte para automatizar a compilação e a personalização de VMs. Os modelos ARM podem ser usados para criar novos hosts e, em seguida, encerrar os antigos: https://github.com/Azure/RDS-Templates/tree/master/ARM-AVD-templates/AddVirtualMachinesToHostPool A abordagem recomendada é criar um novo pool lado a lado, mais fácil de reverter, não utilizável para pool dedicadoReimplantar e aumentar o número de VMs com o modelo ARM também é uma opção viável. Os clientes também podem querer usar métodos de distribuição de software existentes para atualizar a imagem sem reimplantar, por exemplo, com o SCCM ou similar.",
            "guid": "d7b68d0c-7555-462f-8b3e-4563b4d874a7",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/image-builder-virtual-desktop",
            "severity": "Média",
            "subcategory": "Gestão",
            "text": "Planejar uma estratégia de gerenciamento de atualização de imagem dourada"
        },
        {
            "category": "Monitoramento e Gerenciamento",
            "description": "Os clientes podem ter várias opções:- Microsoft Endpoint Configuration Manager, este artigo explica como configurar o Microsoft Endpoint Configuration Manager para aplicar automaticamente atualizações a um host da Área de Trabalho Virtual do Windows executando o Windows 10 Enterprise com várias sessões: https://learn.microsoft.com/azure/virtual-desktop/configure-automatic-updates- Microsoft Intune: https://learn.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop-multi-session- Windows Server Update Services ( WSUS)- 3ª Parte que dá suporte ao seu sistema operacional.- Gerenciamento de Atualização do Azure (Automação do Azure), hoje sem suporte para o sistema operacional cliente: recomenda-se que https://learn.microsoft.com/azure/automation/update-management/overview#unsupported-operating-systemsIt se afaste de uma estratégia de aplicação de patches e mude para uma estratégia de recriação de imagens, se possível. ",
            "guid": "04722da2-9c2b-41cd-922f-54b29bade3aa",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/image-builder-virtual-desktop",
            "severity": "Média",
            "subcategory": "Gestão",
            "text": "Planejar uma estratégia de correção e atualização do Host da Sessão"
        },
        {
            "category": "Monitoramento e Gerenciamento",
            "description": "Os pools de hosts são uma coleção de uma ou mais máquinas virtuais idênticas no ambiente da Área de Trabalho Virtual do Windows. É altamente recomendável que você crie um pool de hosts de validação em que as atualizações de serviço sejam aplicadas primeiro. Isso permite que você monitore as atualizações de serviço antes que o serviço as aplique ao seu ambiente padrão ou de não validação.",
            "guid": "d1e8c38e-c936-4667-913c-005674b1e944",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-validation-host-pool",
            "severity": "Baixo",
            "subcategory": "Gestão",
            "text": "Avaliar o requisito para um ambiente canário de teste AVD"
        },
        {
            "category": "Monitoramento e Gerenciamento",
            "description": "Um Pool de Hosts AVD pode ser implantado de várias maneiras: Portal do Azure, modelos ARM, ferramenta CLI do Azure, Powershell, criação manual de VM com token de registro, Terraform etc. É importante adotar métodos(s) adequado(s) para oferecer suporte à implantação automática por meio de ferramentas de automação e CI/CD.",
            "guid": "a459c373-e7ed-4616-83b3-65a917ecbe48",
            "link": "https://github.com/Azure/RDS-Templates/tree/master/AVD-templates",
            "severity": "Média",
            "subcategory": "Gestão",
            "text": "Determinar a estratégia de implantação do Pool de Hosts"
        },
        {
            "category": "Monitoramento e Gerenciamento",
            "description": "Depois de registrar uma VM em um pool de hosts no serviço Área de Trabalho Virtual do Windows, o agente atualiza regularmente o token da VM sempre que a VM está ativa. O certificado para o token de registro é válido por 90 dias. Devido a esse limite de 90 dias, recomendamos que as VMs fiquem online por 20 minutos a cada 90 dias para que a máquina possa atualizar seus tokens e atualizar o agente e os componentes da pilha lado a lado.",
            "guid": "ebe54cd7-df2e-48bb-ac35-81559bb9153e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/faq",
            "severity": "Média",
            "subcategory": "Gestão",
            "text": "Ative VMs regularmente a cada 90 dias para atualização de token"
        },
        {
            "category": "Monitoramento e Gerenciamento",
            "description": "O Azure Monitor para Área de Trabalho Virtual do Windows é um painel criado em Pastas de Trabalho do Azure Monitor que ajuda os profissionais de TI a entender seus ambientes de Área de Trabalho Virtual do Windows. Leia o artigo referenciado para saber como configurar o Monitor do Azure para Área de Trabalho Virtual do Windows para monitorar seus ambientes de Área de Trabalho Virtual do Windows.",
            "guid": "63cfff1c-ac59-49ef-8d5a-83dd4de36c1c",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/azure-monitor",
            "severity": "Alto",
            "subcategory": "Monitorização",
            "text": "Habilitar o Monitoramento do Azure para AVD"
        },
        {
            "category": "Monitoramento e Gerenciamento",
            "description": "A Área de Trabalho Virtual do Windows usa o Azure Monitor e o Log Analytics para monitoramento e alertas, como muitos outros serviços do Azure. Isso permite que os administradores identifiquem problemas por meio de uma única interface. O serviço cria logs de atividades para ações administrativas e de usuário.  Cada registro de atividades se enquadra nas seguintes categorias: Gerenciamento, Feed, Conexões, Registro de Host, Erros, Pontos de Verificação. ",
            "guid": "81770afb-c4c0-4e43-a186-58d2857ed671",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/diagnostics-log-analytics",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Habilitar e redirecionar configurações de diagnóstico para Espaços de Trabalho, Pools de Hosts, Grupos de Aplicativos e VMs Host para o espaço de trabalho do Log Analytics"
        },
        {
            "category": "Monitoramento e Gerenciamento",
            "description": "Consulte o artigo referenciado e este adicional para configurar o monitoramento e o alerta adequados para armazenamento: https://learn.microsoft.com/azure/storage/files/storage-troubleshooting-files-performance. ",
            "guid": "2463cffe-179c-4599-be0d-5973dd4ce32c",
            "link": "https://learn.microsoft.com/azure/storage/files/storage-files-monitoring?tabs=azure-portal",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Criar alertas no armazenamento de perfis a serem alertados em caso de alto uso e limitação"
        },
        {
            "category": "Monitoramento e Gerenciamento",
            "description": "Você pode usar a Integridade do Serviço do Azure para monitorar problemas de serviço e avisos de integridade da Área de Trabalho Virtual do Windows. A Integridade do Serviço do Azure pode notificá-lo com diferentes tipos de alertas (por exemplo, email ou SMS), ajudá-lo a entender o efeito de um problema e mantê-lo atualizado à medida que o problema é resolvido.",
            "guid": "18813706-f7c4-4c0d-9e51-4548d2457ed6",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-service-alerts",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Configurar a Integridade do Serviço do Azure para alertas AVD "
        },
        {
            "category": "Rede",
            "description": "Que tipo de conectividade híbrida? Rota Expressa, VPN, NVA?",
            "guid": "c8639648-a652-4d6c-85e5-02965388e5de",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/",
            "severity": "Média",
            "subcategory": "Rede",
            "text": "Revisar a arquitetura de conectividade híbrida para ambiente local"
        },
        {
            "category": "Rede",
            "description": "Avalie os requisitos de largura de banda, garanta que a largura de banda VPN/ER seja suficiente e a latência tolerável. ",
            "guid": "d227dd14-2b06-4c21-a799-9a646f4389a7",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/",
            "severity": "Média",
            "subcategory": "Rede",
            "text": "Avaliar quais recursos os usuários precisarão acessar dos Pools de Host do AVD para o local"
        },
        {
            "category": "Rede",
            "description": "Revise ou recomende um novo onde colocar os Pools de Host AVD com base no CAF (vWAN vs. Hub & Spoke)",
            "guid": "f42c78e7-8c06-4a63-a21a-4956e6a8dc4a",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/networking-options",
            "severity": "Alto",
            "subcategory": "Rede",
            "text": "Revise a topologia de rede da zona de aterrissagem para o serviço AVD"
        },
        {
            "category": "Rede",
            "description": "Verifique se cada sub-rede terá espaço suficiente para dimensionar o Pool de Hosts AVD. Para pools de hosts diferentes, é recomendável usar sub-redes separadas, se possível. ",
            "guid": "20e27b3e-2971-41b1-952b-eee079b588de",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "Média",
            "subcategory": "Rede",
            "text": "Avaliar o posicionamento da VNET e da sub-rede para vários pools de hosts"
        },
        {
            "category": "Rede",
            "description": "Várias opções estão disponíveis. Você pode usar o Firewall do Azure ou o Firewall NVA, o NSG e/ou o Proxy. O NSG não é capaz de ativar/desabilitar por URL, apenas portas e protocolos. O proxy deve ser usado apenas como configuração explícita no navegador do usuário. Os detalhes sobre como usar o Firewall do Azure Premium com AVD estão aqui no https://aka.ms/AVDfirewall e aqui https://learn.microsoft.com/azure/firewall/protect-windows-virtual-desktop. Certifique-se de revisar a lista completa de requisitos para acesso a URLs AVD.",
            "guid": "fc4972cd-3cd2-41bf-9703-6e5e6b4bed3d",
            "link": "https://aka.ms/AVDfirewall",
            "severity": "Média",
            "subcategory": "Rede",
            "text": "Precisa controlar/restringir o tráfego de saída da Internet para hosts AVD? "
        },
        {
            "category": "Rede",
            "description": "Considere o uso do Ponto de Extremidade do Azure Defender para controlar a navegação na Web do usuário, consulte a seção Segurança para obter mais detalhes. ",
            "guid": "73676ae4-6691-4e88-95ad-a42223e13810",
            "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/windows-virtual-desktop-support-is-now-generally-available/ba-p/2103712",
            "severity": "Média",
            "subcategory": "Rede",
            "text": "Precisa controlar/restringir o tráfego de saída da Internet apenas para usuários em hosts AVD? "
        },
        {
            "category": "Rede",
            "description": "A UDR personalizada pode ser aplicada à sub-rede do Pool de Hosts AVD, por exemplo, para redirecionar para o Firewall do Azure ou NVA. Neste caso, recomenda-se uma revisão cuidadosa para garantir que o caminho ideal para o tráfego de saída para o plano de controle AVD seja usado. As etiquetas de serviço agora podem ser usadas com UDR e, em seguida, o tráfego do avião de gerenciamento AVD pode ser facilmente colocado na lista de permissões. https://learn.microsoft.com/azure/firewall/protect-windows-virtual-desktop#host-pool-outbound-access-to-windows-virtual-desktop ",
            "guid": "523181a9-4174-4158-93ff-7ae7c6d37431",
            "link": "https://learn.microsoft.com/azure/firewall/protect-windows-virtual-desktop",
            "severity": "Baixo",
            "subcategory": "Rede",
            "text": "Revise UDR para a sub-rede do Pool de Hosts AVD"
        },
        {
            "category": "Rede",
            "description": "As URLs necessárias para o acesso ao plano de controle AVD por hosts de sessão estão documentadas aqui: https://learn.microsoft.com/azure/virtual-desktop/safe-url-list. Uma ferramenta de verificação está disponível para verificar a conectividade dos hosts de sessão: https://learn.microsoft.com/azure/virtual-desktop/safe-url-list#required-url-check-tool.",
            "guid": "65c7acbe-45bb-4e60-ad89-f2e87778424d",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/safe-url-list",
            "severity": "Alto",
            "subcategory": "Rede",
            "text": "Garantir que os endpoints do plano de controle AVD estejam acessíveis"
        },
        {
            "category": "Rede",
            "description": "Recomenda-se avaliar e revisar os requisitos de largura de banda de rede para os usuários, com base no tipo de carga de trabalho específico. O artigo referenciado fornece estimativas e recomendações gerais, mas medidas específicas são necessárias para o dimensionamento adequado. ",
            "guid": "516785c6-fa96-4c96-ad88-408f372734c8",
            "link": "https://learn.microsoft.com/windows-server/remote/remote-desktop-services/network-guidance",
            "severity": "Baixo",
            "subcategory": "Rede",
            "text": "Verifique a largura de banda de rede necessária para cada usuário e, no total, para a SKU da VM"
        },
        {
            "category": "Segurança",
            "description": "Recomendamos que você não conceda aos usuários acesso de administrador a áreas de trabalho virtuais. Se você precisar de pacotes de software, recomendamos disponibilizá-los por meio de utilitários de gerenciamento de configuração, como o Microsoft Endpoint Manager. Em um ambiente de várias sessões, recomendamos que você não permita que os usuários instalem o software diretamente.",
            "guid": "a0cdb3b5-4eb2-4eb0-9dda-a3592718e2ed",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "Média",
            "subcategory": "Configuração do host",
            "text": "Certifique-se de que os usuários do AVD não terão privilégios de administrador local nos hosts do AVD. "
        },
        {
            "category": "Segurança",
            "description": "O Microsoft Defender for Endpoint agora oferece suporte a várias sessões da Área de Trabalho Virtual do Windows para Windows 10 Enterprise. Consulte o artigo para integrar dispositivos VDI (infraestrutura de área de trabalho virtual) não persistentes: https://learn.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi",
            "guid": "b1172576-9ef6-4691-a483-5ac932223ece",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "Alto",
            "subcategory": "Configuração do host",
            "text": "Certifique-se de que a solução antivírus e antimalware seja usada"
        },
        {
            "category": "Segurança",
            "description": "Certifique-se de que as seguintes exclusões estão em vigor: https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix#antivirus-exclusions .",
            "guid": "80b12308-1a54-4174-8583-3ea3ad2c2de7",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "Alto",
            "subcategory": "Configuração do host",
            "text": "Certifique-se de que as exclusões AV adequadas estejam em vigor"
        },
        {
            "category": "Segurança",
            "description": "Os discos no Azure já são criptografados em repouso por padrão com chaves gerenciadas da Microsoft. A criptografia de disco do Host VM OS é possível e suportada usando ADE e DES: dados de usuário sensíveis e persistentes não devem ser armazenados no disco do Host da Sessão, então eles devem ser usados somente se estritamente necessário por motivo de conformidade. A criptografia do armazenamento FSLogix usando o Arquivos do Azure pode ser feita usando o SSE no Armazenamento do Azure.Para a criptografia do OneDrive, consulte este artigo: https://learn.microsoft.com/compliance/assurance/assurance-encryption-for-microsoft-365-services.",
            "guid": "0fd32907-98bc-4178-adc5-a06ca7144351",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "Baixo",
            "subcategory": "Configuração do host",
            "text": "Avaliar os requisitos de criptografia de disco para hosts AVD"
        },
        {
            "category": "Segurança",
            "description": "Considere o uso do Ponto de Extremidade do Azure Defender para controlar a navegação na Web do usuário. ",
            "guid": "e19dd344-29eb-4722-a237-a151c5bb4e4f",
            "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/windows-virtual-desktop-support-is-now-generally-available/ba-p/2103712",
            "severity": "Média",
            "subcategory": "Configuração do host",
            "text": "Precisa controlar/restringir a navegação do usuário na Internet a partir de hosts de sessão AVD?"
        },
        {
            "category": "Segurança",
            "description": "Recomendamos que você habilite o Azure Security Center Standard para assinaturas, máquinas virtuais, cofres de chaves e contas de armazenamento. Com o Azure Security Center Standard é possível avaliar e gerenciar vulnerabilidades, avaliar a conformidade com estruturas comuns, como PCI, fortalecer a segurança geral do seu ambiente AVD.",
            "guid": "1814387e-5ca9-4c26-a9b3-2ab5bdfc6998",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "Média",
            "subcategory": "Segurança",
            "text": "Avaliar o uso da Central de Segurança do Azure (ASC) para hosts de sessão AVD"
        },
        {
            "category": "Segurança",
            "description": "Deve ser usado, por exemplo, para impor bloqueio de área de trabalho e encerramento de sessão ociosa. Os GPOs existentes aplicados ao ambiente local devem ser revisados e, eventualmente, aplicados para proteger também os hosts AVD. ",
            "guid": "a135e337-897e-431c-97d6-8cb6a22ac19f",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "Média",
            "subcategory": "Segurança",
            "text": "Revisar GPOs do Active Directory para proteger sessões RDP"
        },
        {
            "category": "Segurança",
            "description": "Para obter detalhes e insights adicionais, consulte este artigo: https://christiaanbrinkhoff.com/2020/03/23/learn-how-to-increase-the-security-level-of-your-windows-virtual-desktop-environment-e-g-windows-client-with-azure-mfa-and-conditional-access",
            "guid": "916d697d-8ead-4ed2-9bdd-186f1ac252b9",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-mfa",
            "severity": "Baixo",
            "subcategory": "Segurança",
            "text": "Avaliar o uso de MFA para usuários de AVD"
        },
        {
            "category": "Segurança",
            "description": "A habilitação do Acesso Condicional permite que você gerencie riscos antes de conceder aos usuários acesso ao seu ambiente de Área de Trabalho Virtual do Windows. Ao decidir a quais usuários conceder acesso, recomendamos que você também considere quem é o usuário, como ele entra e qual dispositivo está usando.",
            "guid": "556246b4-3856-44b4-bc74-a748b6633ad2",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "Baixo",
            "subcategory": "Segurança",
            "text": "Avaliar o uso do Acesso Condicional para usuários"
        },
        {
            "category": "Segurança",
            "description": "A habilitação da coleta de logs de auditoria permite exibir a atividade do usuário e do administrador relacionada à Área de Trabalho Virtual do Windows. Este também é um requisito para habilitar e usar a ferramenta de Monitoramento AVD. Altamente recomendado para habilitar. ",
            "guid": "a0916a76-4980-4ad0-b278-ee293c1bc352",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "Média",
            "subcategory": "Segurança",
            "text": "Habilitar o log de diagnóstico e auditoria no espaço de trabalho central do Log Analytics"
        },
        {
            "category": "Segurança",
            "description": "O AVD usa RBAC (controles de acesso baseados em função) do Azure para atribuir funções a usuários e administradores. Essas funções dão aos administradores permissão para executar determinadas tarefas. Se a separação de tarefas for necessária, a Área de Trabalho Virtual do Windows terá funções adicionais que permitem separar funções de gerenciamento para pools de hosts, grupos de aplicativos e espaços de trabalho. Essa separação permite que você tenha um controle mais granular sobre as tarefas administrativas. Essas funções são nomeadas em conformidade com as funções padrão do Azure e a metodologia de privilégios mínimos.",
            "guid": "baaab757-1849-4ab8-893d-c9fc9d1bb73b",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/rbac",
            "severity": "Baixo",
            "subcategory": "Segurança",
            "text": "Avaliar o requisito de usar funções RBAC personalizadas para gerenciamento de AVD "
        },
        {
            "category": "Segurança",
            "description": "Um conjunto abrangente de práticas recomendadas de segurança e recomendações estão contidas no artigo referenciado, recomenda-se revisar. ",
            "guid": "36a5a67f-bb9e-4d5b-9547-8c4479816b28",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "Média",
            "subcategory": "Segurança",
            "text": "Revise todas as práticas recomendadas de segurança para o ambiente AVD"
        },
        {
            "category": "Armazenamento",
            "description": "Arquivos NetApp do Azure, Arquivos do Azure, Servidor de Arquivos baseado em VM. Servidor de arquivos não recomendado. O Azure Files Premium normalmente é um bom ponto de partida. A NetApp geralmente só é necessária para ambientes de grande escala/alto desempenho. ",
            "guid": "ed6b17db-8255-4462-b2ae-e4553afc8339",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/store-fslogix-profile",
            "severity": "Alto",
            "subcategory": "FSLogix",
            "text": "Determinar qual solução de back-end de armazenamento será usada para FSLogix Profile e Office Containers"
        },
        {
            "category": "Armazenamento",
            "description": "A recomendação na Área de Trabalho Virtual do Windows é usar o Contêiner de Perfil sem o Contêiner do Office, a menos que você esteja planejando cenários específicos de BCDR (Business Continuity and Disaster Recovery), conforme descrito na seção Recuperação de Desastres abaixo. https://learn.microsoft.com/fslogix/profile-container-office-container-cncpt ",
            "guid": "df47d2d9-2881-4b1c-b5d1-e54a29759e39",
            "link": "https://learn.microsoft.com/fslogix/profile-container-office-container-cncpt",
            "severity": "Baixo",
            "subcategory": "FSLogix",
            "text": "Avalie a possibilidade de separar os Contêineres de Perfil dos Contêineres do Office"
        },
        {
            "category": "Armazenamento",
            "description": "Como ponto de partida para estimar os requisitos de desempenho de armazenamento de contêiner de perfil, recomendamos assumir 10 IOPS por usuário no estado estacionário e 50 IOPS por usuário durante a entrada/saída.",
            "guid": "680e7828-9c93-4665-9d02-bff4564b0d93",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "Alto",
            "subcategory": "FSLogix",
            "text": "Verificar os limites de escalabilidade do armazenamento para dar suporte aos requisitos do Pool de Hosts"
        },
        {
            "category": "Armazenamento",
            "description": "Se uma segunda região for necessária para fins de DR, verifique a disponibilidade da NetApp também.",
            "guid": "4a359836-ee79-4d6c-9d3a-364a5b7abae3",
            "link": "https://azure.microsoft.com/global-infrastructure/services/",
            "severity": "Média",
            "subcategory": "FSLogix",
            "text": "Se o armazenamento do NetApp Files for usado, verifique a disponibilidade do serviço de armazenamento em sua região específica."
        },
        {
            "category": "Armazenamento",
            "description": "Evite introduzir latência e custos adicionais associados ao tráfego de rede entre regiões sempre que possível.",
            "guid": "8aad53cc-79e2-4e86-9673-57c549675c5e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/fslogix-containers-azure-files",
            "severity": "Alto",
            "subcategory": "FSLogix",
            "text": "Para obter o desempenho ideal, a solução de armazenamento e o contêiner de perfil FSLogix devem estar no mesmo local do data center."
        },
        {
            "category": "Armazenamento",
            "description": "Certifique-se de configurar as seguintes exclusões de antivírus para discos rígidos virtuais FSLogix Profile Container, conforme documentado no artigo referenciado.",
            "guid": "83f63047-22ee-479d-9b5c-3632054b69ba",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "Média",
            "subcategory": "FSLogix",
            "text": "Configure as exclusões antivírus recomendadas para o FSLogix (inclui não verificar arquivos VHD(x) na conexão)."
        },
        {
            "category": "Armazenamento",
            "description": "As configurações básicas e recomendadas padrão estão aqui: https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix#best-practice-settings-for-enterprises Veja aqui o conjunto principal: https://learn.microsoft.com/fslogix/configure-profile-container-tutorialSee aqui para referência completa: https://learn.microsoft.com/fslogix/profile-container-configuration-reference ",
            "guid": "d34aad5e-8c78-4e1d-9666-7313c405674c",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "Alto",
            "subcategory": "FSLogix",
            "text": "Revise as chaves do Registro FSLogix e determine quais devem ser aplicadas"
        },
        {
            "category": "Armazenamento",
            "description": "Conexões simultâneas ou múltiplas são desencorajadas na Área de Trabalho Virtual do Windows. A prática recomendada é criar um local de perfil diferente para cada sessão (como um pool de hosts).",
            "guid": "5e985b85-9c77-43e7-b261-623b775a917e",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "Alto",
            "subcategory": "FSLogix",
            "text": "Verificar o uso de conexões simultâneas ou múltiplas com o mesmo perfil"
        },
        {
            "category": "Armazenamento",
            "description": "Como uma estimativa geral, a ser validada em um ambiente de teste, para cada usuário 5 - 15 IOPS devem ser primeiro considerados, dependendo da carga de trabalho. Arquivos do Azure: IOPS máximo de 100k por compartilhamento Premium (máximo de 100TB) e até 5Gbps com latência de 3ms. Esteja ciente de como os Arquivos do Azure são provisionados, ou seja, IOPS estritamente vinculadas ao SIZE provisionado. Capacidade de dimensionamento de burst em alguns casos. Certifique-se de fornecer ao UPFRONT mais espaço do que o necessário para ter certeza de ter IOPS suficiente. NOTA: O Azure Premium talvez seja mais barato do que o Standard porque você não paga transações e, em seguida, detalhes importantes a serem lembrados. Arquivos NetApp do Azure: lembre-se de um máximo de 1000 IPs conectados, pode ajustar IOPS em tempo real, capacidade provisionada mínima de 4 TB. ",
            "guid": "1f348ff3-64d2-47d4-8e8b-bbc868155abb",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/store-fslogix-profile",
            "severity": "Alto",
            "subcategory": "FSLogix",
            "text": "Revise as práticas recomendadas e as principais considerações para o dimensionamento do armazenamento"
        },
        {
            "category": "Armazenamento",
            "description": "Certifique-se de verificar a lista de práticas recomendadas e recomendações descritas no artigo referenciado.",
            "guid": "9164e990-9ae2-48c8-9c33-b6b7808bafe6",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "Média",
            "subcategory": "FSLogix",
            "text": "Verificar as práticas recomendadas para os Arquivos do Azure (se usados)"
        },
        {
            "category": "Armazenamento",
            "description": "Certifique-se de verificar a lista de práticas recomendadas e recomendações descritas no artigo referenciado.",
            "guid": "c42149d4-13a9-423c-9574-d11028ac6aae",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "Média",
            "subcategory": "FSLogix",
            "text": "Verificar as práticas recomendadas para o NetApp Files (se usado)"
        },
        {
            "category": "Armazenamento",
            "description": "Os contêineres de perfil têm um tamanho máximo padrão de 30 GB. Se os Contêineres de Perfil grandes estiverem previstos e os clientes quiserem tentar mantê-los pequenos, considere usar o OneDrive para hospedar arquivos do Office 365 fora do perfil FSLogic.",
            "guid": "01e6a84d-e5df-443d-8992-481718d5d1e5",
            "link": "https://learn.microsoft.com/fslogix/profile-container-configuration-reference",
            "severity": "Alto",
            "subcategory": "FSLogix",
            "text": "Revise e confirme o tamanho máximo do perfil configurado no FSLogix"
        },
        {
            "category": "Armazenamento",
            "description": "O Cloud Cache usa o disco local como cache e pode gerar muita pressão sobre o disco da VM. Recomendado para aproveitar o poder do disco de VM temporário (e conectado localmente), se possível com base na SKU da VM. ",
            "guid": "b2d1215a-e114-4ba3-9df5-85ecdcd9bd3b",
            "link": "https://learn.microsoft.com/fslogix/cloud-cache-configuration-reference",
            "severity": "Média",
            "subcategory": "FSLogix",
            "text": "Se o FSLogix Cloud Cache for usado, mova o diretório Cache para a unidade temporária."
        },
        {
            "category": "Armazenamento",
            "description": "REDIRECTION.XML arquivo é usado para controlar quais pastas são redirecionadas do contêiner de perfil para a unidade C:. As exclusões devem ser a exceção e nunca devem ser usadas, a menos que a exclusão específica seja completamente compreendida pela pessoa que configura a exclusão. As exclusões devem ser sempre totalmente testadas no ambiente em que se destinam a ser implementadas. A configuração de exclusões pode afetar a funcionalidade, a estabilidade e o desempenho.",
            "guid": "0b50ca97-b1d2-473c-b4d9-6e98b0f912de",
            "link": "https://learn.microsoft.com/fslogix/manage-profile-content-cncpt#redirectionsxml",
            "severity": "Média",
            "subcategory": "FSLogix",
            "text": "Revise o uso do redirecionamento FSLogix."
        },
        {
            "category": "Armazenamento",
            "description": "Um Site do Active Directory deve ser criado para o ambiente de rede virtual do Azure onde a sub-rede ANF será criada, e esse nome de site deve ser especificado na propriedade de conexão ANF ao executar o procedimento de associação, conforme explicado no artigo de referência.",
            "guid": "6647e977-db49-48a8-bc35-743f17499d42",
            "link": "https://learn.microsoft.com/azure/azure-netapp-files/create-active-directory-connections",
            "severity": "Alto",
            "subcategory": "FSLogix",
            "text": "Se o armazenamento dos Arquivos NetApp do Azure for usado, marque a configuração do nome do Site do AD na Conexão do AD."
        },
        {
            "category": "Armazenamento",
            "description": "O SMB Multichannel permite que os clientes usem várias conexões de rede que proporcionam maior desempenho e, ao mesmo tempo, reduzem o custo de propriedade. O desempenho maior é alcançado por meio da agregação de largura de banda em várias NICs e da utilização do suporte a RSS (Receive Side Scaling) para NICs para distribuir a carga de E/S entre várias CPUs.",
            "guid": "5784b6ca-5e9e-4bcf-8b54-c95459ea7369",
            "link": "https://learn.microsoft.com/azure/storage/files/storage-files-smb-multichannel-performance",
            "severity": "Média",
            "subcategory": "FSLogix",
            "text": "Habilite o SMB multicanal ao usar um compartilhamento de arquivos premium para hospedar contêineres de perfil FSLogix."
        },
        {
            "category": "Armazenamento",
            "description": "HDD padrão, SSD padrão ou SSD Premium, discos efêmeros não são suportados, Ultra-Discos não recomendados. Recomendado para avaliar o disco Premium para OS se a densidade do usuário não for baixa e se você for usar o Cloud Cache. ",
            "guid": "3611c818-b0a0-4bc5-80e4-3a18a9cd289c",
            "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
            "severity": "Média",
            "subcategory": "Host da Sessão ",
            "text": "Determinar que tipo de disco gerenciado será usado para os hosts de sessão  "
        }
    ],
    "metadata": {
        "name": "Azure Virtual Desktop Review",
        "state": "GA"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Média"
        },
        {
            "name": "Baixo"
        }
    ],
    "status": [
        {
            "description": "Esta verificação ainda não foi analisada",
            "name": "Não verificado"
        },
        {
            "description": "Há um item de ação associado a essa verificação",
            "name": "Abrir"
        },
        {
            "description": "Essa verificação foi verificada e não há mais itens de ação associados a ela",
            "name": "Cumprido"
        },
        {
            "description": "Recomendação entendida, mas não necessária pelos requisitos atuais",
            "name": "Não é necessário"
        },
        {
            "description": "Não aplicável ao projeto atual",
            "name": "N/A"
        }
    ]
}
checklists/avd_checklist.ko.json METASEP
{
    "$schema": "checklist.schema.json",
    "categories": [
        {
            "name": "토대"
        },
        {
            "name": "신원"
        },
        {
            "name": "네트워킹"
        },
        {
            "name": "계산"
        },
        {
            "name": "보관"
        },
        {
            "name": "안전"
        },
        {
            "name": "모니터링 및 관리"
        },
        {
            "name": "BC/DR"
        }
    ],
    "items": [
        {
            "category": "BC/DR",
            "description": "AVD 제어 계획은 재정적으로 지원되는 서비스 수준 계약을 제공하지 않습니다. Microsoft는 Windows 가상 데스크톱 서비스 URL에 대해 최소 99.9%의 가용성을 달성하기 위해 노력하고 있습니다. 구독에서 세션 호스트 가상 컴퓨터의 가용성은 가상 컴퓨터 SLA에 포함됩니다. 종속 리소스/서비스 및 인프라 가용성도 글로벌 고가용성 요구 사항을 적절하게 충족하기 위해 고려해야 합니다. ",
            "guid": "56c57ba5-9119-4bf8-b8f5-c586c7d9cdc1",
            "link": "https://azure.microsoft.com/support/legal/sla/virtual-desktop/v1_0/",
            "severity": "높다",
            "subcategory": "계산",
            "text": "AVD를 통해 게시된 애플리케이션/데스크톱에 대해 예상되는 고가용성 SLA 결정"
        },
        {
            "category": "BC/DR",
            "description": "활성-활성' 모델은 서로 다른 지역의 여러 호스트 풀을 사용하여 달성할 수 있습니다. 다른 지역의 VM이 있는 단일 호스트 풀은 권장되지 않습니다. 동일한 사용자에 대해 여러 풀을 사용하는 경우 사용자 프로필을 동기화/복제하는 방법의 문제를 해결해야 합니다. FSLogix 클라우드 캐시를 사용할 수 있지만 신중하게 검토하고 계획해야 하거나 고객이 동기화/복제를 전혀 사용하지 않도록 결정할 수 있습니다. '활성-수동'은 ASR(Azure 사이트 복구) 또는 자동화된 메커니즘이 있는 주문형 풀 배포를 사용하여 수행할 수 있습니다.",
            "guid": "6acc076e-f9b1-441a-a989-579e76b897e7",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "보통",
            "subcategory": "계산",
            "text": "AVD 호스트 풀에 대한 지역 재해 복구 지역 평가"
        },
        {
            "category": "BC/DR",
            "description": "Windows 가상 데스크톱 BCDR 계획 및 디자인에 접근하기 전에 AVD를 통해 사용되는 응용 프로그램이 중요한지 처음에 고려하는 것이 중요합니다. 중요하지 않은 앱과 분리하고 다른 재해 복구 방법 및 기능을 가진 별도의 호스트 풀을 사용할 수 있습니다.",
            "guid": "10a7da7b-e996-46e1-9d3c-4ada97cc3d13",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "보통",
            "subcategory": "계산",
            "text": "서로 다른 AVD 호스트 풀에서 중요한 애플리케이션 분리"
        },
        {
            "category": "BC/DR",
            "description": "? 호스트 풀 VM(가용성 집합 및 가용성 영역)에 대해 적절한 복원력 수준을 선택했습니까? AS 또는 AZ와 함께 제공되는 HA SLA 및 확장성 제한에 대한 영향을 알고 있습니까? ? 현재 가용성 집합 없이 Windows 가상 데스크톱 ARM 템플릿 배포당 399개의 VM 또는 가용성 집합당 200개의 VM을 배포할 수 있습니다. ARM 템플릿 또는 Azure Portal 호스트 풀 등록에서 가용성 집합을 해제하여 배포당 VM 수를 늘릴 수 있습니다. 이제 AZ를 배포할 수 있으며, 현재 한 번에 하나의 AZ를 원하는 각 AZ에 VM의 일부를 수동으로 생성해야 합니다. ",
            "guid": "25ab225c-6f4e-4168-9fdd-dea8a4b7cdeb",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/faq",
            "severity": "높다",
            "subcategory": "계산",
            "text": "AVD 호스트 풀 배포를 위한 최상의 복원력 옵션 계획"
        },
        {
            "category": "BC/DR",
            "description": "Azure Backup은 호스트 풀 VM을 보호하는 데도 사용할 수 있으며, 호스트 풀 VM이 상태 비저장이어야 하는 경우에도 이 방법이 지원됩니다. 이 옵션은 개인 호스트 풀에 대해 고려할 수 있습니다. ",
            "guid": "4c61fc3f-c14e-4ea6-b69e-8d9a3eec218e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "보통",
            "subcategory": "계산",
            "text": "AVD 세션 호스트 백업 요구 사항 평가"
        },
        {
            "category": "BC/DR",
            "description": "사용자 지정 이미지를 사용하여 AVD 호스트 풀 VM을 배포하는 경우 중대한 재해가 발생하더라도 모든 지역에서 해당 아티팩트를 사용할 수 있도록 하는 것이 중요합니다. Azure Compute 갤러리 서비스를 사용하여 호스트 풀이 배포된 모든 지역에서 중복 스토리지 및 여러 복사본으로 이미지를 복제할 수 있습니다.",
            "guid": "dd2e0d5d-771d-441e-9610-cc57b4a4a141",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/shared-images-portal",
            "severity": "낮다",
            "subcategory": "종속성",
            "text": "골든 이미지 지역 간 가용성 계획"
        },
        {
            "category": "BC/DR",
            "description": "AVD 인프라 사용자에게 온-프레미스 리소스 액세스가 필요한 경우 연결에 필요한 네트워크 인프라의 고가용성도 중요하므로 고려해야 합니다. 인증 인프라의 복원력을 평가하고 평가해야 합니다. 종속 애플리케이션 및 기타 리소스에 대한 BCDR 측면을 고려하여 보조 DR 위치에서 가용성을 보장해야 합니다.",
            "guid": "fd339489-8c12-488b-9c6a-57cfb644451e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "보통",
            "subcategory": "종속성",
            "text": "Assessment Infrastructure & Application Dependencies "
        },
        {
            "category": "BC/DR",
            "description": "FSLogix 사용자 프로필 내의 모든 데이터가 재해로부터 보호받을 수 있는 것은 아닙니다. 또한 OneDrive 또는 파일 서버/공유와 같은 외부 저장소를 사용하는 경우 FSLogix 프로필에 남아 있는 항목이 최소화되며 일부 극단적인 상황에서 손실될 수 있습니다. 다른 경우에는 프로필 내의 데이터를 다른 저장소(예: 캐시 모드의 Outlook 받은 편지함)에서 다시 작성할 수 있습니다. ",
            "guid": "687ab077-adb5-49e5-a960-3334fdf8cc23",
            "link": "https://learn.microsoft.com/fslogix/manage-profile-content-cncpt",
            "severity": "보통",
            "subcategory": "보관",
            "text": "프로필 및 Office 컨테이너 내에서 보호해야 하는 데이터 평가"
        },
        {
            "category": "BC/DR",
            "description": "중요한 사용자 데이터의 데이터 손실을 방지하는 것이 중요하며, 첫 번째 단계는 저장하고 보호해야 하는 데이터를 평가하는 것입니다. OneDrive 또는 기타 외부 저장소를 사용하는 경우 사용자 프로필 및/또는 Office 컨테이너 데이터를 저장할 필요가 없을 수 있습니다. 중요한 사용자 데이터를 보호하기 위해 적절한 메커니즘을 고려해야 합니다. Azure 백업 서비스는 Azure 파일 표준 및 프리미엄 계층에 저장될 때 프로필 및 Office 컨테이너 데이터를 보호하는 데 사용할 수 있습니다. Azure NetApp Files 스냅샷 및 정책은 Azure NetApp Files(모든 계층)에 사용할 수 있습니다.",
            "guid": "fc4972cc-3cd2-45bf-a707-6e9eab4bed32",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "보통",
            "subcategory": "보관",
            "text": "프로필 및 Office 컨테이너에 대한 백업 보호 전략 구축"
        },
        {
            "category": "BC/DR",
            "description": "AVD에서는 FSLogix 컨테이너에 있는 사용자 데이터에 대해 여러 복제 메커니즘과 전략을 사용할 수 있습니다. 프로필 패턴 #1: 네이티브 Azure 저장소 복제 메커니즘(예: Azure 파일 표준 GRS 복제, Azure NetApp 파일 지역 간 복제 또는 VM 기반 파일 서버에 대한 Azure 파일 동기화)? Azure Files에 ZRS(영역 복제 스토리지) 또는 GRS(지역 복제 스토리지)를 사용하는 것이 좋습니다.? 영역/지역 보호가 필요하지 않은 경우 로컬 전용 복원력이 있는 LRS를 사용할 수 있습니다. 참고: Azure 파일 공유 표준은 LRS/ZRS/GRS이지만 100TB 대규모 지원을 사용하도록 설정하면 LRS/ZRS만 지원됩니다. ? 프로필 패턴 #2: FSLogix 클라우드 캐시는 서로 다른(최대 4개) 스토리지 계정 간에 컨테이너를 복제하는 자동 메커니즘으로 빌드됩니다. 클라우드 캐시는 다음과 같은 경우에만 사용해야 합니다. 사용자 프로필 또는 Office 컨테이너 데이터 가용성 필요 고가용성 SLA는 중요하며 지역 오류에 탄력적이어야 합니다. 선택한 스토리지 옵션은 BCDR 요구 사항을 충족할 수 없습니다. 예를 들어 Azure 파일 공유 프리미엄 계층 또는 대용량 파일 지원이 있는 Azure 파일 공유 표준을 사용하도록 설정하면 GRS를 사용할 수 없습니다. 서로 다른 스토리지 간의 복제가 필요한 경우.? 프로필 패턴 #3: 사용자 데이터/프로필 컨테이너가 아닌 응용 프로그램 데이터에 대해서만 지역 재해 복구 설정: 중요한 응용 프로그램 데이터를 OneDrive 또는 자체 DR 메커니즘이 내장된 기타 외부 저장소와 같은 별도의 저장소에 저장합니다.",
            "guid": "9f7547c1-746d-4c56-868a-714435bd09dd",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "보통",
            "subcategory": "보관",
            "text": "프로필 컨테이너 스토리지 복제 요구 사항 및 BCDR 용도의 복원력 평가"
        },
        {
            "category": "BC/DR",
            "description": "지리적 재해 복구: Azure NetApp Files는 기본적으로 LRS(로컬로 복제된 스토리지)이므로 지역 간 복제를 원하는 경우 더 많은 것을 설계해야 합니다. 현재 교차 지역에 대한 권장 사항은 다른 Azure 지역(및 NetApp 볼륨)으로 복제하는 NetApp Cloud Sync입니다. 백업: 백업은 스냅샷에 의해 처리되지만 자동이 아니므로 정책을 사용하여 예약해야 합니다. https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-manage-snapshots. 볼륨당 스냅샷의 최대 제한(255)은 여기에 설명된 대로 https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-resource-limits 입니다.",
            "guid": "23429db7-2281-4376-85cc-57b4a4b18142",
            "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-manage-snapshots",
            "severity": "보통",
            "subcategory": "보관",
            "text": "Azure NetApp Files DR 전략 검토"
        },
        {
            "category": "BC/DR",
            "description": "지역 재해 복구: Azure Files용 GRS는 표준 SKU에서만 사용할 수 있으며 대규모 공유 지원은 없으므로 대부분의 고객 시나리오에 적합하지 않습니다. 지역에서 복제가 필요한 경우 Azure 파일 공유 프리미엄을 사용하는 경우 FSLogix 클라우드 캐시를 사용한 복제를 평가하거나 '지역 내' AZ(가용성 영역) 전용 복원력을 고려해야 합니다. 백업: Azure 백업은 Azure 파일 공유 모든 SKU를 완벽하게 지원하며 프로필 컨테이너를 보호하는 데 권장되는 솔루션입니다. OneDrive 또는 기타 외부 저장소를 사용하는 경우 사용자 프로필 및/또는 Office 컨테이너 데이터를 저장할 필요가 없을 수 있습니다.",
            "guid": "3d4f3537-c134-46dc-9602-7a71efe1bd05",
            "link": "https://learn.microsoft.com/azure/backup/backup-afs",
            "severity": "보통",
            "subcategory": "보관",
            "text": "Azure 파일 DR 전략 검토"
        },
        {
            "category": "계산",
            "description": "애플리케이션은 골든 이미지로 사전 설치하거나, MSIX 및 AppAttach 기능을 사용하여 연결하거나, 기존 SW 배포 방법을 사용하여 풀 배포 후 호스트에 배포할 수 있습니다.",
            "guid": "86ba2802-1459-4014-95d3-8e5309ccbd97",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-customize-master-image",
            "severity": "높다",
            "subcategory": "골든 이미지 / s",
            "text": "AVD 호스트 풀에 애플리케이션을 배포하는 방법 결정"
        },
        {
            "category": "계산",
            "description": "단일 이미지에 적합한 fslogix 응용 프로그램 마스킹을 사용합니까, 아니면 다른 응용 프로그램이 구워진 다중 이미지를 사용합니까?",
            "guid": "9266bcca-274f-4aa1-abf3-9d95d44c7c89",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace",
            "severity": "보통",
            "subcategory": "골든 이미지 / s",
            "text": "필요한 골든 이미지 수 추정"
        },
        {
            "category": "계산",
            "description": "각 호스트 풀을 배포하는 데 사용할 게스트 OS 결정: Windows 10 대 Windows Server, 마켓플레이스 대 사용자 지정 이미지",
            "guid": "19ca1f6d-5315-4ae5-84ba-34d4585e2213",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "보통",
            "subcategory": "골든 이미지 / s",
            "text": "호스트 풀 배포에 사용할 OS 이미지 결정"
        },
        {
            "category": "계산",
            "description": "아무 것도 없는 경우 Azure 이미지 빌더를 사용하여 빌드 프로세스를 자동화하는 것이 좋습니다. ",
            "guid": "9bd7bb01-2f7b-495e-86e1-54e2aa359282",
            "link": "https://learn.microsoft.com/azure/virtual-machines/image-builder-overview",
            "severity": "낮다",
            "subcategory": "골든 이미지 / s",
            "text": "사용자 지정 이미지를 사용할 경우 자동화된 빌드 프로세스가 있는지 확인합니다."
        },
        {
            "category": "계산",
            "description": "Azure 계산 갤러리를 평가합니다.",
            "guid": "5a2adb2c-3e23-426b-b225-ca44e1696fdd",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/shared-image-galleries",
            "severity": "낮다",
            "subcategory": "골든 이미지 / s",
            "text": "사용자 지정 이미지를 사용할 경우 이미지의 수명 주기를 구성하고 관리할 계획이 있습니까?"
        },
        {
            "category": "계산",
            "description": "골든 이미지 사용자 지정에 대한 몇 가지 알려진 모범 사례 및 권장 사항이 있으므로 참조된 문서를 확인하십시오. ",
            "guid": "deace4cb-1dec-44c6-90c3-fc14eebb36a3",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-customize-master-image",
            "severity": "보통",
            "subcategory": "골든 이미지 / s",
            "text": "맞춤 이미지를 사용할 경우 마스터 이미지를 빌드하는 방법에 대한 AVD 권장사항을 확인하세요."
        },
        {
            "category": "계산",
            "description": "이 도구 집합은 백서 'VDI(가상 데스크톱 인프라) 역할에 대해 Windows 10 버전 2004 최적화'https://learn.microsoft.com/windows-server/remote/remote-desktop-services/rds-vdi-recommendations-2004 에 참조된 설정을 자동으로 적용하기 위해 만들어졌습니다. 백서에 언급된 도구의 사용 및/또는 최적화를 고려해야 합니다. ",
            "guid": "829e3fec-2183-4687-a017-7a2b5945bda4",
            "link": "https://github.com/The-Virtual-Desktop-Team/Virtual-Desktop-Optimization-Tool",
            "severity": "보통",
            "subcategory": "골든 이미지 / s",
            "text": "가상 데스크톱 최적화 도구의 사용 평가"
        },
        {
            "category": "계산",
            "description": "초기 배포 후 호스트 풀 VM 구성을 관리하기 위한 구성 관리 도구(예: SCCM, MEM/Intune, GPO, 타사 솔루션)가 이미 있는지 확인합니다.",
            "guid": "3334fdf9-1c23-4418-8b65-285269440b4b",
            "link": "https://learn.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop-multi-session",
            "severity": "낮다",
            "subcategory": "골든 이미지 / s",
            "text": "AVD 세션 호스트 구성 관리 전략 계획/평가"
        },
        {
            "category": "계산",
            "description": "제공된 문서를 검토하고 '알려진 폴더 리디렉션' 및 '주문형 파일'을 확인합니다. OneDrive 기능을 고려하고 결국 채택해야 합니다.",
            "guid": "e3d3e084-4276-4d4b-bc01-5bcf219e4a1e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/install-office-on-AVD-master-image",
            "severity": "보통",
            "subcategory": "골든 이미지 / s",
            "text": "마이크로소프트 원드라이브가 AVD 배포의 일부가 될지 확인"
        },
        {
            "category": "계산",
            "description": "이 문서를 검토하고 최신 버전을 사용하고, Teams 제외를 검토 및 평가하여 프로필 크기를 줄여야 합니다.",
            "guid": "b5887953-5d22-4788-9d30-b66c67be5951",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/teams-on-AVD",
            "severity": "보통",
            "subcategory": "골든 이미지 / s",
            "text": "마이크로소프트 팀이 AVD 배포에 포함될 것인지 확인"
        },
        {
            "category": "계산",
            "description": "별도의 스토리지 계정/공유를 사용하여 MSIX 패키지를 저장하는 것이 좋습니다. 필요한 경우 저장소는 독립적으로 확장할 수 있으며 프로필 I/O 작업의 영향을 받지 않습니다. Azure는 MISX 앱 연결에 사용할 수 있는 여러 저장소 옵션을 제공합니다. Azure 파일 또는 Azure NetApp 파일은 비용과 관리 오버헤드 간에 최상의 가치를 제공하므로 이러한 옵션을 사용하는 것이 좋습니다. ",
            "guid": "90083845-c587-4cb3-a1ec-16a1d076ef9f",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-file-share",
            "severity": "높다",
            "subcategory": "MSIX 및 AppAttach",
            "text": "프로필/Office 컨테이너와 동일한 저장소 계정/공유를 사용하지 마세요. "
        },
        {
            "category": "계산",
            "description": "참조된 문서에서는 AVD 컨텍스트에서 MSIX 사용에 대한 몇 가지 중요한 성능 고려 사항을 보고했으므로 신중하게 검토해야 합니다.",
            "guid": "241addce-5793-477b-adb3-751ab2ac1fad",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-file-share",
            "severity": "높다",
            "subcategory": "MSIX 및 AppAttach",
            "text": "MSIX에 대한 성능 고려 사항 검토"
        },
        {
            "category": "계산",
            "description": "MSIX 앱 연결에는 파일 공유에 액세스하기 위한 읽기 전용 권한이 필요합니다. MSIX 애플리케이션을 Azure Files에 저장하는 경우 세션 호스트에 대해 모든 세션 호스트 VM에 공유에 대한 스토리지 계정 RBAC(역할 기반 액세스 제어) 및 파일 공유 NTFS(신기술 파일 시스템) 권한을 모두 할당해야 합니다.",
            "guid": "66e15d4d-5a2a-4db2-a3e2-326bf225ca41",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-file-share",
            "severity": "보통",
            "subcategory": "MSIX 및 AppAttach",
            "text": "MSIX 공유에 대한 적절한 세션 호스트 권한 확인"
        },
        {
            "category": "계산",
            "description": "타사 소프트웨어 공급업체는 MSIX 패키지를 제공해야 하며, 고객이 애플리케이션 소유자의 적절한 지원 없이 변환 절차를 시도하지 않는 것이 좋습니다.",
            "guid": "bd362caa-ab79-4b19-adab-81932c9fc9d1",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-faq",
            "severity": "보통",
            "subcategory": "MSIX 및 AppAttach",
            "text": "제3자 애플리케이션을 위한 MSIX 패키지"
        },
        {
            "category": "계산",
            "description": "MSIX 앱 연결은 MSIX 애플리케이션에 대한 자동 업데이트를 지원하지 않으므로 사용하지 않도록 설정해야 합니다.",
            "guid": "bb88037f-5e6b-4fbb-aed5-03547cc447e8",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-faq",
            "severity": "낮다",
            "subcategory": "MSIX 및 AppAttach",
            "text": "MSIX 패키지에 대한 자동 업데이트 사용 안 함"
        },
        {
            "category": "계산",
            "description": "MSIX 및 앱 연결을 활용하려면 AVD 호스트 풀의 게스트 OS 이미지가 Windows 10 Enterprise 또는 Windows 10 Enterprise 다중 세션 버전 2004 이상이어야 합니다.",
            "guid": "26128a71-f0f1-4cac-9d9e-f1d5e832e42e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-faq",
            "severity": "보통",
            "subcategory": "MSIX 및 AppAttach",
            "text": "운영 체제 지원 검토"
        },
        {
            "category": "계산",
            "description": "호스트 풀 배포에 사용할 VM SKU를 선택한 후에는 더 높은 보안 및 향상된 기능을 위해 Gen2 유형의 SKU를 사용하는 것이 좋습니다.",
            "guid": "e4633254-3185-40a1-b120-bd563a1c8e9d",
            "link": "https://learn.microsoft.com/azure/virtual-machines/generation-2",
            "severity": "보통",
            "subcategory": "세션 호스트",
            "text": "호스트 풀 배포를 위한 Gen2 VM 사용량 평가"
        },
        {
            "category": "토대",
            "description": "공유/공동 또는 전용/개인",
            "guid": "8468c55a-775c-46ee-a5b8-6ad8844ce3b2",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace",
            "severity": "높다",
            "subcategory": "용량 계획",
            "text": "사용할 호스트 풀 유형 결정"
        },
        {
            "category": "토대",
            "description": "자동 할당과 직접 할당의 차이점을 잘 이해하고 선택한 옵션이 해당 시나리오에 적합한지 확인합니다.",
            "guid": "b38b875b-a1cf-4204-a901-3a5d3ce474db",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type",
            "severity": "보통",
            "subcategory": "용량 계획",
            "text": "개인 호스트 풀 유형의 경우 할당 유형을 결정합니다."
        },
        {
            "category": "토대",
            "description": "사용할 항목과 사용 가능한 옵션을 확인하고 자동 크기 조정을 사용할 경우 너비 우선으로 설정합니다. ",
            "guid": "cbd8682a-6abc-4a2a-9fda-1dbf3dc95d48",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/host-pool-load-balancing",
            "severity": "보통",
            "subcategory": "용량 계획",
            "text": "풀링된 호스트 풀 유형의 경우 부하 분산 방법 결정"
        },
        {
            "category": "토대",
            "description": "선택 기준에 따라 필요한 호스트 풀 수는 몇 개입니까? 다음과 같은 경우 여러 개를 갖는 것을 고려해야합니다. 여러 OS 이미지? 여러 지역? 다른 HW가 필요합니까? 다른 호스트 풀 유형(공유 대 개인)? 다른 사용자 요구 사항 및 SLA (상위 사용자, 임원, 사무원 대 개발자 등)? 다른 RDP 설정(호스트 풀 수준에서 적용됨)은 https://learn.microsoft.com/azure/virtual-desktop/customize-rdp-properties? 최대 용량을 초과하는 호스트 풀의 필수 VM 수",
            "guid": "c7c791dc-a1f6-4d56-999e-558b937d4985",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/environment-setup",
            "severity": "높다",
            "subcategory": "용량 계획",
            "text": "배포할 여러 호스트 풀의 수 예상 "
        },
        {
            "category": "토대",
            "description": "제공된 링크를 사용하여 SKU 결정의 시작점을 설정한 다음, 성능 테스트를 사용하여 유효성을 검사합니다. 프로덕션에 대해 최소 4개의 코어가 세션 호스트(다중 세션)당 선택되었는지 확인합니다.",
            "guid": "e1112dbd-7ba0-412e-9b94-ef6e047d2ea2",
            "link": "https://learn.microsoft.com/windows-server/remote/remote-desktop-services/virtual-machine-recs",
            "severity": "보통",
            "subcategory": "용량 계획",
            "text": "워크로드 성능 테스트를 실행하여 사용할 최상의 Azure VM SKU 및 크기 결정(풀당 호스트 수 결정)"
        },
        {
            "category": "토대",
            "description": "참조된 문서에 보고된 AVD 용량 및 한도를 확인하는 것이 중요합니다. ",
            "guid": "992b1cd6-d2f5-44b2-a769-e3a691e8838a",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop",
            "severity": "높다",
            "subcategory": "용량 계획",
            "text": "환경에 대한 AVD 확장성 제한 확인"
        },
        {
            "category": "토대",
            "description": "GPU가 있는 호스트 풀에는 특별한 구성이 필요하므로 참조된 문서를 검토하세요. ",
            "guid": "c936667e-13c0-4056-94b1-e945a459837e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/configure-vm-gpu",
            "severity": "보통",
            "subcategory": "용량 계획",
            "text": "세션 호스트에 GPU가 필요한지 여부 결정"
        },
        {
            "category": "토대",
            "description": "가능하면 가속화된 네트워킹 기능이 있는 VM SKU를 활용하는 것이 좋습니다. 오늘 pnly 윈도우 서버 OS가 지원됩니다 (기사의 목록 참조), 향후 윈도우 클라이언트 OS도 포함될 수 있습니다. ",
            "guid": "b47a393a-0803-4272-a479-8b1578b219a4",
            "link": "https://learn.microsoft.com/azure/virtual-network/create-vm-accelerated-networking-powershell",
            "severity": "낮다",
            "subcategory": "용량 계획",
            "text": "Azure에서 가속화된 네트워킹 기능을 활용할 수 있는 VM SKU를 사용하는 것이 좋습니다."
        },
        {
            "category": "토대",
            "description": "적절한 계획 및 배포를 위해서는 최대 사용자 수와 평균 동시 세션 수를 평가하는 것이 중요합니다. ",
            "guid": "bb91a33d-90ca-4e2c-a881-3706f7c0cb9f",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/faq",
            "severity": "보통",
            "subcategory": "클라이언트 및 사용자",
            "text": "AVD에 연결할 사용자 수와 지역 평가"
        },
        {
            "category": "토대",
            "description": "여러 호스트 풀이 필요할 수 있습니다. 다른 사용자 집합을 지원하는 데 필요한 사용자 수를 예측하는 것이 좋습니다. ",
            "guid": "a1cf2049-9013-4a5d-9ce4-74dbcbd8682a",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/environment-setup",
            "severity": "보통",
            "subcategory": "클라이언트 및 사용자",
            "text": "모든 사용자가 동일한 애플리케이션 집합 및/또는 다른 호스트 풀 구성 및/또는 OS 이미지를 사용하는지 확인"
        },
        {
            "category": "토대",
            "description": "AVD 풀 외부의 리소스에 대한 종속성(예: Active Directory, 외부 파일 공유 또는 기타 스토리지, 온-프레미스 서비스 및 리소스, VPN 및/또는 Express 경로와 같은 네트워크 인프라 구성 요소, 외부 서비스 및 타사 구성 요소)을 평가하고 검토해야 합니다. 이러한 모든 리소스에 대해 AVD 호스트 풀의 대기 시간을 평가하고 연결을 고려해야 합니다. 또한 BCDR 고려 사항을 이러한 종속성에도 적용해야 합니다.",
            "guid": "6abca2a4-fda1-4dbf-9dc9-5d48c7c791dc",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "낮다",
            "subcategory": "클라이언트 및 사용자",
            "text": "각 호스트 풀에 대한 외부 종속성 평가"
        },
        {
            "category": "토대",
            "description": "각 클라이언트의 제한 사항을 검토하고 가능한 경우 여러 옵션을 비교합니다.",
            "guid": "a1f6d565-99e5-458b-a37d-4985e1112dbd",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/connect-windows-7-10",
            "severity": "보통",
            "subcategory": "클라이언트 및 사용자",
            "text": "사용된 클라이언트 OS 및 AVD 클라이언트 유형 검토"
        },
        {
            "category": "토대",
            "description": "Windows 가상 데스크톱 워크로드를 실행할 수 있는 적절한 라이선스가 있는 고객은 세션 호스트 가상 머신에 Windows 라이선스를 적용하고 다른 라이선스에 대한 비용을 지불하지 않고 실행할 수 있습니다.",
            "guid": "7ba012e7-b94e-4f6e-847d-2ea2992b1cd6",
            "link": "https://azure.microsoft.com/pricing/details/virtual-desktop/",
            "severity": "낮다",
            "subcategory": "클라이언트 및 사용자",
            "text": "라이선스 요구 사항 확인"
        },
        {
            "category": "토대",
            "description": "사용자 위치 및 AVD 지역 배포에 따라 사용자에게 최적이 아닌 환경이 있을 수 있으므로 소규모 PoC 환경에서 가능한 한 빨리 테스트하는 것이 중요합니다. ",
            "guid": "d2f54b29-769e-43a6-a1e8-838ac936667e",
            "link": "https://azure.microsoft.com/services/virtual-desktop/assessment/",
            "severity": "높다",
            "subcategory": "클라이언트 및 사용자",
            "text": "PoC를 실행하여 종단 간 사용자 환경을 테스트하여 네트워크 대기 시간으로 인한 영향을 확인합니다."
        },
        {
            "category": "토대",
            "description": "사용자에게 전체 데스크톱 및/또는 원격 애플리케이션 그룹이 제공되는지 여부를 결정합니다. ",
            "guid": "13c00567-4b1e-4945-a459-837ee7ad6c6d",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/manage-app-groups",
            "severity": "낮다",
            "subcategory": "클라이언트 및 사용자",
            "text": "사용자가 전체 데스크톱 및/또는 원격 애플리케이션을 사용하여 AVD에 액세스할지 여부 결정 "
        },
        {
            "category": "토대",
            "description": "RDP 설정은 현재 사용자/그룹이 아닌 호스트 풀 수준에서만 구성할 수 있습니다.",
            "guid": "3b365a5c-7acb-4e48-abe5-4cd79f2e8776",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/customize-rdp-properties",
            "severity": "낮다",
            "subcategory": "클라이언트 및 사용자",
            "text": "모든 사용자가 동일한 RDP 설정을 사용합니까? "
        },
        {
            "category": "토대",
            "description": "관리되는 네트워크에 대한 RDP Shortpath는 원격 데스크톱 클라이언트와 세션 호스트 간에 직접 UDP 기반 전송을 설정하는 Azure 가상 데스크톱의 기능입니다. 추가 릴레이를 제거하면 왕복 시간이 줄어들어 대기 시간에 민감한 애플리케이션 및 입력 방법에 대한 사용자 경험이 향상됩니다. RDP 단축 경로를 지원하려면 Azure 가상 데스크톱 클라이언트가 세션 호스트에 대한 직접적인 가시선이 필요하며 Windows 10 또는 Windows 7을 실행하고 Windows 데스크톱 클라이언트가 설치되어 있어야 합니다.",
            "guid": "b2074747-d01a-4f61-b1aa-92ad793d9ff4",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/shortpath",
            "severity": "보통",
            "subcategory": "클라이언트 및 사용자",
            "text": "관리되는 내부 네트워크에서 연결하는 클라이언트에 대한 RDP ShortPath 평가"
        },
        {
            "category": "토대",
            "description": "AVD는 비지역 서비스이며 모든 지역에서 호스트 풀을 만들 수 있으며 가장 가까운 프런트 엔드에서 자동 리디렉션이 자동으로 수행됩니다.",
            "guid": "42e52f47-21d9-428c-8b1b-d521e44a29a9",
            "link": "https://azure.microsoft.com/global-infrastructure/services/?products=virtual-desktop",
            "severity": "높다",
            "subcategory": "일반",
            "text": "배포할 Azure 지역의 AVD 호스트 풀을 결정합니다."
        },
        {
            "category": "토대",
            "description": "온-프레미스 환경에 연결해야 하는 경우 현재 연결 옵션을 평가하거나 필요한 연결을 계획합니다. ",
            "guid": "dd399cfd-7b28-4dc8-9555-6202bfe4563b",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/",
            "severity": "보통",
            "subcategory": "일반",
            "text": "온-프레미스 환경에 연결하는 데 하이브리드 연결이 필요한지 확인"
        },
        {
            "category": "토대",
            "description": "'Windows 가상 데스크톱 환경 예측기' 도구를 실행하여 호스트 풀을 배포하는 데 가장 적합한 Azure 지역을 선택합니다. 대기 시간이 150ms를 초과하면 사용자 환경이 최적이 아닐 수 있습니다. ",
            "guid": "0d834a34-8b26-43e6-bc60-512a26498f6d",
            "link": "https://azure.microsoft.com/services/virtual-desktop/assessment/",
            "severity": "높다",
            "subcategory": "일반",
            "text": "사용자 위치와 Azure AVD 인프라 간의 대기 시간을 평가했습니까?"
        },
        {
            "category": "토대",
            "description": "AVD는 특정 지리적 위치에서만 서비스를 실행하기 위해 메타데이터를 저장하고, 현재 사용 가능한 항목을 결정하고, 고객 요구 사항에 따라 적합한 경우 결정합니다. ",
            "guid": "bad37ead-53cc-47ce-8d7a-aab3571449ab",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/data-locations",
            "severity": "보통",
            "subcategory": "일반",
            "text": "AVD 서비스의 메타데이터 위치 결정"
        },
        {
            "category": "토대",
            "description": "특히 GPU 또는 고사양 SKU가 필요한 경우 특정 VM SKU를 확인하고 결국 Azure NetApp 파일 가용성(사용되는 경우)을 확인합니다. ",
            "guid": "8053d89e-89dc-47b3-9be2-a1a27f7a9e91",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
            "severity": "낮다",
            "subcategory": "일반",
            "text": "선택한 지역의 특정 VM 크기에 대한 Azure 할당량 및 가용성 확인"
        },
        {
            "category": "토대",
            "description": "자세한 내용은 BCDR 섹션을 참조하세요.",
            "guid": "be1f38ce-f398-412b-b463-cbbac89c199d",
            "link": "https://learn.microsoft.com/azure/availability-zones/az-region",
            "severity": "보통",
            "subcategory": "일반",
            "text": "선택한 리전의 가용 영역(AZ) 가용성 확인"
        },
        {
            "category": "신원",
            "description": "Azure의 AD DC는 AVD 세션 호스트에 로그인하는 사용자와 결국 Azure NetApp 파일 및 AD 통합에 대한 대기 시간을 줄이는 데 권장됩니다. ADC는 모든 자식 도메인에 대해 DC와 통신할 수 있어야 합니다. 또는 온-프레미스 연결을 사용하여 AD DC에 연결해야 합니다. ",
            "guid": "c14aea7e-65e8-4d9a-9aec-218e6436b073",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
            "severity": "보통",
            "subcategory": "활성 디렉터리",
            "text": "AVD 호스트 풀에 가까운 Azure VNET 환경에서 두 개 이상의 활성 디렉터리 DC(도메인 컨트롤러)를 만듭니다."
        },
        {
            "category": "신원",
            "description": "별도의 OU 계층 구조 아래에 호스트 풀당 별도의 OU를 만드는 것이 좋습니다. 이러한 OU에는 AVD 세션 호스트의 컴퓨터 계정이 포함됩니다. ",
            "guid": "6db55f57-9603-4334-adf9-cc23418db612",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace",
            "severity": "낮다",
            "subcategory": "활성 디렉터리",
            "text": "각 호스트 풀에 대해 Active Directory에서 특정 OU를 만듭니다."
        },
        {
            "category": "신원",
            "description": "신중하게 검토하고 AVD 호스트 풀을 포함하는 OU에 대한 GPO 상속을 차단/필터링합니다. ",
            "guid": "7126504b-b47a-4393-a080-327294798b15",
            "link": "https://learn.microsoft.com/previous-versions/windows/desktop/Policy/group-policy-hierarchy",
            "severity": "보통",
            "subcategory": "활성 디렉터리",
            "text": "OU에 적용되고 호스트 풀 VM 기능에 영향을 주는 도메인 GPO를 검토합니다."
        },
        {
            "category": "신원",
            "description": "특정 권한이 있고 기본 10개의 조인 제한이 없는 특정 전용 계정을 사용하는 것이 좋습니다. ",
            "guid": "347dc560-28a7-41ff-b1cd-15dd2f0d5e77",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace",
            "severity": "보통",
            "subcategory": "활성 디렉터리",
            "text": "VM을 도메인에 가입시킬 수 있는 권한만 있는 전용 사용자 계정 만들기"
        },
        {
            "category": "신원",
            "description": "사용자당 액세스 권한을 부여하지 말고 대신 AD 그룹을 사용하고 Azure AD에서 ADC를 사용하여 복제합니다. ",
            "guid": "2d41e361-1cc5-47b4-a4b1-410d43958a8c",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/manage-app-groups",
            "severity": "보통",
            "subcategory": "활성 디렉터리",
            "text": "각 호스트 풀 응용 프로그램 그룹(DAG 또는 RAG)에 대한 액세스 권한이 부여될 각 사용자 집합에 대해 도메인 사용자 그룹 만들기"
        },
        {
            "category": "신원",
            "description": "Azure 파일 공유 및 Active Directory 인증을 통합하는 절차의 일부로 저장소 계정(파일 공유)을 나타내는 AD 계정이 만들어집니다. 컴퓨터 계정 또는 서비스 로그온 계정으로 등록하도록 선택할 수 있으며, 자세한 내용은 FAQ를 참조하세요. 컴퓨터 계정의 경우 AD에 설정된 기본 암호 만료 기간이 30일입니다. 마찬가지로 서비스 로그온 계정에는 AD 도메인 또는 OU(조직 구성 단위)에 설정된 기본 암호 만료 기간이 있을 수 있습니다. 두 계정 유형 모두 AD 환경에 구성된 암호 만료 기간을 확인하고 최대 암호 사용 기간 전에 AD 계정의 스토리지 계정 ID의 암호를 업데이트하도록 계획하는 것이 좋습니다. AD에서 새 AD OU(조직 구성 단위)를 만들고 그에 따라 컴퓨터 계정 또는 서비스 로그온 계정에서 암호 만료 정책을 사용하지 않도록 설정할 수 있습니다.",
            "guid": "2289b3d6-b57c-4fc6-9546-1e1a3e3453a3",
            "link": "https://learn.microsoft.com/azure/storage/files/storage-files-identity-ad-ds-enable",
            "severity": "낮다",
            "subcategory": "활성 디렉터리",
            "text": "Azure Files AD 통합에 사용되는 계정에 대한 조직 암호 만료 정책 검토"
        },
        {
            "category": "신원",
            "description": "Azure 구독은 Windows 서버 Active Directory 또는 Azure AD DS 인스턴스를 포함하거나 연결된 가상 네트워크를 포함하는 동일한 Azure AD 테넌트의 부모여야 합니다.",
            "guid": "6ceb5443-5125-4922-9442-93bb628537a5",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "높다",
            "subcategory": "요구 사항",
            "text": "Azure Active Directory 테넌트는 하나 이상의 구독이 연결된 상태에서 사용할 수 있어야 합니다."
        },
        {
            "category": "신원",
            "description": "Azure AD 커넥트(하이브리드 조직의 경우) 또는 Azure AD 도메인 서비스(하이브리드 또는 클라우드 조직의 경우)를 사용하여 이를 구성할 수 있습니다.",
            "guid": "5119bf8e-8f58-4542-a7d9-cec166cd072a",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "높다",
            "subcategory": "요구 사항",
            "text": "Windows Server Active Directory 포리스트/도메인이 Azure Active Directory와 동기화되어 있습니다."
        },
        {
            "category": "신원",
            "description": "(1) 사용자는 Azure AD에 연결된 동일한 Active Directory에서 제공되어야 합니다. Windows Virtual Desktop은 B2B 또는 MSA 계정을 지원하지 않습니다. (2) Windows 가상 데스크톱을 구독하는 데 사용하는 UPN은 VM이 가입된 Active Directory 도메인에 있어야 합니다.",
            "guid": "f9b141a8-98a5-435e-9378-97e71ca7da7b",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "보통",
            "subcategory": "요구 사항",
            "text": "Windows 가상 데스크톱에 연결하기 위한 사용자 계정 요구 사항 확인"
        },
        {
            "category": "신원",
            "description": "VM은 표준 도메인 가입 또는 하이브리드 AD 가입이어야 합니다. 가상 머신은 Azure AD에 조인할 수 없습니다.",
            "guid": "ea962a15-9394-46da-a7cc-3923266b2258",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "보통",
            "subcategory": "요구 사항",
            "text": "생성될 AVD 세션 호스트에 대한 VM 요구 사항 확인"
        },
        {
            "category": "신원",
            "description": "자체 관리형 Active Directory 도메인 서비스, Azure Active Directory 및 관리되는 Azure Active Directory 도메인 서비스 비교",
            "guid": "6f4a1651-bddd-4ea8-a487-cdeb4861bc3b",
            "link": "https://learn.microsoft.com/azure/active-directory-domain-services/compare-identity-solutions",
            "severity": "낮다",
            "subcategory": "요구 사항",
            "text": "AVD용 AAD-DS(Azure Active Directory 도메인 서비스)를 사용하기 전에 제한 사항을 검토해야 합니다. "
        },
        {
            "category": "모니터링 및 관리",
            "description": "크기 조정 도구는 세션 호스트 VM 비용을 최적화하려는 고객에게 저렴한 자동화 옵션을 제공합니다. 크기 조정 도구를 사용하여 사용량이 많은 업무 시간 및 사용량이 적은 업무 시간을 기준으로 VM을 시작 및 중지하도록 예약하고, CPU 코어당 세션 수에 따라 VM을 확장하고, 사용량이 적은 시간 동안 VM을 확장하고, 최소 세션 호스트 VM 수를 실행 상태로 둘 수 있습니다. 개인 호스트 풀 유형에는 아직 사용할 수 없으며 각 호스트 풀에 대해 별도의 설정을 사용하는 것이 좋습니다. ",
            "guid": "7138b820-102c-4e16-be30-1e6e872e52e3",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-scaling-script",
            "severity": "낮다",
            "subcategory": "경영",
            "text": "호스트 풀 자동 크기 조정 기능에 대한 요구 사항 평가"
        },
        {
            "category": "모니터링 및 관리",
            "description": "Azure Advisor는 구성 및 원격 분석을 분석하여 일반적인 문제를 해결하기 위한 개인 설정된 권장 사항을 제공합니다. 이러한 권장 사항을 통해 안정성, 보안, 운영 우수성, 성능 및 비용에 대해 Azure 리소스를 최적화할 수 있습니다.",
            "guid": "611dd68c-5a4b-4252-8e44-a59a9c2399c4",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/azure-advisor",
            "severity": "낮다",
            "subcategory": "경영",
            "text": "AVD에 대한 Azure 어드바이저 권장 사항을 주기적으로 확인"
        },
        {
            "category": "모니터링 및 관리",
            "description": "골든 이미지에 대한 업데이트를 관리하는 전략(예: 보안 핫픽스 적용 및/또는 이미지 내에 설치된 애플리케이션 업데이트)을 준비합니다. Azure 이미지 작성기 서비스는 VM의 빌드 및 사용자 지정을 자동화하기 위한 제1자 솔루션입니다. ARM 템플릿을 사용하여 새 호스트를 만든 다음 이전 호스트를 서비스 해제할 수 있습니다. https://github.com/Azure/RDS-Templates/tree/master/ARM-AVD-templates/AddVirtualMachinesToHostPool 권장되는 방법은 새 풀을 나란히 만들고, 롤백하기 쉽고, 전용 풀에 사용할 수 없으며, ARM 템플릿을 사용하여 VM 수를 다시 배포하고 늘리는 것도 실행 가능한 옵션입니다. 고객은 기존 소프트웨어 배포 방법을 사용하여 다시 배포하지 않고 이미지를 업데이트할 수도 있습니다(예: SCCM 또는 이와 유사한 사용).",
            "guid": "d7b68d0c-7555-462f-8b3e-4563b4d874a7",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/image-builder-virtual-desktop",
            "severity": "보통",
            "subcategory": "경영",
            "text": "골든 이미지 업데이트 관리 전략 계획"
        },
        {
            "category": "모니터링 및 관리",
            "description": "고객은 몇 가지 옵션을 가질 수 있습니다 : - 마이크로 소프트 엔드 포인트 구성 관리자,이 문서에서는 자동으로 Windows 10 엔터프라이즈 멀티 세션을 실행하는 Windows 가상 데스크톱 호스트에 업데이트를 적용 하도록 마이크로 소프트 엔드 포인트 구성 관리자를 구성 하는 방법을 설명 합니다 : https://learn.microsoft.com/azure/virtual-desktop/configure-automatic-updates - 마이크로 소프트 Intune : https://learn.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop-multi-session- 윈도우 서버 업데이트 서비스 ( WSUS)- OS를 지원하는 제3자.- Azure 업데이트 관리(Azure 자동화), 현재 클라이언트 OS에서 지원되지 않음: https://learn.microsoft.com/azure/automation/update-management/overview#unsupported-operating-systemsIt 패치 전략에서 벗어나 가능한 경우 이미지로 다시 설치하는 전략으로 이동하는 것이 좋습니다. ",
            "guid": "04722da2-9c2b-41cd-922f-54b29bade3aa",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/image-builder-virtual-desktop",
            "severity": "보통",
            "subcategory": "경영",
            "text": "세션 호스트 패치 및 업데이트 전략 계획"
        },
        {
            "category": "모니터링 및 관리",
            "description": "호스트 풀은 Windows 가상 데스크톱 환경 내에서 하나 이상의 동일한 가상 컴퓨터의 모음입니다. 서비스 업데이트가 먼저 적용되는 유효성 검사 호스트 풀을 만드는 것이 좋습니다. 이렇게 하면 서비스가 표준 또는 비유효성 검사 환경에 적용하기 전에 서비스 업데이트를 모니터링할 수 있습니다.",
            "guid": "d1e8c38e-c936-4667-913c-005674b1e944",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-validation-host-pool",
            "severity": "낮다",
            "subcategory": "경영",
            "text": "AVD 테스트 카나리아 환경에 대한 요구 사항 평가"
        },
        {
            "category": "모니터링 및 관리",
            "description": "AVD 호스트 풀은 Azure 포털, ARM 템플릿, Azure CLI 도구, Powershell, 등록 토큰을 사용한 수동 VM 만들기, Terraform 등 여러 가지 방법으로 배포할 수 있습니다. 자동화 및 CI/CD 도구를 통해 자동 배포를 지원하는 적절한 방법을 채택하는 것이 중요합니다.",
            "guid": "a459c373-e7ed-4616-83b3-65a917ecbe48",
            "link": "https://github.com/Azure/RDS-Templates/tree/master/AVD-templates",
            "severity": "보통",
            "subcategory": "경영",
            "text": "호스트 풀 배포 전략 결정"
        },
        {
            "category": "모니터링 및 관리",
            "description": "Windows 가상 데스크톱 서비스 내의 호스트 풀에 VM을 등록한 후 에이전트는 VM이 활성 상태일 때마다 VM의 토큰을 정기적으로 새로 고칩니다. 등록 토큰에 대한 인증서는 90일 동안 유효합니다. 이 90일 제한으로 인해 머신이 토큰을 새로 고치고 에이전트 및 병렬 스택 구성 요소를 업데이트할 수 있도록 VM을 90일마다 20분 동안 온라인 상태로 유지하는 것이 좋습니다.",
            "guid": "ebe54cd7-df2e-48bb-ac35-81559bb9153e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/faq",
            "severity": "보통",
            "subcategory": "경영",
            "text": "토큰 새로 고침을 위해 90일마다 정기적으로 VM 켜기"
        },
        {
            "category": "모니터링 및 관리",
            "description": "Windows 가상 데스크톱용 Azure 모니터는 IT 전문가가 Windows 가상 데스크톱 환경을 이해하는 데 도움이 되는 Azure 모니터 통합 문서를 기반으로 하는 대시보드입니다. Windows 가상 데스크톱 환경을 모니터링하도록 Windows 가상 데스크톱용 Azure 모니터를 설정하는 방법을 알아보려면 참조된 문서를 참조하세요.",
            "guid": "63cfff1c-ac59-49ef-8d5a-83dd4de36c1c",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/azure-monitor",
            "severity": "높다",
            "subcategory": "모니터링",
            "text": "AVD에 대한 Azure 모니터링 사용"
        },
        {
            "category": "모니터링 및 관리",
            "description": "Windows Virtual Desktop은 다른 많은 Azure 서비스와 마찬가지로 모니터링 및 경고에 Azure Monitor 및 Log Analytics를 사용합니다. 이를 통해 관리자는 단일 인터페이스를 통해 문제를 식별할 수 있습니다. 이 서비스는 사용자 및 관리 작업 모두에 대한 활동 로그를 만듭니다.  각 활동 로그는 관리, 피드, 연결, 호스트 등록, 오류, 검사점 범주에 속합니다. ",
            "guid": "81770afb-c4c0-4e43-a186-58d2857ed671",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/diagnostics-log-analytics",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "작업 영역, 호스트 풀, 애플리케이션 그룹 및 호스트 VM에 대한 진단 설정을 사용하도록 설정하고 Log Analytics 작업 영역으로 리디렉션합니다."
        },
        {
            "category": "모니터링 및 관리",
            "description": "참조 된 문서와이 추가 문서를 참조하여 스토리지에 대한 적절한 모니터링 및 경고를 설정하십시오 : https://learn.microsoft.com/azure/storage/files/storage-troubleshooting-files-performance. ",
            "guid": "2463cffe-179c-4599-be0d-5973dd4ce32c",
            "link": "https://learn.microsoft.com/azure/storage/files/storage-files-monitoring?tabs=azure-portal",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "사용량이 많고 제한이 많은 경우 경고할 프로필 저장소에 대한 경고 만들기"
        },
        {
            "category": "모니터링 및 관리",
            "description": "Azure 서비스 상태를 사용하여 Windows 가상 데스크톱에 대한 서비스 문제 및 상태 권고를 모니터링할 수 있습니다. Azure 서비스 상태는 다양한 유형의 경고(예: 이메일 또는 SMS)로 사용자에게 알리고, 문제의 영향을 이해하는 데 도움을 주고, 문제가 해결되면 계속 업데이트할 수 있습니다.",
            "guid": "18813706-f7c4-4c0d-9e51-4548d2457ed6",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-service-alerts",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "AVD 경고에 대한 Azure 서비스 상태 구성 "
        },
        {
            "category": "네트워킹",
            "description": "어떤 유형의 하이브리드 연결? 익스프레스 노선, VPN, NVA?",
            "guid": "c8639648-a652-4d6c-85e5-02965388e5de",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/",
            "severity": "보통",
            "subcategory": "네트워킹",
            "text": "온-프레미스 환경에 대한 하이브리드 연결 아키텍처 검토"
        },
        {
            "category": "네트워킹",
            "description": "대역폭 요구 사항을 평가하고 VPN/ER 대역폭이 충분하고 대기 시간이 허용되는지 확인합니다. ",
            "guid": "d227dd14-2b06-4c21-a799-9a646f4389a7",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/",
            "severity": "보통",
            "subcategory": "네트워킹",
            "text": "사용자가 AVD 호스트 풀에서 온-프레미스로 액세스해야 하는 리소스 평가"
        },
        {
            "category": "네트워킹",
            "description": "CAF (vWAN 대 Hub & Spoke)를 기반으로 AVD 호스트 풀을 배치 할 새로운 것을 검토하거나 권장합니다.",
            "guid": "f42c78e7-8c06-4a63-a21a-4956e6a8dc4a",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/networking-options",
            "severity": "높다",
            "subcategory": "네트워킹",
            "text": "AVD 서비스에 대한 랜딩 존 네트워킹 토폴로지 검토"
        },
        {
            "category": "네트워킹",
            "description": "각 서브넷에 AVD 호스트 풀의 크기를 조정하기에 충분한 공간이 있는지 확인합니다. 다른 호스트 풀의 경우 가능하면 별도의 서브넷을 사용하는 것이 좋습니다. ",
            "guid": "20e27b3e-2971-41b1-952b-eee079b588de",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "보통",
            "subcategory": "네트워킹",
            "text": "여러 호스트 풀에 대한 VNET 및 서브넷 배치 평가"
        },
        {
            "category": "네트워킹",
            "description": "몇 가지 옵션을 사용할 수 있습니다. Azure 방화벽 또는 NVA 방화벽, NSG 및/또는 프록시를 사용할 수 있습니다. NSG는 URL로 사용하거나 사용하지 않도록 설정할 수 없으며 포트 및 프로토콜만 사용할 수 있습니다. 프록시는 사용자 브라우저에서 명시적 설정으로만 사용해야 합니다. AVD와 함께 Azure 방화벽 프리미엄을 사용하는 방법에 대한 자세한 내용은 https://aka.ms/AVDfirewall 및 여기 https://learn.microsoft.com/azure/firewall/protect-windows-virtual-desktop 참조하세요. AVD URL 액세스에 대한 전체 요구사항 목록을 검토하세요.",
            "guid": "fc4972cd-3cd2-41bf-9703-6e5e6b4bed3d",
            "link": "https://aka.ms/AVDfirewall",
            "severity": "보통",
            "subcategory": "네트워킹",
            "text": "AVD 호스트의 인터넷 아웃바운드 트래픽을 제어/제한해야 하나요? "
        },
        {
            "category": "네트워킹",
            "description": "Azure Defender 엔드포인트를 사용하여 사용자 웹 탐색을 제어하는 방법을 고려하고, 자세한 내용은 보안 섹션을 참조하세요. ",
            "guid": "73676ae4-6691-4e88-95ad-a42223e13810",
            "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/windows-virtual-desktop-support-is-now-generally-available/ba-p/2103712",
            "severity": "보통",
            "subcategory": "네트워킹",
            "text": "AVD 호스트의 사용자에 대해서만 인터넷 아웃바운드 트래픽을 제어/제한해야 합니까? "
        },
        {
            "category": "네트워킹",
            "description": "사용자 지정 UDR은 AVD 호스트 풀 서브넷에 적용할 수 있습니다(예: Azure 방화벽 또는 NVA로 리디렉션). 이 경우 AVD 컨트롤 플레인으로의 아웃바운드 트래픽에 대한 최적의 경로가 사용되는지 신중하게 검토하는 것이 좋습니다. 이제 서비스 태그를 UDR과 함께 사용할 수 있으므로 AVD 관리부 트래픽을 쉽게 화이트리스트에 추가할 수 있습니다. https://learn.microsoft.com/azure/firewall/protect-windows-virtual-desktop#host-pool-outbound-access-to-windows-virtual-desktop ",
            "guid": "523181a9-4174-4158-93ff-7ae7c6d37431",
            "link": "https://learn.microsoft.com/azure/firewall/protect-windows-virtual-desktop",
            "severity": "낮다",
            "subcategory": "네트워킹",
            "text": "AVD 호스트 풀 서브넷에 대한 UDR 검토"
        },
        {
            "category": "네트워킹",
            "description": "세션 호스트의 AVD 컨트롤 플레인 액세스에 필요한 URL은 https://learn.microsoft.com/azure/virtual-desktop/safe-url-list 에 설명되어 있습니다. 확인 도구를 사용하여 세션 호스트의 연결을 확인할 수 있습니다: https://learn.microsoft.com/azure/virtual-desktop/safe-url-list#required-url-check-tool.",
            "guid": "65c7acbe-45bb-4e60-ad89-f2e87778424d",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/safe-url-list",
            "severity": "높다",
            "subcategory": "네트워킹",
            "text": "AVD 컨트롤 플레인 엔드포인트에 액세스할 수 있는지 확인"
        },
        {
            "category": "네트워킹",
            "description": "특정 워크로드 유형에 따라 사용자에 대한 네트워킹 대역폭 요구 사항을 평가하고 검토하는 것이 좋습니다. 참조된 문서는 일반적인 추정 및 권장 사항을 제공하지만 적절한 크기 조정을 위해서는 특정 조치가 필요합니다. ",
            "guid": "516785c6-fa96-4c96-ad88-408f372734c8",
            "link": "https://learn.microsoft.com/windows-server/remote/remote-desktop-services/network-guidance",
            "severity": "낮다",
            "subcategory": "네트워킹",
            "text": "각 사용자에 대해 필요한 네트워크 대역폭 및 VM SKU에 대한 총 네트워크 대역폭 확인"
        },
        {
            "category": "안전",
            "description": "사용자에게 가상 데스크톱에 대한 관리자 액세스 권한을 부여하지 않는 것이 좋습니다. 소프트웨어 패키지가 필요한 경우 Microsoft 엔드포인트 관리자와 같은 구성 관리 유틸리티를 통해 사용할 수 있도록 하는 것이 좋습니다. 다중 세션 환경에서는 사용자가 소프트웨어를 직접 설치하도록 허용하지 않는 것이 좋습니다.",
            "guid": "a0cdb3b5-4eb2-4eb0-9dda-a3592718e2ed",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "보통",
            "subcategory": "호스트 구성",
            "text": "AVD 사용자에게 AVD 호스트에 대한 로컬 관리자 권한이 없는지 확인합니다. "
        },
        {
            "category": "안전",
            "description": "Microsoft Defender for Endpoint는 이제 Windows 10 Enterprise 다중 세션용 Windows Virtual Desktop을 지원합니다. 비영구 VDI(가상 데스크톱 인프라) 장치 온보딩에 대한 문서 확인: https://learn.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi",
            "guid": "b1172576-9ef6-4691-a483-5ac932223ece",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "높다",
            "subcategory": "호스트 구성",
            "text": "바이러스 백신 및 맬웨어 방지 솔루션이 사용되는지 확인"
        },
        {
            "category": "안전",
            "description": "다음 제외 사항이 있는지 확인하십시오. https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix#antivirus-exclusions .",
            "guid": "80b12308-1a54-4174-8583-3ea3ad2c2de7",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "높다",
            "subcategory": "호스트 구성",
            "text": "적절한 AV 제외가 있는지 확인"
        },
        {
            "category": "안전",
            "description": "Azure의 디스크는 기본적으로 Microsoft 관리형 키를 사용하여 미사용 시 이미 암호화되어 있습니다. 호스트 VM OS 디스크 암호화는 ADE 및 DES를 사용하여 가능하고 지원되며, 적절하고 영구적인 사용자 데이터는 세션 호스트 디스크에 저장해서는 안 되며, 규정 준수를 위해 엄격하게 필요한 경우에만 사용해야 합니다. Azure Files를 사용한 FSLogix 저장소의 암호화는 Azure 저장소에서 SSE를 사용하여 수행할 수 있습니다.OneDrive 암호화에 대해서는 다음 문서를 참조하세요: https://learn.microsoft.com/compliance/assurance/assurance-encryption-for-microsoft-365-services.",
            "guid": "0fd32907-98bc-4178-adc5-a06ca7144351",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "낮다",
            "subcategory": "호스트 구성",
            "text": "AVD 호스트의 디스크 암호화 요구 사항 평가"
        },
        {
            "category": "안전",
            "description": "Azure Defender 엔드포인트를 사용하여 사용자 웹 탐색을 제어하는 것이 좋습니다. ",
            "guid": "e19dd344-29eb-4722-a237-a151c5bb4e4f",
            "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/windows-virtual-desktop-support-is-now-generally-available/ba-p/2103712",
            "severity": "보통",
            "subcategory": "호스트 구성",
            "text": "AVD 세션 호스트에서 사용자 인터넷 탐색을 제어/제한해야 합니까?"
        },
        {
            "category": "안전",
            "description": "구독, 가상 머신, 키 자격 증명 모음 및 저장소 계정에 대해 Azure 보안 센터 표준을 사용하도록 설정하는 것이 좋습니다. Azure 보안 센터 표준을 사용하면 취약성을 평가 및 관리하고, PCI와 같은 일반적인 프레임워크의 준수를 평가하고, AVD 환경의 전반적인 보안을 강화할 수 있습니다.",
            "guid": "1814387e-5ca9-4c26-a9b3-2ab5bdfc6998",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "보통",
            "subcategory": "안전",
            "text": "AVD 세션 호스트에 대한 ASC(Azure 보안 센터) 사용 평가"
        },
        {
            "category": "안전",
            "description": "예를 들어 데스크톱 잠금 및 유휴 세션 종료를 적용하는 데 사용해야 합니다. 온-프레미스 환경에 적용된 기존 GPO를 검토하고 최종적으로 AVD 호스트도 보호하기 위해 적용해야 합니다. ",
            "guid": "a135e337-897e-431c-97d6-8cb6a22ac19f",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "보통",
            "subcategory": "안전",
            "text": "활성 디렉터리 GPO를 검토하여 RDP 세션 보호"
        },
        {
            "category": "안전",
            "description": "자세한 내용과 인사이트는 다음 문서를 참조하세요. https://christiaanbrinkhoff.com/2020/03/23/learn-how-to-increase-the-security-level-of-your-windows-virtual-desktop-environment-e-g-windows-client-with-azure-mfa-and-conditional-access",
            "guid": "916d697d-8ead-4ed2-9bdd-186f1ac252b9",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-mfa",
            "severity": "낮다",
            "subcategory": "안전",
            "text": "AVD 사용자의 MFA 사용량 평가"
        },
        {
            "category": "안전",
            "description": "조건부 액세스를 사용하도록 설정하면 사용자에게 Windows 가상 데스크톱 환경에 대한 액세스 권한을 부여하기 전에 위험을 관리할 수 있습니다. 액세스 권한을 부여할 사용자를 결정할 때는 사용자가 누구인지, 로그인하는 방법, 사용 중인 장치도 고려하는 것이 좋습니다.",
            "guid": "556246b4-3856-44b4-bc74-a748b6633ad2",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "낮다",
            "subcategory": "안전",
            "text": "사용자에 대한 조건부 액세스 사용 평가"
        },
        {
            "category": "안전",
            "description": "감사 로그 수집을 사용하도록 설정하면 Windows 가상 데스크톱과 관련된 사용자 및 관리자 활동을 볼 수 있습니다. 이것은 또한 AVD 모니터링 도구를 활성화하고 사용하기 위한 요구 사항입니다. 활성화하는 것이 좋습니다. ",
            "guid": "a0916a76-4980-4ad0-b278-ee293c1bc352",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "보통",
            "subcategory": "안전",
            "text": "중앙 Log Analytics 작업 영역에 대한 진단 및 감사 로깅 사용"
        },
        {
            "category": "안전",
            "description": "AVD는 Azure RBAC(역할 기반 액세스 제어)를 사용하여 사용자 및 관리자에게 역할을 할당합니다. 이러한 역할은 관리자에게 특정 작업을 수행할 수 있는 권한을 부여합니다. 업무 분리가 필요한 경우 Windows Virtual Desktop에는 호스트 풀, 앱 그룹 및 작업 영역에 대한 관리 역할을 분리할 수 있는 추가 역할이 있습니다. 이러한 분리를 통해 관리 작업을 보다 세부적으로 제어할 수 있습니다. 이러한 역할은 Azure의 표준 역할 및 최소 권한 방법론에 따라 이름이 지정됩니다.",
            "guid": "baaab757-1849-4ab8-893d-c9fc9d1bb73b",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/rbac",
            "severity": "낮다",
            "subcategory": "안전",
            "text": "AVD 관리에 사용자 지정 RBAC 역할을 사용하기 위한 요구 사항 평가 "
        },
        {
            "category": "안전",
            "description": "포괄적인 보안 모범 사례 및 권장 사항 집합이 참조된 문서에 포함되어 있으므로 검토하는 것이 좋습니다. ",
            "guid": "36a5a67f-bb9e-4d5b-9547-8c4479816b28",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "보통",
            "subcategory": "안전",
            "text": "AVD 환경에 대한 모든 보안 권장사항 검토"
        },
        {
            "category": "보관",
            "description": "Azure NetApp Files, Azure Files, VM 기반 File Server. 파일 서버는 권장되지 않습니다. Azure 파일 프리미엄은 일반적으로 좋은 시작점입니다. NetApp은 일반적으로 대규모/고성능 환경에만 필요합니다. ",
            "guid": "ed6b17db-8255-4462-b2ae-e4553afc8339",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/store-fslogix-profile",
            "severity": "높다",
            "subcategory": "에프에스로직스",
            "text": "FSLogix 프로필 및 Office 컨테이너에 사용할 스토리지 백 엔드 솔루션 결정"
        },
        {
            "category": "보관",
            "description": "Windows 가상 데스크톱에서는 아래의 재해 복구 섹션에 설명된 대로 특정 BCDR(비즈니스 연속성 및 재해 복구) 시나리오를 계획하지 않는 한 Office 컨테이너 없이 프로필 컨테이너를 사용하는 것이 좋습니다. https://learn.microsoft.com/fslogix/profile-container-office-container-cncpt ",
            "guid": "df47d2d9-2881-4b1c-b5d1-e54a29759e39",
            "link": "https://learn.microsoft.com/fslogix/profile-container-office-container-cncpt",
            "severity": "낮다",
            "subcategory": "에프에스로직스",
            "text": "프로필 컨테이너를 Office 컨테이너에서 분리할 수 있는 가능성 평가"
        },
        {
            "category": "보관",
            "description": "프로필 컨테이너 스토리지 성능 요구 사항을 예측하기 위한 시작점으로 안정적인 상태에서는 사용자당 10 IOPS, 로그인/로그아웃 중에는 사용자당 50 IOPS를 가정하는 것이 좋습니다.",
            "guid": "680e7828-9c93-4665-9d02-bff4564b0d93",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "높다",
            "subcategory": "에프에스로직스",
            "text": "호스트 풀 요구 사항을 지원하기 위한 스토리지 확장성 제한 확인"
        },
        {
            "category": "보관",
            "description": "DR 목적으로 두 번째 지역이 필요한 경우 해당 지역에서도 NetApp 가용성을 확인합니다.",
            "guid": "4a359836-ee79-4d6c-9d3a-364a5b7abae3",
            "link": "https://azure.microsoft.com/global-infrastructure/services/",
            "severity": "보통",
            "subcategory": "에프에스로직스",
            "text": "NetApp Files 스토리지를 사용하는 경우 특정 지역의 스토리지 서비스 가용성을 확인합니다."
        },
        {
            "category": "보관",
            "description": "가능한 경우 지역 간 네트워크 트래픽과 관련된 추가 대기 시간 및 비용을 도입하지 마십시오.",
            "guid": "8aad53cc-79e2-4e86-9673-57c549675c5e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/fslogix-containers-azure-files",
            "severity": "높다",
            "subcategory": "에프에스로직스",
            "text": "최적의 성능을 위해 저장소 솔루션과 FSLogix 프로필 컨테이너는 동일한 데이터 센터 위치에 있어야 합니다."
        },
        {
            "category": "보관",
            "description": "참조된 문서에 설명된 대로 FSLogix 프로필 컨테이너 가상 하드 드라이브에 대해 다음 바이러스 백신 제외를 구성해야 합니다.",
            "guid": "83f63047-22ee-479d-9b5c-3632054b69ba",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "보통",
            "subcategory": "에프에스로직스",
            "text": "FSLogix에 대해 권장되는 바이러스 백신 제외를 구성합니다(연결 시 VHD(x) 파일을 검색하지 않는 것 포함)."
        },
        {
            "category": "보관",
            "description": "기본 기본 및 권장 설정은 다음과 같습니다. https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix#best-practice-settings-for-enterprises 코어 세트는 여기를 참조하십시오. https://learn.microsoft.com/fslogix/configure-profile-container-tutorialSee 전체 참조를 위해 여기를 참조하십시오 : https://learn.microsoft.com/fslogix/profile-container-configuration-reference ",
            "guid": "d34aad5e-8c78-4e1d-9666-7313c405674c",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "높다",
            "subcategory": "에프에스로직스",
            "text": "FSLogix 레지스트리 키를 검토하고 적용할 레지스트리 키 결정"
        },
        {
            "category": "보관",
            "description": "동시 또는 다중 연결은 Windows 가상 데스크톱에서 권장되지 않습니다. 가장 좋은 방법은 각 세션에 대해 다른 프로필 위치를 호스트 풀로 만드는 것입니다.",
            "guid": "5e985b85-9c77-43e7-b261-623b775a917e",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "높다",
            "subcategory": "에프에스로직스",
            "text": "동일한 프로필에 대한 동시 또는 다중 연결 사용 확인"
        },
        {
            "category": "보관",
            "description": "일반적으로 테스트 환경에서 유효성을 검사하려면 워크로드에 따라 각 사용자에 대해 5 - 15 IOPS를 먼저 고려해야 합니다. Azure 파일: 프리미엄 최대 100k IOPS 공유당 (최대 100TB) 및 최대 5Gbps (3ms 대기 시간). Azure 파일이 프로비전되는 방법, 즉 프로비전된 크기에 엄격하게 연결된 IOPS를 알고 있어야 합니다. 경우에 따라 버스트 크기 조정 기능. 충분한 IOPS를 확보하기 위해 필요한 것보다 더 많은 공간을 UPFRONT로 프로비저닝해야 합니다. 참고: Azure Premium은 트랜잭션을 지불하지 않기 때문에 표준보다 저렴할 수 있으며 중요한 세부 정보를 염두에 두어야 합니다. Azure NetApp 파일: 연결된 최대 1000개의 IP를 기억하고, IOPS를 즉시 조정할 수 있으며, 최소 4TB의 프로비저닝된 용량을 기억합니다. ",
            "guid": "1f348ff3-64d2-47d4-8e8b-bbc868155abb",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/store-fslogix-profile",
            "severity": "높다",
            "subcategory": "에프에스로직스",
            "text": "스토리지 크기 조정에 대한 모범 사례 및 주요 고려 사항 검토"
        },
        {
            "category": "보관",
            "description": "참조된 문서에 설명된 모범 사례 및 권장 사항 목록을 확인하십시오.",
            "guid": "9164e990-9ae2-48c8-9c33-b6b7808bafe6",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "보통",
            "subcategory": "에프에스로직스",
            "text": "Azure 파일에 대한 모범 사례 확인(사용되는 경우)"
        },
        {
            "category": "보관",
            "description": "참조된 문서에 설명된 모범 사례 및 권장 사항 목록을 확인하십시오.",
            "guid": "c42149d4-13a9-423c-9574-d11028ac6aae",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "보통",
            "subcategory": "에프에스로직스",
            "text": "NetApp 파일에 대한 모범 사례 확인(사용되는 경우)"
        },
        {
            "category": "보관",
            "description": "프로필 컨테이너의 기본 최대 크기는 30GB입니다. 큰 프로필 컨테이너가 예상되고 고객이 작게 유지하려는 경우 OneDrive를 사용하여 FSLogix 프로필 외부에서 Office 365 파일을 호스트하는 것이 좋습니다.",
            "guid": "01e6a84d-e5df-443d-8992-481718d5d1e5",
            "link": "https://learn.microsoft.com/fslogix/profile-container-configuration-reference",
            "severity": "높다",
            "subcategory": "에프에스로직스",
            "text": "FSLogix에서 구성된 최대 프로필 크기를 검토하고 확인합니다."
        },
        {
            "category": "보관",
            "description": "클라우드 캐시는 로컬 디스크를 캐시로 사용하며 VM 디스크에 많은 압력을 가할 수 있습니다. 가능한 경우 VM SKU를 기반으로 임시(및 로컬로 연결된) VM 디스크의 기능을 활용하는 것이 좋습니다. ",
            "guid": "b2d1215a-e114-4ba3-9df5-85ecdcd9bd3b",
            "link": "https://learn.microsoft.com/fslogix/cloud-cache-configuration-reference",
            "severity": "보통",
            "subcategory": "에프에스로직스",
            "text": "FSLogix 클라우드 캐시를 사용하는 경우 캐시 디렉터리를 임시 드라이브로 이동합니다."
        },
        {
            "category": "보관",
            "description": "REDIRECTION.XML 파일은 프로필 컨테이너에서 C: 드라이브로 리디렉션되는 폴더를 제어하는 데 사용됩니다. 제외는 예외여야 하며 제외를 구성하는 사람이 특정 제외를 완전히 이해하지 않는 한 사용해서는 안 됩니다. 제외는 항상 구현하려는 환경에서 완전히 테스트해야 합니다. 제외를 구성하면 기능, 안정성 및 성능에 영향을 줄 수 있습니다.",
            "guid": "0b50ca97-b1d2-473c-b4d9-6e98b0f912de",
            "link": "https://learn.microsoft.com/fslogix/manage-profile-content-cncpt#redirectionsxml",
            "severity": "보통",
            "subcategory": "에프에스로직스",
            "text": "FSLogix 리디렉션의 사용법을 검토합니다."
        },
        {
            "category": "보관",
            "description": "ANF 서브넷을 만들 Azure 가상 네트워크 환경에 대해 Active Directory 사이트를 만들어야 하며, 참조 문서에 설명된 대로 조인 절차를 실행할 때 ANF 연결 속성에 해당 사이트 이름을 지정해야 합니다.",
            "guid": "6647e977-db49-48a8-bc35-743f17499d42",
            "link": "https://learn.microsoft.com/azure/azure-netapp-files/create-active-directory-connections",
            "severity": "높다",
            "subcategory": "에프에스로직스",
            "text": "Azure NetApp 파일 스토리지를 사용하는 경우 AD 연결에서 AD 사이트 이름 설정을 확인합니다."
        },
        {
            "category": "보관",
            "description": "SMB 다중 채널을 사용하면 클라이언트가 소유 비용을 낮추면서 향상된 성능을 제공하는 여러 네트워크 연결을 사용할 수 있습니다. 여러 NIC에 대한 대역폭 집계와 NIC에 대한 RSS(수신측 배율) 지원을 활용하여 여러 CPU에 IO 부하를 분산함으로써 성능이 향상됩니다.",
            "guid": "5784b6ca-5e9e-4bcf-8b54-c95459ea7369",
            "link": "https://learn.microsoft.com/azure/storage/files/storage-files-smb-multichannel-performance",
            "severity": "보통",
            "subcategory": "에프에스로직스",
            "text": "프리미엄 파일 공유를 사용하여 FSLogix 프로필 컨테이너를 호스트할 때 SMB 다중 채널을 사용하도록 설정합니다."
        },
        {
            "category": "보관",
            "description": "표준 HDD, 표준 SSD 또는 프리미엄 SSD, 임시 디스크는 지원되지 않으며 울트라 디스크는 권장되지 않습니다. 사용자 밀도가 낮지 않고 클라우드 캐시를 사용하려는 경우 OS 디스크에 대한 Premium을 평가하는 것이 좋습니다. ",
            "guid": "3611c818-b0a0-4bc5-80e4-3a18a9cd289c",
            "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
            "severity": "보통",
            "subcategory": "세션 호스트 ",
            "text": "세션 호스트에 사용할 관리 디스크 유형 결정  "
        }
    ],
    "metadata": {
        "name": "Azure Virtual Desktop Review",
        "state": "GA"
    },
    "severities": [
        {
            "name": "높다"
        },
        {
            "name": "보통"
        },
        {
            "name": "낮다"
        }
    ],
    "status": [
        {
            "description": "이 검사는 아직 검토되지 않았습니다.",
            "name": "확인되지 않음"
        },
        {
            "description": "이 검사와 연결된 작업 항목이 있습니다.",
            "name": "열다"
        },
        {
            "description": "이 검사가 확인되었으며 연결된 추가 작업 항목이 없습니다.",
            "name": "성취"
        },
        {
            "description": "권장 사항을 이해했지만 현재 요구 사항에서 필요하지 않음",
            "name": "필요하지 않음"
        },
        {
            "description": "현재 디자인에는 적용되지 않음",
            "name": "해당 없음"
        }
    ]
}
checklists/avd_checklist.ja.json METASEP
{
    "$schema": "checklist.schema.json",
    "categories": [
        {
            "name": "財団"
        },
        {
            "name": "同一性"
        },
        {
            "name": "ネットワーキング"
        },
        {
            "name": "計算する"
        },
        {
            "name": "貯蔵"
        },
        {
            "name": "安全"
        },
        {
            "name": "監視と管理"
        },
        {
            "name": "BC/DR"
        }
    ],
    "items": [
        {
            "category": "BC/DR",
            "description": "AVD 制御プランでは、返金制度のあるサービス レベル アグリーメントは提供されません。Windows 仮想デスクトップ サービス URL の可用性を 99.9% 以上確保するよう努めています。サブスクリプション内のセッション ホスト仮想マシンの可用性は、仮想マシン SLA の対象となります。グローバルな高可用性要件を適切に満たすには、依存するリソース/サービスとインフラストラクチャの可用性も考慮する必要があります。",
            "guid": "56c57ba5-9119-4bf8-b8f5-c586c7d9cdc1",
            "link": "https://azure.microsoft.com/support/legal/sla/virtual-desktop/v1_0/",
            "severity": "高い",
            "subcategory": "計算する",
            "text": "AVD を通じて公開されたアプリケーション/デスクトップの予想される高可用性 SLA を決定する"
        },
        {
            "category": "BC/DR",
            "description": "アクティブ-アクティブ」モデルは、異なるリージョンにある複数のホスト プールで実現できます。異なるリージョンの VM を含む単一のホスト プールは推奨されません。同じユーザーに対して複数のプールを使用する場合は、ユーザー プロファイルを同期/レプリケートする方法の問題を解決する必要があります。FSLogix Cloud Cache を使用することもできますが、慎重に確認して計画する必要があります。または、同期/レプリケートをまったく行わないことをお客様が決定できます。\"アクティブ/パッシブ\" は、Azure Site Recovery (ASR) または自動化されたメカニズムを使用したオンデマンド プール デプロイを使用して実現できます。",
            "guid": "6acc076e-f9b1-441a-a989-579e76b897e7",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "中程度",
            "subcategory": "計算する",
            "text": "AVD ホストプールの geo ディザスタリカバリリージョンの評価"
        },
        {
            "category": "BC/DR",
            "description": "Windows 仮想デスクトップ BCDR の計画と設計に取り組む前に、AVD を介して使用されるアプリケーションを最初に検討することが重要です。重要でないアプリから分離し、異なるディザスター リカバリーのアプローチと機能を備えた別のホスト プールを使用することをお勧めします。",
            "guid": "10a7da7b-e996-46e1-9d3c-4ada97cc3d13",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "中程度",
            "subcategory": "計算する",
            "text": "重要なアプリケーションを異なる AVD ホストプールに分離"
        },
        {
            "category": "BC/DR",
            "description": "?ホスト プール VM に適切な回復性レベルを選択しましたか (可用性セットと可用性ゾーン)??AS または AZ に伴う HA SLA とスケーラビリティの制限への影響を認識していますか? ?現在、可用性セットなしで Windows 仮想デスクトップ ARM テンプレートのデプロイごとに 399 台の VM をデプロイすることも、可用性セットごとに 200 台の VM をデプロイすることもできます。デプロイあたりの VM の数を増やすには、ARM テンプレートまたは Azure portal ホスト プールの登録で可用性セットをオフにします。AZのデプロイが可能になり、現時点では一度に1つのAZで、目的のAZごとにVMの一部を手動で作成する必要があります。",
            "guid": "25ab225c-6f4e-4168-9fdd-dea8a4b7cdeb",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/faq",
            "severity": "高い",
            "subcategory": "計算する",
            "text": "AVD ホストプール展開に最適な復元力オプションを計画する"
        },
        {
            "category": "BC/DR",
            "description": "Azure Backup はホスト プール VM を保護するためにも使用できますが、ホスト プール VM をステートレスにする必要がある場合でも、この方法はサポートされます。このオプションは、個人用ホスト プールで検討できます。",
            "guid": "4c61fc3f-c14e-4ea6-b69e-8d9a3eec218e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "中程度",
            "subcategory": "計算する",
            "text": "AVD セッションホストをバックアップする要件を評価する"
        },
        {
            "category": "BC/DR",
            "description": "カスタムイメージを使用して AVD ホストプール VM を展開する場合は、大規模な災害が発生した場合でも、それらのアーティファクトがすべてのリージョンで使用可能であることを確認することが重要です。Azure コンピューティング ギャラリー サービスを使用すると、ホスト プールがデプロイされているすべてのリージョンで、冗長ストレージと複数のコピーでイメージをレプリケートできます。",
            "guid": "dd2e0d5d-771d-441e-9610-cc57b4a4a141",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/shared-images-portal",
            "severity": "低い",
            "subcategory": "依存 関係",
            "text": "ゴールデン イメージのリージョン間の可用性を計画する"
        },
        {
            "category": "BC/DR",
            "description": "AVD インフラストラクチャのユーザがオンプレミスのリソースアクセスを必要とする場合、接続に必要なネットワークインフラストラクチャの高可用性も重要であり、考慮する必要があります。認証インフラストラクチャの回復性を評価および評価する必要があります。依存アプリケーションやその他のリソースの BCDR の側面は、セカンダリ DR の場所の可用性を確保するために考慮する必要があります。",
            "guid": "fd339489-8c12-488b-9c6a-57cfb644451e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "中程度",
            "subcategory": "依存 関係",
            "text": "インフラストラクチャとアプリケーションの依存関係を評価する"
        },
        {
            "category": "BC/DR",
            "description": "FSLogix ユーザー プロファイル内のすべてのデータが、障害から保護する必要があるわけではありません。さらに、OneDrive やファイル サーバー/共有などの外部ストレージが使用されている場合、FSLogix プロファイルに残っているものは最小限であり、極端な状況では失われる可能性があります。また、プロファイル内のデータを他のストレージ (キャッシュ モードの Outlook 受信トレイなど) から再構築できる場合もあります。",
            "guid": "687ab077-adb5-49e5-a960-3334fdf8cc23",
            "link": "https://learn.microsoft.com/fslogix/manage-profile-content-cncpt",
            "severity": "中程度",
            "subcategory": "貯蔵",
            "text": "プロファイルコンテナとオフィスコンテナ内で保護する必要があるデータを評価します"
        },
        {
            "category": "BC/DR",
            "description": "重要なユーザーデータのデータ損失を防ぐことは重要であり、最初のステップは、どのデータを保存して保護する必要があるかを評価することです。OneDriveまたはその他の外部ストレージを使用している場合は、ユーザープロファイルやOfficeコンテナのデータを保存する必要がない場合があります。重要なユーザー データを保護するには、適切なメカニズムを検討する必要があります。Azure Backup サービスは、Azure Files Standard レベルと Premium レベルに格納されているときに、プロファイルとオフィス コンテナーのデータを保護するために使用できます。Azure NetApp Files Snapshots と Policies は、Azure NetApp Files (すべての層) に使用できます。",
            "guid": "fc4972cc-3cd2-45bf-a707-6e9eab4bed32",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "中程度",
            "subcategory": "貯蔵",
            "text": "プロファイルコンテナとオフィスコンテナのバックアップ保護戦略を構築する"
        },
        {
            "category": "BC/DR",
            "description": "AVD では、FSLogix コンテナに存在するユーザーデータに複数のレプリケーションメカニズムと戦略を使用できます。プロファイル パターン #1: ネイティブの Azure ストレージ レプリケーション メカニズム (Azure Files Standard GRS レプリケーション、Azure NetApp Files クロスリージョン レプリケーション、VM ベースのファイル サーバー用の Azure Files Sync など)Azure Files にゾーン レプリケート ストレージ (ZRS) または geo レプリケート ストレージ (GRS) を使用することをお勧めします。ローカルのみの回復性を持つ LRS は、ゾーン/リージョンの保護が必要ない場合に使用できます。注: Azure ファイル共有標準は LRS/ZRS/GRS ですが、100 TB の大容量サポートが有効になっている場合は LRS/ZRS のみがサポートされます。?プロファイル パターン #2: FSLogix Cloud Cache は、異なる (最大 4 つの) ストレージ アカウント間でコンテナーをレプリケートするための自動メカニズムで構築されています。クラウドキャッシュは、次の場合にのみ使用する必要があります。ユーザー プロファイルまたは Office コンテナーのデータ可用性が必要 高可用性 SLA は重要であり、リージョンの障害に対する回復性が必要です。選択したストレージ オプションは、BCDR 要件を満たすことができません。たとえば、Azure ファイル共有 Premium レベル、または大きなファイルのサポートが有効になっている Azure ファイル共有標準では、GRS は使用できません。異種ストレージ間のレプリケーションが必要な場合。プロファイル パターン #3: ユーザー データ/プロファイル コンテナーではなく、アプリケーション データに対してのみ geo ディザスター リカバリーを設定する: 重要なアプリケーション データを、OneDrive や独自の組み込み DR メカニズムを備えたその他の外部ストレージなどの個別のストレージに格納します。",
            "guid": "9f7547c1-746d-4c56-868a-714435bd09dd",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "中程度",
            "subcategory": "貯蔵",
            "text": "BCDRを目的としたプロファイルコンテナストレージレプリケーションの要件と回復性を評価する"
        },
        {
            "category": "BC/DR",
            "description": "geo ディザスター リカバリー: Azure NetApp Files は基本的に LRS (ローカルにレプリケートされたストレージ) であるため、リージョン間のレプリケーションが必要な場合は、さらに何かを設計する必要があります。現時点でのクロスリージョンの推奨事項は、別の Azure リージョン(およびネットアップボリューム)にレプリケートするネットアップクラウド同期です。バックアップ:バックアップはスナップショットによって処理されますが、自動ではなく、ポリシーを使用してスケジュールする必要があります。https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-manage-snapshots。ここに記載されているように、ボリュームあたりのスナップショットの上限(255)があります:https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-resource-limits。",
            "guid": "23429db7-2281-4376-85cc-57b4a4b18142",
            "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-manage-snapshots",
            "severity": "中程度",
            "subcategory": "貯蔵",
            "text": "Azure ネットアップ ファイルの DR 戦略を確認する"
        },
        {
            "category": "BC/DR",
            "description": "geo ディザスター リカバリー: Azure Files の GRS は、Standard SKU でのみ使用でき、大規模な共有のサポートはないため、ほとんどのお客様のシナリオには適していません。geo レプリケーションが必要な場合は、Azure ファイル共有プレミアムを使用するときに、FSLogix クラウド キャッシュを使用したレプリケーションを評価するか、\"リージョン内\" 可用性ゾーン (AZ) のみの回復性を考慮する必要があります。バックアップ: Azure Backup は、すべての SKU で Azure ファイル共有を完全にサポートしており、プロファイル コンテナーを保護するために推奨されるソリューションです。OneDriveまたはその他の外部ストレージを使用している場合は、ユーザープロファイルやOfficeコンテナのデータを保存する必要がない場合があります。",
            "guid": "3d4f3537-c134-46dc-9602-7a71efe1bd05",
            "link": "https://learn.microsoft.com/azure/backup/backup-afs",
            "severity": "中程度",
            "subcategory": "貯蔵",
            "text": "Azure Files DR 戦略を確認する"
        },
        {
            "category": "計算する",
            "description": "アプリケーションは、ゴールデン イメージにプレインストールすることも、MSIX & AppAttach 機能を使用してアタッチすることも、従来の SW 配布方法を使用してプールのデプロイ後にホストに配布することもできます。",
            "guid": "86ba2802-1459-4014-95d3-8e5309ccbd97",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-customize-master-image",
            "severity": "高い",
            "subcategory": "ゴールデンイメージ",
            "text": "アプリケーションを AVD ホストプールに展開する方法を決定する"
        },
        {
            "category": "計算する",
            "description": "彼らは、単一のイメージ、または異なるアプリケーションが組み込まれた複数のイメージに役立つfslogixアプリケーションマスキングを使用しますか?",
            "guid": "9266bcca-274f-4aa1-abf3-9d95d44c7c89",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace",
            "severity": "中程度",
            "subcategory": "ゴールデンイメージ",
            "text": "必要なゴールデン画像の数を見積もる"
        },
        {
            "category": "計算する",
            "description": "各ホスト プールの展開に使用するゲスト OS を決定します: Windows 10 と Windows Server、マーケットプレースとカスタム イメージ",
            "guid": "19ca1f6d-5315-4ae5-84ba-34d4585e2213",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "中程度",
            "subcategory": "ゴールデンイメージ",
            "text": "ホスト プールの展開に使用する OS イメージを決定する"
        },
        {
            "category": "計算する",
            "description": "何も存在しない場合は、Azure Image Builder を使用してビルド プロセスを自動化することを検討してください。",
            "guid": "9bd7bb01-2f7b-495e-86e1-54e2aa359282",
            "link": "https://learn.microsoft.com/azure/virtual-machines/image-builder-overview",
            "severity": "低い",
            "subcategory": "ゴールデンイメージ",
            "text": "カスタム イメージを使用する場合は、自動ビルド プロセスがあるかどうかを判断しますか。"
        },
        {
            "category": "計算する",
            "description": "Azure コンピューティング ギャラリーを評価します。",
            "guid": "5a2adb2c-3e23-426b-b225-ca44e1696fdd",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/shared-image-galleries",
            "severity": "低い",
            "subcategory": "ゴールデンイメージ",
            "text": "カスタム イメージを使用する場合、イメージのライフサイクルを整理および管理する計画はありますか?"
        },
        {
            "category": "計算する",
            "description": "ゴールデンイメージのカスタマイズに関するいくつかの既知のベストプラクティスと推奨事項がありますので、参照されている記事を確認してください。",
            "guid": "deace4cb-1dec-44c6-90c3-fc14eebb36a3",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-customize-master-image",
            "severity": "中程度",
            "subcategory": "ゴールデンイメージ",
            "text": "カスタムイメージを使用する場合は、マスターイメージの構築方法に関する AVD の推奨ベストプラクティスを確認してください。"
        },
        {
            "category": "計算する",
            "description": "このツールセットは、ホワイト ペーパー「仮想デスクトップ インフラストラクチャ (VDI) ロールのための Windows 10 バージョン 2004 の最適化」で参照されている設定を自動的に適用するために作成されました https://learn.microsoft.com/windows-server/remote/remote-desktop-services/rds-vdi-recommendations-2004。ホワイトペーパーに記載されているツールの使用および/または最適化を検討する必要があります。",
            "guid": "829e3fec-2183-4687-a017-7a2b5945bda4",
            "link": "https://github.com/The-Virtual-Desktop-Team/Virtual-Desktop-Optimization-Tool",
            "severity": "中程度",
            "subcategory": "ゴールデンイメージ",
            "text": "仮想デスクトップ最適化ツールの使用状況を評価する"
        },
        {
            "category": "計算する",
            "description": "初期展開後にホスト プール VM の構成を管理するための構成管理ツールが既に導入されているかどうかを確認します (SCCM、MEM/Intune、GPO、3 番目のパーティのソリューションなど)。",
            "guid": "3334fdf9-1c23-4418-8b65-285269440b4b",
            "link": "https://learn.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop-multi-session",
            "severity": "低い",
            "subcategory": "ゴールデンイメージ",
            "text": "AVD セッションホスト設定管理戦略の計画/評価"
        },
        {
            "category": "計算する",
            "description": "提供されている記事を確認し、「既知のフォルダーリダイレクト」と「ファイルオンデマンド」を確認します OneDrive 機能を検討し、最終的に採用する必要があります。",
            "guid": "e3d3e084-4276-4d4b-bc01-5bcf219e4a1e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/install-office-on-AVD-master-image",
            "severity": "中程度",
            "subcategory": "ゴールデンイメージ",
            "text": "Microsoft OneDrive が AVD 展開の一部になるかどうかを判断する"
        },
        {
            "category": "計算する",
            "description": "この記事を確認し、最新バージョンを使用し、Teams の除外を確認して評価し、プロファイルのサイズを小さくしてください。",
            "guid": "b5887953-5d22-4788-9d30-b66c67be5951",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/teams-on-AVD",
            "severity": "中程度",
            "subcategory": "ゴールデンイメージ",
            "text": "Microsoft Teams が AVD 展開の一部になるかどうかを判断する"
        },
        {
            "category": "計算する",
            "description": "MSIX パッケージを格納するには、個別のストレージ アカウント/共有を使用することを強くお勧めします。必要に応じて、ストレージは個別にスケールアウトでき、プロファイル I/O アクティビティの影響を受けません。Azure には、MISX アプリのアタッチに使用できる複数のストレージ オプションが用意されています。Azure Files または Azure NetApp Files は、コストと管理オーバーヘッドの間で最適な価値を提供するため、これらのオプションを使用することをお勧めします。",
            "guid": "90083845-c587-4cb3-a1ec-16a1d076ef9f",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-file-share",
            "severity": "高い",
            "subcategory": "MSIX & AppAttach",
            "text": "プロファイル/Office コンテナーと同じストレージ アカウント/共有を使用しないでください"
        },
        {
            "category": "計算する",
            "description": "参照記事では、AVD コンテキストでの MSIX の使用に関するパフォーマンスに関する考慮事項はほとんどありませんが、慎重に確認してください。",
            "guid": "241addce-5793-477b-adb3-751ab2ac1fad",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-file-share",
            "severity": "高い",
            "subcategory": "MSIX & AppAttach",
            "text": "MSIX のパフォーマンスに関する考慮事項を確認する"
        },
        {
            "category": "計算する",
            "description": "MSIX アプリのアタッチには、ファイル共有にアクセスするための読み取り専用アクセス許可が必要です。MSIX アプリケーションを Azure Files に格納する場合は、セッション ホストに対して、すべてのセッション ホスト VM に、共有に対するストレージ アカウント ロールベースのアクセス制御 (RBAC) とファイル共有の新技術ファイル システム (NTFS) アクセス許可の両方を割り当てる必要があります。",
            "guid": "66e15d4d-5a2a-4db2-a3e2-326bf225ca41",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-file-share",
            "severity": "中程度",
            "subcategory": "MSIX & AppAttach",
            "text": "MSIX 共有の適切なセッション ホストのアクセス許可を確認する"
        },
        {
            "category": "計算する",
            "description": "3番目のパーティのソフトウェアベンダーは、MIXパッケージを提供する必要があります、それは顧客アプリケーションの所有者からの適切なサポートなしで変換手順を試みることはお勧めしません。",
            "guid": "bd362caa-ab79-4b19-adab-81932c9fc9d1",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-faq",
            "severity": "中程度",
            "subcategory": "MSIX & AppAttach",
            "text": "3番目のパーティ製アプリケーション用の MSIX パッケージ"
        },
        {
            "category": "計算する",
            "description": "MSIX アプリのアタッチでは、MSIX アプリケーションの自動更新がサポートされないため、無効にする必要があります。",
            "guid": "bb88037f-5e6b-4fbb-aed5-03547cc447e8",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-faq",
            "severity": "低い",
            "subcategory": "MSIX & AppAttach",
            "text": "MSIX パッケージの自動更新を無効にする"
        },
        {
            "category": "計算する",
            "description": "MSIX & App Attach を利用するには、AVD ホスト プールのゲスト OS イメージが Windows 10 Enterprise または Windows 10 Enterprise Multi-session バージョン 2004 以降である必要があります。",
            "guid": "26128a71-f0f1-4cac-9d9e-f1d5e832e42e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-faq",
            "severity": "中程度",
            "subcategory": "MSIX & AppAttach",
            "text": "オペレーティング システムのサポートを確認する"
        },
        {
            "category": "計算する",
            "description": "ホスト プールのデプロイに使用する VM SKU を選択したら、セキュリティを強化し、機能を向上させるために、Gen2 タイプの SKU を使用することをお勧めします。",
            "guid": "e4633254-3185-40a1-b120-bd563a1c8e9d",
            "link": "https://learn.microsoft.com/azure/virtual-machines/generation-2",
            "severity": "中程度",
            "subcategory": "セッション ホスト",
            "text": "ホスト プールの展開のための Gen2 VM の使用状況を評価する"
        },
        {
            "category": "財団",
            "description": "共有/プールまたは専用/個人",
            "guid": "8468c55a-775c-46ee-a5b8-6ad8844ce3b2",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace",
            "severity": "高い",
            "subcategory": "キャパシティ プランニング",
            "text": "使用するホスト・プール・タイプの決定"
        },
        {
            "category": "財団",
            "description": "自動割り当てと直接割り当ての違いがよく理解されており、選択したオプションが問題のシナリオに適していることを確認します。",
            "guid": "b38b875b-a1cf-4204-a901-3a5d3ce474db",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type",
            "severity": "中程度",
            "subcategory": "キャパシティ プランニング",
            "text": "パーソナルホストプールタイプで、割り当てタイプを決定します"
        },
        {
            "category": "財団",
            "description": "使用するものと使用可能なオプションを確認し、自動スケーリングを使用する場合は幅優先に設定されることに注意してください。",
            "guid": "cbd8682a-6abc-4a2a-9fda-1dbf3dc95d48",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/host-pool-load-balancing",
            "severity": "中程度",
            "subcategory": "キャパシティ プランニング",
            "text": "プールされたホストプールタイプで、負荷分散方法を決定します"
        },
        {
            "category": "財団",
            "description": "選択基準に基づいて、必要なホストプールの数はいくつですか。次の場合は、複数のものを持つことを検討する必要があります。複数のOSイメージ?複数の地域?別のハードウェアが必要ですか?異なるホストプールタイプ(共有と個人)?異なるユーザー要件とSLA(トップユーザー、エグゼクティブ、オフィスワーカー対開発者など)?さまざまな RDP 設定 (ホスト プール レベルで適用) については、「https://learn.microsoft.com/azure/virtual-desktop/customize-rdp-properties」を参照してください。ホスト プール内の必要な数の VM が最大機能を超えています",
            "guid": "c7c791dc-a1f6-4d56-999e-558b937d4985",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/environment-setup",
            "severity": "高い",
            "subcategory": "キャパシティ プランニング",
            "text": "展開するさまざまなホスト プールの数を見積もる"
        },
        {
            "category": "財団",
            "description": "提供されているリンクを使用して SKU 決定の開始点を設定し、パフォーマンス テストを使用して検証します。セッション ホストごとに少なくとも 4 つのコアが本番用に選択されていることを確認します (マルチセッション)",
            "guid": "e1112dbd-7ba0-412e-9b94-ef6e047d2ea2",
            "link": "https://learn.microsoft.com/windows-server/remote/remote-desktop-services/virtual-machine-recs",
            "severity": "中程度",
            "subcategory": "キャパシティ プランニング",
            "text": "ワークロード パフォーマンス テストを実行して、使用する最適な Azure VM SKU とサイズを決定します (プールあたりのホスト数を決定します)"
        },
        {
            "category": "財団",
            "description": "参照記事で報告されている AVD の容量と制限を確認することが重要です。",
            "guid": "992b1cd6-d2f5-44b2-a769-e3a691e8838a",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop",
            "severity": "高い",
            "subcategory": "キャパシティ プランニング",
            "text": "環境の AVD スケーラビリティの制限を確認する"
        },
        {
            "category": "財団",
            "description": "GPU を搭載したホスト プールには特別な構成が必要ですので、参照先の記事を必ず確認してください。",
            "guid": "c936667e-13c0-4056-94b1-e945a459837e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/configure-vm-gpu",
            "severity": "中程度",
            "subcategory": "キャパシティ プランニング",
            "text": "セッション ホストに GPU が必要かどうかを判断する"
        },
        {
            "category": "財団",
            "description": "可能な限り、高速ネットワーク機能を備えた VM SKU を活用することをお勧めします。現在、Windows Server OSがサポートされており(記事のリストを参照)、将来的にはWindowsクライアントOSも含まれる可能性があります。",
            "guid": "b47a393a-0803-4272-a479-8b1578b219a4",
            "link": "https://learn.microsoft.com/azure/virtual-network/create-vm-accelerated-networking-powershell",
            "severity": "低い",
            "subcategory": "キャパシティ プランニング",
            "text": "Azure の高速ネットワーク機能を利用できる VM SKU を使用することをお勧めします。"
        },
        {
            "category": "財団",
            "description": "適切な計画と展開を行うには、最大ユーザー数と平均同時セッション数を評価することが重要です。",
            "guid": "bb91a33d-90ca-4e2c-a881-3706f7c0cb9f",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/faq",
            "severity": "中程度",
            "subcategory": "クライアントとユーザー",
            "text": "AVD に接続するユーザーの数と、どのリージョンから接続するかを評価する"
        },
        {
            "category": "財団",
            "description": "異なるユーザー セットをサポートするために複数のホスト プールが必要になる可能性がある場合は、必要な数を見積もることをお勧めします。",
            "guid": "a1cf2049-9013-4a5d-9ce4-74dbcbd8682a",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/environment-setup",
            "severity": "中程度",
            "subcategory": "クライアントとユーザー",
            "text": "すべてのユーザーが同じアプリケーション・セットを持つか、異なるホスト・プール構成やOSイメージを使用するかを決定する"
        },
        {
            "category": "財団",
            "description": "AVD プールの外部のリソース(Active Directory、外部ファイル共有またはその他のストレージ、オンプレミスのサービスとリソース、VPN や Express Route などのネットワーク インフラストラクチャ コンポーネント、外部サービス、サードパーティ コンポーネントなど)への依存関係を評価および確認する必要があります。これらすべてのリソースについて、AVD ホストプールからの遅延を評価し、接続を考慮する必要があります。さらに、BCDR に関する考慮事項をこれらの依存関係にも適用する必要があります。",
            "guid": "6abca2a4-fda1-4dbf-9dc9-5d48c7c791dc",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "低い",
            "subcategory": "クライアントとユーザー",
            "text": "各ホスト プールの外部依存関係を評価する"
        },
        {
            "category": "財団",
            "description": "各クライアントの制限事項を確認し、可能な場合は複数のオプションを比較します。",
            "guid": "a1f6d565-99e5-458b-a37d-4985e1112dbd",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/connect-windows-7-10",
            "severity": "中程度",
            "subcategory": "クライアントとユーザー",
            "text": "使用されているクライアント OS と AVD クライアントタイプを確認する"
        },
        {
            "category": "財団",
            "description": "Windows Virtual Desktop ワークロードを実行するための適切なライセンスを持つお客様は、セッション ホスト仮想マシンに Windows ライセンスを適用し、別のライセンスを支払うことなく実行できます。",
            "guid": "7ba012e7-b94e-4f6e-847d-2ea2992b1cd6",
            "link": "https://azure.microsoft.com/pricing/details/virtual-desktop/",
            "severity": "低い",
            "subcategory": "クライアントとユーザー",
            "text": "ライセンス要件を確認する"
        },
        {
            "category": "財団",
            "description": "ユーザーの場所と AVD リージョンの展開によっては、ユーザーのエクスペリエンスが最適でない場合があるため、小規模な PoC 環境でできるだけ早くテストすることが重要です。",
            "guid": "d2f54b29-769e-43a6-a1e8-838ac936667e",
            "link": "https://azure.microsoft.com/services/virtual-desktop/assessment/",
            "severity": "高い",
            "subcategory": "クライアントとユーザー",
            "text": "PoC を実行してエンドツーエンドのユーザー エクスペリエンスをテストし、ネットワーク遅延による影響を検証する"
        },
        {
            "category": "財団",
            "description": "ユーザーにフルデスクトップまたはリモートアプリケーショングループを提供するかどうかを決定します。",
            "guid": "13c00567-4b1e-4945-a459-837ee7ad6c6d",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/manage-app-groups",
            "severity": "低い",
            "subcategory": "クライアントとユーザー",
            "text": "ユーザーがフルデスクトップやリモートアプリケーションを使用して AVD にアクセスするかどうかを決定する"
        },
        {
            "category": "財団",
            "description": "RDP 設定は、現在、ユーザー/グループごとではなく、ホスト プール レベルでのみ構成できます。",
            "guid": "3b365a5c-7acb-4e48-abe5-4cd79f2e8776",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/customize-rdp-properties",
            "severity": "低い",
            "subcategory": "クライアントとユーザー",
            "text": "すべてのユーザーの RDP 設定は同じですか?"
        },
        {
            "category": "財団",
            "description": "マネージド ネットワークの RDP ショートパスは、リモート デスクトップ クライアントとセッション ホスト間の直接 UDP ベースのトランスポートを確立する Azure 仮想デスクトップの機能です。余分なリレーを削除すると、ラウンドトリップ時間が短縮され、遅延の影響を受けやすいアプリケーションや入力方式のユーザーエクスペリエンスが向上します。RDP ショートパスをサポートするには、Azure 仮想デスクトップ クライアントがセッション ホストへの直接の通信経路を必要とし、Windows 10 または Windows 7 のいずれかを実行し、Windows デスクトップ クライアントがインストールされている必要があります。",
            "guid": "b2074747-d01a-4f61-b1aa-92ad793d9ff4",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/shortpath",
            "severity": "中程度",
            "subcategory": "クライアントとユーザー",
            "text": "管理された内部ネットワークから接続するクライアントの RDP ShortPath を評価する"
        },
        {
            "category": "財団",
            "description": "AVDは非地域サービスであり、ホストプールは任意のリージョンで作成でき、最も近いフロントエンドからの自動リダイレクトが自動的に行われます。",
            "guid": "42e52f47-21d9-428c-8b1b-d521e44a29a9",
            "link": "https://azure.microsoft.com/global-infrastructure/services/?products=virtual-desktop",
            "severity": "高い",
            "subcategory": "全般",
            "text": "どの Azure リージョンにデプロイされるかを決定します。"
        },
        {
            "category": "財団",
            "description": "オンプレミス環境に接続する必要がある場合は、現在の接続オプションを評価するか、必要な接続を計画します。",
            "guid": "dd399cfd-7b28-4dc8-9555-6202bfe4563b",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/",
            "severity": "中程度",
            "subcategory": "全般",
            "text": "オンプレミス環境への接続にハイブリッド接続が必要かどうかを判断する"
        },
        {
            "category": "財団",
            "description": "\"Windows 仮想デスクトップ エクスペリエンス推定ツール\" ツールを実行して、ホスト プールをデプロイするのに最適な Azure リージョンを選択します。150 ミリ秒を超える待機時間を超えると、ユーザー エクスペリエンスが最適でなくなる可能性があります。",
            "guid": "0d834a34-8b26-43e6-bc60-512a26498f6d",
            "link": "https://azure.microsoft.com/services/virtual-desktop/assessment/",
            "severity": "高い",
            "subcategory": "全般",
            "text": "ユーザーの場所と Azure AVD インフラストラクチャの間の待機時間を評価しましたか?"
        },
        {
            "category": "財団",
            "description": "AVD は、特定の地理的な場所でサービスを実行するためにのみメタデータを保存し、顧客の要件に基づいて、現在利用可能なものと適切なものを決定します。",
            "guid": "bad37ead-53cc-47ce-8d7a-aab3571449ab",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/data-locations",
            "severity": "中程度",
            "subcategory": "全般",
            "text": "AVD サービスのメタデータの場所を決定する"
        },
        {
            "category": "財団",
            "description": "特定の VM SKU を確認し (特に GPU またはハイスペックの SKU が必要な場合は)、最終的には Azure NetApp Files の可用性 (使用されている場合) を確認します。",
            "guid": "8053d89e-89dc-47b3-9be2-a1a27f7a9e91",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
            "severity": "低い",
            "subcategory": "全般",
            "text": "選択したリージョンの特定の VM サイズの Azure クォータと可用性を確認する"
        },
        {
            "category": "財団",
            "description": "詳細については、「BCDR 」セクションを参照してください。",
            "guid": "be1f38ce-f398-412b-b463-cbbac89c199d",
            "link": "https://learn.microsoft.com/azure/availability-zones/az-region",
            "severity": "中程度",
            "subcategory": "全般",
            "text": "選択したリージョンのアベイラビリティーゾーン (AZ) の可用性を確認する"
        },
        {
            "category": "同一性",
            "description": "Azure の AD DC は、AVD セッションホストにログインするユーザーのレイテンシーを短縮し、最終的には Azure NetApp Files と AD 統合のレイテンシーを削減するために推奨されます。ADCは、すべての子ドメインのDCと通信できる必要があります。別の方法として、オンプレミス接続を使用して AD DC に到達する必要があります。",
            "guid": "c14aea7e-65e8-4d9a-9aec-218e6436b073",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
            "severity": "中程度",
            "subcategory": "アクティブディレクトリ",
            "text": "AVD ホスト プールに近い Azure VNET 環境に少なくとも 2 つのアクティブ ディレクトリ ドメイン コントローラー (DC) を作成します。"
        },
        {
            "category": "同一性",
            "description": "別の OU 階層の下にホスト プールごとに個別の OU を作成することをお勧めします。これらの OU には、AVD セッションホストのマシンアカウントが含まれます。",
            "guid": "6db55f57-9603-4334-adf9-cc23418db612",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace",
            "severity": "低い",
            "subcategory": "アクティブディレクトリ",
            "text": "ホスト プールごとにアクティブ ディレクトリに特定の OU を作成する"
        },
        {
            "category": "同一性",
            "description": "慎重に確認し、最終的に AVD ホストプールを含む OU への GPO の継承をブロック/フィルタリングします。",
            "guid": "7126504b-b47a-4393-a080-327294798b15",
            "link": "https://learn.microsoft.com/previous-versions/windows/desktop/Policy/group-policy-hierarchy",
            "severity": "中程度",
            "subcategory": "アクティブディレクトリ",
            "text": "OU に適用され、ホスト プール VM の機能に影響を与えるドメイン GPO を確認する"
        },
        {
            "category": "同一性",
            "description": "特定のアクセス許可を持つ特定の専用アカウントを持ち、既定の 10 回の参加制限がないことをお勧めします。",
            "guid": "347dc560-28a7-41ff-b1cd-15dd2f0d5e77",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace",
            "severity": "中程度",
            "subcategory": "アクティブディレクトリ",
            "text": "VM をドメインに参加させるためのアクセス許可のみを持つ専用ユーザー アカウントを作成する"
        },
        {
            "category": "同一性",
            "description": "ユーザーごとにアクセスを許可するのではなく、AD グループを使用し、Azure AD の ADC を使用してレプリケートします。",
            "guid": "2d41e361-1cc5-47b4-a4b1-410d43958a8c",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/manage-app-groups",
            "severity": "中程度",
            "subcategory": "アクティブディレクトリ",
            "text": "各ホスト プール アプリケーション グループ (DAG または RAG) へのアクセスが許可されるユーザーのセットごとにドメイン ユーザー グループを作成します。"
        },
        {
            "category": "同一性",
            "description": "Azure ファイル共有と Active Directory 認証を統合する手順の一環として、ストレージ アカウント (ファイル共有) を表す AD アカウントが作成されます。コンピューター アカウントまたはサービス ログオン アカウントとして登録することを選択できます (詳細については、FAQ を参照してください)。コンピューター アカウントの場合、AD には既定のパスワードの有効期限が 30 日に設定されています。同様に、サービス ログオン アカウントには、AD ドメインまたは組織単位 (OU) に既定のパスワード有効期限が設定されている場合があります。どちらのアカウントの種類でも、AD 環境で構成されているパスワードの有効期限を確認し、パスワードの最大有効期間の前に AD アカウントのストレージ アカウント ID のパスワードを更新することを計画することをお勧めします。AD に新しい AD 組織単位 (OU) を作成し、それに応じてコンピューター アカウントまたはサービス ログオン アカウントのパスワード有効期限ポリシーを無効にすることを検討できます。",
            "guid": "2289b3d6-b57c-4fc6-9546-1e1a3e3453a3",
            "link": "https://learn.microsoft.com/azure/storage/files/storage-files-identity-ad-ds-enable",
            "severity": "低い",
            "subcategory": "アクティブディレクトリ",
            "text": "Azure Files AD 統合で使用されるアカウントの組織のパスワード有効期限ポリシーを確認する"
        },
        {
            "category": "同一性",
            "description": "Azure サブスクリプションは、Windows Server Active Directory または Azure AD DS インスタンスを含む、または Azure AD DS インスタンスに接続されている仮想ネットワークを含む、同じ Azure AD テナントの親である必要があります。",
            "guid": "6ceb5443-5125-4922-9442-93bb628537a5",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "高い",
            "subcategory": "必要条件",
            "text": "Azure Active Directory テナントは、少なくとも 1 つのサブスクリプションがリンクされている状態で使用可能である必要があります"
        },
        {
            "category": "同一性",
            "description": "これは、Azure AD Connect (ハイブリッド組織の場合) または Azure AD ドメイン サービス (ハイブリッド組織またはクラウド組織の場合) を使用して構成できます。",
            "guid": "5119bf8e-8f58-4542-a7d9-cec166cd072a",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "高い",
            "subcategory": "必要条件",
            "text": "Windows Server Active Directory フォレスト/ドメインが Azure Active Directory と同期している"
        },
        {
            "category": "同一性",
            "description": "(1) ユーザーは、Azure AD に接続されているのと同じ Active Directory から取得する必要があります。 Windows 仮想デスクトップは、B2B または MSA アカウントをサポートしていません。(2) Windows 仮想デスクトップのサブスクライブに使用する UPN は、VM が参加しているアクティブ ディレクトリ ドメインに存在する必要があります。",
            "guid": "f9b141a8-98a5-435e-9378-97e71ca7da7b",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "中程度",
            "subcategory": "必要条件",
            "text": "Windows 仮想デスクトップに接続するためのユーザー アカウント要件を確認する"
        },
        {
            "category": "同一性",
            "description": "VM は、Standard ドメイン参加済みまたはハイブリッド AD 参加済みである必要があります。仮想マシンを Azure AD に参加させることはできません。",
            "guid": "ea962a15-9394-46da-a7cc-3923266b2258",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "中程度",
            "subcategory": "必要条件",
            "text": "作成される AVD セッションホストの VM 要件を確認する"
        },
        {
            "category": "同一性",
            "description": "セルフマネージド Active Directory Domain Services、Azure Active Directory、および管理された Azure Active Directory Domain Services の比較",
            "guid": "6f4a1651-bddd-4ea8-a487-cdeb4861bc3b",
            "link": "https://learn.microsoft.com/azure/active-directory-domain-services/compare-identity-solutions",
            "severity": "低い",
            "subcategory": "必要条件",
            "text": "AVD に Azure Active Directory ドメイン サービス (AAD-DS) を使用する前に、制限事項を確認してください。"
        },
        {
            "category": "監視と管理",
            "description": "スケーリング ツールは、セッション ホスト VM のコストを最適化したいお客様向けに、低コストの自動化オプションを提供します。スケーリング ツールを使用して、ピーク時とオフピーク時の営業時間に基づいて VM を起動および停止するようにスケジュールしたり、CPU コアあたりのセッション数に基づいて VM をスケールアウトしたり、オフピーク時に VM をスケールインしたりして、セッション ホスト VM の最小数を実行したままにすることができます。パーソナルホストプールタイプではまだ使用できないため、ホストプールごとに個別に設定することをお勧めします。",
            "guid": "7138b820-102c-4e16-be30-1e6e872e52e3",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-scaling-script",
            "severity": "低い",
            "subcategory": "管理",
            "text": "ホスト プールの自動スケーリング機能の要件を評価する"
        },
        {
            "category": "監視と管理",
            "description": "Azure Advisor は、構成とテレメトリを分析して、一般的な問題を解決するためのパーソナライズされた推奨事項を提供します。これらの推奨事項を使用すると、信頼性、セキュリティ、オペレーショナル エクセレンス、パフォーマンス、コストに関して Azure リソースを最適化できます。",
            "guid": "611dd68c-5a4b-4252-8e44-a59a9c2399c4",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/azure-advisor",
            "severity": "低い",
            "subcategory": "管理",
            "text": "AVD に関する Azure アドバイザーの推奨事項を定期的に確認する"
        },
        {
            "category": "監視と管理",
            "description": "ゴールデン イメージの更新を管理するための戦略を準備します (たとえば、セキュリティ修正プログラムの適用やイメージ内にインストールされているアプリケーションの更新など)。Azure Image Builder サービスは、VM のビルドとカスタマイズを自動化するためのファースト パーティのソリューションです。 ARM テンプレートを使用して新しいホストを作成し、古いホストを使用停止にすることができます。 https://github.com/Azure/RDS-Templates/tree/master/ARM-AVD-templates/AddVirtualMachinesToHostPool 推奨されるアプローチは、新しいプールをサイドバイサイドで作成し、ロールバックしやすく、専用プールに使用できないARMテンプレートを使用してVMを再デプロイして数を増やすことも実行可能なオプションです。また、既存のソフトウェア配布方法を使用して、SCCM などを使用して再展開せずにイメージを更新することもできます。",
            "guid": "d7b68d0c-7555-462f-8b3e-4563b4d874a7",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/image-builder-virtual-desktop",
            "severity": "中程度",
            "subcategory": "管理",
            "text": "ゴールデンイメージ更新管理戦略を計画する"
        },
        {
            "category": "監視と管理",
            "description": "お客様にはいくつかのオプションがあります。- Microsoft エンドポイント構成マネージャー、この記事では、Windows 10 エンタープライズ マルチセッションを実行している Windows 仮想デスクトップ ホストに更新プログラムを自動的に適用するように Microsoft エンドポイント構成マネージャーを構成する方法について説明します。 https://learn.microsoft.com/azure/virtual-desktop/configure-automatic-updates- マイクロソフト Intune : https://learn.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop-multi-session- Windows Server Update Services (WSUS)- OS をサポートする第三者 - Azure Update Management (Azure Automation)、現在はクライアント OS ではサポートされていません: https://learn.microsoft.com/azure/automation/update-management/overview#unsupported-operating-systemsIt 修正プログラムの適用戦略から離れ、可能であればイメージ再作成戦略に移行することをお勧めします。",
            "guid": "04722da2-9c2b-41cd-922f-54b29bade3aa",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/image-builder-virtual-desktop",
            "severity": "中程度",
            "subcategory": "管理",
            "text": "セッションホストのパッチ適用と更新戦略を計画する"
        },
        {
            "category": "監視と管理",
            "description": "ホスト プールは、Windows 仮想デスクトップ環境内の 1 つ以上の同一の仮想マシンのコレクションです。サービス更新プログラムが最初に適用される検証ホスト プールを作成することを強くお勧めします。これにより、サービスの更新を標準環境または非検証環境に適用する前に監視できます。",
            "guid": "d1e8c38e-c936-4667-913c-005674b1e944",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-validation-host-pool",
            "severity": "低い",
            "subcategory": "管理",
            "text": "AVD テストカナリア環境の要件を評価する"
        },
        {
            "category": "監視と管理",
            "description": "AVD ホスト プールは、Azure ポータル、ARM テンプレート、Azure CLI ツール、Powershell、登録トークンを使用した手動 VM 作成、Terraform など、いくつかの方法でデプロイできます。自動化および CI/CD ツールによる自動デプロイをサポートするために、適切な方法を採用することが重要です。",
            "guid": "a459c373-e7ed-4616-83b3-65a917ecbe48",
            "link": "https://github.com/Azure/RDS-Templates/tree/master/AVD-templates",
            "severity": "中程度",
            "subcategory": "管理",
            "text": "ホスト プールの展開戦略を決定する"
        },
        {
            "category": "監視と管理",
            "description": "Windows 仮想デスクトップ サービス内のホスト プールに VM を登録すると、VM がアクティブになるたびに、エージェントによって VM のトークンが定期的に更新されます。登録トークンの証明書は 90 日間有効です。この 90 日間の制限のため、マシンがトークンを更新し、エージェントとサイド バイ サイド スタック コンポーネントを更新できるように、VM を 90 日ごとに 20 分間オンラインにすることをお勧めします。",
            "guid": "ebe54cd7-df2e-48bb-ac35-81559bb9153e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/faq",
            "severity": "中程度",
            "subcategory": "管理",
            "text": "トークンの更新のために 90 日ごとに VM を定期的にオンにする"
        },
        {
            "category": "監視と管理",
            "description": "Azure Monitor for Windows Virtual Desktop は、Azure Monitor ブック上に構築されたダッシュボードであり、IT プロフェッショナルが Windows 仮想デスクトップ環境を理解するのに役立ちます。Windows 仮想デスクトップ環境を監視するように Windows 仮想デスクトップ用 Azure Monitor を設定する方法については、参照先の記事をお読みください。",
            "guid": "63cfff1c-ac59-49ef-8d5a-83dd4de36c1c",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/azure-monitor",
            "severity": "高い",
            "subcategory": "モニタリング",
            "text": "AVD の Azure モニタリングを有効にする"
        },
        {
            "category": "監視と管理",
            "description": "Windows Virtual Desktop では、他の多くの Azure サービスと同様に、監視とアラートに Azure Monitor と Log Analytics を使用します。これにより、管理者は単一のインターフェイスから問題を特定できます。このサービスは、ユーザー操作と管理者操作の両方のアクティビティ ログを作成します。 各アクティビティ ログは、管理、フィード、接続、ホスト登録、エラー、チェックポイントのカテゴリに分類されます。",
            "guid": "81770afb-c4c0-4e43-a186-58d2857ed671",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/diagnostics-log-analytics",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "ワークスペース、ホスト プール、アプリケーション グループ、ホスト VM の診断設定を有効にして Log Analytics ワークスペースにリダイレクトする"
        },
        {
            "category": "監視と管理",
            "description": "参照されている記事と、ストレージの適切な監視とアラートを設定するには、次の追加の記事を参照してください。 https://learn.microsoft.com/azure/storage/files/storage-troubleshooting-files-performance。",
            "guid": "2463cffe-179c-4599-be0d-5973dd4ce32c",
            "link": "https://learn.microsoft.com/azure/storage/files/storage-files-monitoring?tabs=azure-portal",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "プロファイルストレージにアラートを作成して、使用率とスロットリングが高い場合にアラートを受け取る"
        },
        {
            "category": "監視と管理",
            "description": "Azure サービス正常性を使用して、Windows 仮想デスクトップのサービスの問題と正常性アドバイザリを監視できます。Azure Service Health では、さまざまな種類のアラート (電子メールや SMS など) で通知し、問題の影響を理解し、問題の解決時に最新情報を入手できます。",
            "guid": "18813706-f7c4-4c0d-9e51-4548d2457ed6",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-service-alerts",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "AVD アラートの Azure サービス正常性を構成する"
        },
        {
            "category": "ネットワーキング",
            "description": "どのタイプのハイブリッド接続ですか?エクスプレスルート、VPN、NVA?",
            "guid": "c8639648-a652-4d6c-85e5-02965388e5de",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/",
            "severity": "中程度",
            "subcategory": "ネットワーキング",
            "text": "オンプレミス環境のハイブリッド接続アーキテクチャを確認する"
        },
        {
            "category": "ネットワーキング",
            "description": "帯域幅の要件を評価し、VPN/ER 帯域幅が十分であり、待機時間が許容できることを確認します。",
            "guid": "d227dd14-2b06-4c21-a799-9a646f4389a7",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/",
            "severity": "中程度",
            "subcategory": "ネットワーキング",
            "text": "ユーザーが AVD ホストプールからオンプレミスにアクセスする必要があるリソースを評価する"
        },
        {
            "category": "ネットワーキング",
            "description": "CAF に基づいて AVD ホストプールを配置する場所をレビューまたは推奨する(vWAN vs. ハブ&スポーク)",
            "guid": "f42c78e7-8c06-4a63-a21a-4956e6a8dc4a",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/networking-options",
            "severity": "高い",
            "subcategory": "ネットワーキング",
            "text": "AVD サービスのランディングゾーンネットワーキングトポロジの確認"
        },
        {
            "category": "ネットワーキング",
            "description": "各サブネットに AVD ホストプールをスケーリングするのに十分なスペースがあることを確認します。ホスト プールが異なる場合は、可能であれば個別のサブネットを使用することをお勧めします。",
            "guid": "20e27b3e-2971-41b1-952b-eee079b588de",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "中程度",
            "subcategory": "ネットワーキング",
            "text": "複数のホスト プールの VNET とサブネットの配置を評価する"
        },
        {
            "category": "ネットワーキング",
            "description": "いくつかのオプションを使用できます。Azure Firewall または NVA ファイアウォール、NSG、プロキシを使用できます。NSG では、URL による有効化/無効化はできず、ポートとプロトコルのみが可能です。プロキシは、ユーザーブラウザの明示的な設定としてのみ使用する必要があります。AVD での Azure Firewall Premium の使用の詳細については、こちら https://aka.ms/AVDfirewall と こちら https://learn.microsoft.com/azure/firewall/protect-windows-virtual-desktop を参照してください。AVD URL アクセスの要件の完全なリストを確認してください。",
            "guid": "fc4972cd-3cd2-41bf-9703-6e5e6b4bed3d",
            "link": "https://aka.ms/AVDfirewall",
            "severity": "中程度",
            "subcategory": "ネットワーキング",
            "text": "AVD ホストのインターネットアウトバウンドトラフィックを制御/制限する必要がありますか?"
        },
        {
            "category": "ネットワーキング",
            "description": "Azure Defender エンドポイントを使用してユーザーの Web ナビゲーションを制御することを検討してください。詳細については、「セキュリティ」セクションを参照してください。",
            "guid": "73676ae4-6691-4e88-95ad-a42223e13810",
            "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/windows-virtual-desktop-support-is-now-generally-available/ba-p/2103712",
            "severity": "中程度",
            "subcategory": "ネットワーキング",
            "text": "AVD ホスト上のユーザに対してのみインターネットアウトバウンドトラフィックを制御/制限する必要がありますか?"
        },
        {
            "category": "ネットワーキング",
            "description": "カスタム UDR は、たとえば Azure ファイアウォールや NVA にリダイレクトするために、AVD ホスト プール サブネットに適用できます。この場合、AVD コントロールプレーンへのアウトバウンドトラフィックの最適なパスが使用されていることを慎重に確認することをお勧めします。サービスタグを UDR で使用できるようになり、AVD 管理プレーントラフィックを簡単にホワイトリストに登録できるようになりました。https://learn.microsoft.com/azure/firewall/protect-windows-virtual-desktop#host-pool-outbound-access-to-windows-virtual-desktop",
            "guid": "523181a9-4174-4158-93ff-7ae7c6d37431",
            "link": "https://learn.microsoft.com/azure/firewall/protect-windows-virtual-desktop",
            "severity": "低い",
            "subcategory": "ネットワーキング",
            "text": "AVD ホストプールサブネットの UDR の確認"
        },
        {
            "category": "ネットワーキング",
            "description": "セッションホストによる AVD コントロールプレーンアクセスに必要な URL については、次の https://learn.microsoft.com/azure/virtual-desktop/safe-url-list を参照してください。セッション ホストからの接続を確認するためのチェック ツールを使用できます。 https://learn.microsoft.com/azure/virtual-desktop/safe-url-list#required-url-check-tool.",
            "guid": "65c7acbe-45bb-4e60-ad89-f2e87778424d",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/safe-url-list",
            "severity": "高い",
            "subcategory": "ネットワーキング",
            "text": "AVD コントロールプレーンエンドポイントにアクセスできることを確認する"
        },
        {
            "category": "ネットワーキング",
            "description": "特定のワークロードの種類に基づいて、ユーザーのネットワーク帯域幅要件を評価および確認することをお勧めします。参照されている記事は一般的な見積もりと推奨事項を提供しますが、適切なサイズ設定には特定の手段が必要です。",
            "guid": "516785c6-fa96-4c96-ad88-408f372734c8",
            "link": "https://learn.microsoft.com/windows-server/remote/remote-desktop-services/network-guidance",
            "severity": "低い",
            "subcategory": "ネットワーキング",
            "text": "VM SKU の各ユーザーおよび合計に必要なネットワーク帯域幅を確認する"
        },
        {
            "category": "安全",
            "description": "仮想デスクトップへの管理者アクセス権をユーザーに付与しないことをお勧めします。ソフトウェア パッケージが必要な場合は、Microsoft エンドポイント マネージャーなどの構成管理ユーティリティを使用して使用できるようにすることをお勧めします。マルチセッション環境では、ユーザーがソフトウェアを直接インストールできないようにすることをお勧めします。",
            "guid": "a0cdb3b5-4eb2-4eb0-9dda-a3592718e2ed",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "中程度",
            "subcategory": "ホスト構成",
            "text": "AVD ユーザーが AVD ホストのローカル管理者権限を持たないようにします。"
        },
        {
            "category": "安全",
            "description": "Microsoft Defender for Endpoint は、Windows Virtual Desktop for Windows 10 Enterprise Multi-session をサポートするようになりました。非永続的な仮想デスクトップ インフラストラクチャ (VDI) デバイスのオンボードに関する記事を確認する: https://learn.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi",
            "guid": "b1172576-9ef6-4691-a483-5ac932223ece",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "高い",
            "subcategory": "ホスト構成",
            "text": "ウイルス対策およびマルウェア対策ソリューションが使用されていることを確認します"
        },
        {
            "category": "安全",
            "description": "次の除外が設定されていることを確認してください: https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix#antivirus-exclusions 。",
            "guid": "80b12308-1a54-4174-8583-3ea3ad2c2de7",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "高い",
            "subcategory": "ホスト構成",
            "text": "適切なAV除外が実施されていることを確認する"
        },
        {
            "category": "安全",
            "description": "Azure のディスクは、既定では Microsoft マネージド キーを使用して保存時に既に暗号化されています。ホスト VM OS ディスクの暗号化は、ADE と DES を使用して可能であり、サポートされています: 賢明で永続的なユーザー データはセッション ホスト ディスクに格納せず、コンプライアンス上の理由で厳密に必要な場合にのみ使用する必要があります。Azure Files を使用した FSLogix ストレージの暗号化は、Azure Storage 上の SSE を使用して実行できます。OneDrive の暗号化については、この記事を参照してください: https://learn.microsoft.com/compliance/assurance/assurance-encryption-for-microsoft-365-services.",
            "guid": "0fd32907-98bc-4178-adc5-a06ca7144351",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "低い",
            "subcategory": "ホスト構成",
            "text": "AVD ホストのディスク暗号化要件を評価する"
        },
        {
            "category": "安全",
            "description": "Azure Defender エンドポイントを使用してユーザーの Web ナビゲーションを制御することを検討してください。",
            "guid": "e19dd344-29eb-4722-a237-a151c5bb4e4f",
            "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/windows-virtual-desktop-support-is-now-generally-available/ba-p/2103712",
            "severity": "中程度",
            "subcategory": "ホスト構成",
            "text": "AVD セッションホストからのユーザーのインターネットナビゲーションを制御/制限する必要がありますか?"
        },
        {
            "category": "安全",
            "description": "サブスクリプション、仮想マシン、キー コンテナー、ストレージ アカウントに対して Azure セキュリティ センター Standard を有効にすることをお勧めします。Azure Security Center Standard を使用すると、脆弱性の評価と管理、PCI などの一般的なフレームワークへの準拠の評価、AVD 環境の全体的なセキュリティの強化が可能になります。",
            "guid": "1814387e-5ca9-4c26-a9b3-2ab5bdfc6998",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "中程度",
            "subcategory": "安全",
            "text": "AVD セッションホストに対する Azure セキュリティ センター(ASC)の使用状況を評価する"
        },
        {
            "category": "安全",
            "description": "たとえば、デスクトップのロックアウトやアイドル状態のセッション終了を課すために使用する必要があります。オンプレミス環境に適用されている既存の GPO を確認し、最終的には AVD ホストもセキュリティで保護するために適用する必要があります。",
            "guid": "a135e337-897e-431c-97d6-8cb6a22ac19f",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "中程度",
            "subcategory": "安全",
            "text": "アクティブ ディレクトリ GPO を確認して RDP セッションをセキュリティで保護する"
        },
        {
            "category": "安全",
            "description": "詳細と分析情報については、次の記事を参照してください。 https://christiaanbrinkhoff.com/2020/03/23/learn-how-to-increase-the-security-level-of-your-windows-virtual-desktop-environment-e-g-windows-client-with-azure-mfa-and-conditional-access",
            "guid": "916d697d-8ead-4ed2-9bdd-186f1ac252b9",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-mfa",
            "severity": "低い",
            "subcategory": "安全",
            "text": "AVD ユーザーの MFA の使用を評価する"
        },
        {
            "category": "安全",
            "description": "条件付きアクセスを有効にすると、Windows 仮想デスクトップ環境へのアクセス権をユーザーに付与する前にリスクを管理できます。アクセスを許可するユーザーを決定するときは、ユーザーが誰であるか、サインインする方法、使用しているデバイスも考慮することをお勧めします。",
            "guid": "556246b4-3856-44b4-bc74-a748b6633ad2",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "低い",
            "subcategory": "安全",
            "text": "ユーザーの条件付きアクセスの使用状況を評価する"
        },
        {
            "category": "安全",
            "description": "監査ログの収集を有効にすると、Windows 仮想デスクトップに関連するユーザーと管理者のアクティビティを表示できます。これは、AVD 監視ツールを有効にして使用するための要件でもあります。有効にすることを強くお勧めします。",
            "guid": "a0916a76-4980-4ad0-b278-ee293c1bc352",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "中程度",
            "subcategory": "安全",
            "text": "中央の Log Analytics ワークスペースへの診断ログと監査ログを有効にする"
        },
        {
            "category": "安全",
            "description": "AVD は、Azure ロールベースのアクセス制御(RBAC)を使用して、ユーザーと管理者にロールを割り当てます。これらのロールは、管理者に特定のタスクを実行する権限を付与します。職務の分離が必要な場合、Windows Virtual Desktop には、ホスト プール、アプリ グループ、およびワークスペースの管理役割を分離できる追加の役割があります。この分離により、管理タスクをよりきめ細かく制御できます。これらのロールには、Azure の標準ロールと最小特権の方法論に準拠した名前が付けられています。",
            "guid": "baaab757-1849-4ab8-893d-c9fc9d1bb73b",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/rbac",
            "severity": "低い",
            "subcategory": "安全",
            "text": "AVD 管理にカスタム RBAC ロールを使用する要件を評価する"
        },
        {
            "category": "安全",
            "description": "セキュリティのベストプラクティスと推奨事項の包括的なセットは、参照記事に含まれているため、確認することをお勧めします。",
            "guid": "36a5a67f-bb9e-4d5b-9547-8c4479816b28",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "中程度",
            "subcategory": "安全",
            "text": "AVD 環境に関するすべてのセキュリティのベストプラクティスを確認する"
        },
        {
            "category": "貯蔵",
            "description": "Azure NetApp Files、Azure Files、VM ベースのファイル サーバー。ファイルサーバーは推奨されません。通常、Azure Files Premium は出発点として適しています。ネットアップは通常、大規模で高パフォーマンスの環境にのみ必要です。",
            "guid": "ed6b17db-8255-4462-b2ae-e4553afc8339",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/store-fslogix-profile",
            "severity": "高い",
            "subcategory": "FSLogix",
            "text": "FSLogix プロファイルおよびオフィス コンテナーに使用するストレージ バックエンド ソリューションを決定する"
        },
        {
            "category": "貯蔵",
            "description": "Windows Virtual Desktop では、以下の「ディザスター リカバリー」セクションで説明するように、特定のビジネス継続性とディザスター リカバリー (BCDR) シナリオを計画していない限り、Office コンテナーなしでプロファイル コンテナーを使用することをお勧めします。https://learn.microsoft.com/fslogix/profile-container-office-container-cncpt",
            "guid": "df47d2d9-2881-4b1c-b5d1-e54a29759e39",
            "link": "https://learn.microsoft.com/fslogix/profile-container-office-container-cncpt",
            "severity": "低い",
            "subcategory": "FSLogix",
            "text": "プロファイルコンテナをオフィスコンテナから分離する可能性を評価する"
        },
        {
            "category": "貯蔵",
            "description": "プロファイル コンテナーのストレージ要件を見積もるための開始点として、定常状態ではユーザーあたり 10 IOPS、サインイン/サインアウト時にはユーザーあたり 50 IOPS を想定することをお勧めします。",
            "guid": "680e7828-9c93-4665-9d02-bff4564b0d93",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "高い",
            "subcategory": "FSLogix",
            "text": "ホスト プールの要件をサポートするための記憶域のスケーラビリティの制限を確認する"
        },
        {
            "category": "貯蔵",
            "description": "DRの目的で2番目のリージョンが必要な場合は、そこでネットアップの可用性も確認します。",
            "guid": "4a359836-ee79-4d6c-9d3a-364a5b7abae3",
            "link": "https://azure.microsoft.com/global-infrastructure/services/",
            "severity": "中程度",
            "subcategory": "FSLogix",
            "text": "NetApp Files ストレージを使用している場合は、特定のリージョンのストレージサービスの可用性を確認してください。"
        },
        {
            "category": "貯蔵",
            "description": "可能な限り、リージョン間のネットワーク トラフィックに関連する追加の待機時間とコストを発生させないようにします。",
            "guid": "8aad53cc-79e2-4e86-9673-57c549675c5e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/fslogix-containers-azure-files",
            "severity": "高い",
            "subcategory": "FSLogix",
            "text": "最適なパフォーマンスを得るには、ストレージ ソリューションと FSLogix プロファイル コンテナーを同じデータ センターの場所に配置する必要があります。"
        },
        {
            "category": "貯蔵",
            "description": "参照記事に記載されているように、FSLogix プロファイル コンテナーの仮想ハード ドライブに対して次のウイルス対策の除外を構成してください。",
            "guid": "83f63047-22ee-479d-9b5c-3632054b69ba",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "中程度",
            "subcategory": "FSLogix",
            "text": "FSLogix の推奨されるウイルス対策除外を構成します (接続時に VHD(x) ファイルをスキャンしないことを含む)。"
        },
        {
            "category": "貯蔵",
            "description": "デフォルトの基本設定と推奨設定は次のとおりです。 https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix#best-practice-settings-for-enterprises 基本セットについてはこちらをご覧ください。 完全な参考のためにここに https://learn.microsoft.com/fslogix/configure-profile-container-tutorialSee: https://learn.microsoft.com/fslogix/profile-container-configuration-reference",
            "guid": "d34aad5e-8c78-4e1d-9666-7313c405674c",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "高い",
            "subcategory": "FSLogix",
            "text": "FSLogix レジストリ キーを確認し、適用するレジストリ キーを決定する"
        },
        {
            "category": "貯蔵",
            "description": "同時接続または複数接続は、Windows 仮想デスクトップでは推奨されません。ベスト プラクティスは、セッションごとに異なるプロファイルの場所を (ホスト プールとして) 作成することです。",
            "guid": "5e985b85-9c77-43e7-b261-623b775a917e",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "高い",
            "subcategory": "FSLogix",
            "text": "同じプロファイルへの同時接続または複数の接続の使用状況を確認する"
        },
        {
            "category": "貯蔵",
            "description": "一般的な見積もりとして、テスト環境で検証するには、ワークロードに応じて、ユーザーごとに 5 から 15 IOPS を最初に検討する必要があります。Azure ファイル: プレミアム シェアあたり最大 100k IOPS (最大 100 TB)、および 3 ミリ秒の待機時間で最大 5 Gbps。Azure Files のプロビジョニング方法、つまり IOPS は厳密にプロビジョニングされた SIZE に関連付けられていることに注意してください。場合によってはバーストサイジング機能。十分な IOPS を確保するために、必要以上の領域を事前にプロビジョニングしてください。注: Azure Premium は、トランザクションを支払わないため、標準よりも安くなる可能性がありますが、覚えておくべき重要な詳細。Azure NetApp Files: 最大 1000 個の IP が接続され、その場で IOPS を調整でき、最小 4 TB のプロビジョニング容量を記憶してください。",
            "guid": "1f348ff3-64d2-47d4-8e8b-bbc868155abb",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/store-fslogix-profile",
            "severity": "高い",
            "subcategory": "FSLogix",
            "text": "ストレージのサイズ設定に関するベスト プラクティスと主な考慮事項を確認する"
        },
        {
            "category": "貯蔵",
            "description": "参照記事で説明されているベストプラクティスと推奨事項のリストを必ず確認してください。",
            "guid": "9164e990-9ae2-48c8-9c33-b6b7808bafe6",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "中程度",
            "subcategory": "FSLogix",
            "text": "Azure ファイルのベスト プラクティスを確認する (使用する場合)"
        },
        {
            "category": "貯蔵",
            "description": "参照記事で説明されているベストプラクティスと推奨事項のリストを必ず確認してください。",
            "guid": "c42149d4-13a9-423c-9574-d11028ac6aae",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "中程度",
            "subcategory": "FSLogix",
            "text": "ネットアップファイルのベストプラクティスを確認する(使用している場合)"
        },
        {
            "category": "貯蔵",
            "description": "プロファイルコンテナのデフォルトの最大サイズは30GBです。大きなプロファイル コンテナーが予想され、お客様がそれらを小さく保とうとする場合は、OneDrive を使用して FSLogix プロファイルの外部で Office 365 ファイルをホストすることを検討してください。",
            "guid": "01e6a84d-e5df-443d-8992-481718d5d1e5",
            "link": "https://learn.microsoft.com/fslogix/profile-container-configuration-reference",
            "severity": "高い",
            "subcategory": "FSLogix",
            "text": "FSLogix で構成された最大プロファイル サイズを確認して確認する"
        },
        {
            "category": "貯蔵",
            "description": "Cloud Cache はローカル ディスクをキャッシュとして使用するため、VM ディスクに大きな負荷がかかる可能性があります。可能であれば、VM SKU に基づいて、一時的な (およびローカルに接続された) VM ディスクの機能を活用することをお勧めします。",
            "guid": "b2d1215a-e114-4ba3-9df5-85ecdcd9bd3b",
            "link": "https://learn.microsoft.com/fslogix/cloud-cache-configuration-reference",
            "severity": "中程度",
            "subcategory": "FSLogix",
            "text": "FSLogix クラウド キャッシュを使用する場合は、キャッシュ ディレクトリを一時ドライブに移動します。"
        },
        {
            "category": "貯蔵",
            "description": "リダイレクト.XMLファイルは、プロファイルコンテナからC:ドライブにリダイレクトされるフォルダを制御するために使用されます。除外は例外であるべきであり、除外を構成するユーザーが特定の除外を完全に理解しない限り、決して使用しないでください。除外は、実装が意図されている環境で常に完全にテストする必要があります。除外を構成すると、機能、安定性、パフォーマンスに影響を与える可能性があります。",
            "guid": "0b50ca97-b1d2-473c-b4d9-6e98b0f912de",
            "link": "https://learn.microsoft.com/fslogix/manage-profile-content-cncpt#redirectionsxml",
            "severity": "中程度",
            "subcategory": "FSLogix",
            "text": "FSLogix リダイレクトの使用法を確認します。"
        },
        {
            "category": "貯蔵",
            "description": "ANF サブネットが作成される Azure 仮想ネットワーク環境用に Active Directory サイトを作成し、リファレンス記事で説明されているように、参加手順を実行するときにそのサイト名を ANF 接続プロパティで指定する必要があります。",
            "guid": "6647e977-db49-48a8-bc35-743f17499d42",
            "link": "https://learn.microsoft.com/azure/azure-netapp-files/create-active-directory-connections",
            "severity": "高い",
            "subcategory": "FSLogix",
            "text": "Azure ネットアップ ファイル ストレージを使用する場合は、AD 接続の AD サイト名の設定を確認してください。"
        },
        {
            "category": "貯蔵",
            "description": "SMB マルチチャネルを使用すると、クライアントは複数のネットワーク接続を使用して、所有コストを削減しながらパフォーマンスを向上させることができます。パフォーマンスの向上は、複数の NIC に帯域幅を集約し、NIC の受信側スケーリング (RSS) サポートを利用して複数の CPU に IO 負荷を分散することで実現されます。",
            "guid": "5784b6ca-5e9e-4bcf-8b54-c95459ea7369",
            "link": "https://learn.microsoft.com/azure/storage/files/storage-files-smb-multichannel-performance",
            "severity": "中程度",
            "subcategory": "FSLogix",
            "text": "Premium ファイル共有を使用して FSLogix プロファイル コンテナーをホストする場合は、SMB マルチチャネルを有効にします。"
        },
        {
            "category": "貯蔵",
            "description": "標準HDD、標準SSD、またはプレミアムSSD、エフェメラルディスクはサポートされておらず、ウルトラディスクは推奨されません。ユーザー密度が低くない場合、およびクラウドキャッシュを使用する場合は、OSディスクのプレミアムを評価することをお勧めします。",
            "guid": "3611c818-b0a0-4bc5-80e4-3a18a9cd289c",
            "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
            "severity": "中程度",
            "subcategory": "セッション ホスト",
            "text": "セッション・ホストに使用する管理対象ディスクのタイプを決定する"
        }
    ],
    "metadata": {
        "name": "Azure Virtual Desktop Review",
        "state": "GA"
    },
    "severities": [
        {
            "name": "高い"
        },
        {
            "name": "中程度"
        },
        {
            "name": "低い"
        }
    ],
    "status": [
        {
            "description": "このチェックはまだ確認されていません",
            "name": "未確認"
        },
        {
            "description": "このチェックに関連付けられているアクションアイテムがあります",
            "name": "開ける"
        },
        {
            "description": "このチェックは検証済みであり、それ以上のアクションアイテムは関連付けられていません",
            "name": "達成"
        },
        {
            "description": "推奨事項は理解されていますが、現在の要件では必要ありません",
            "name": "必須ではありません"
        },
        {
            "description": "現在のデザインには適用できません",
            "name": "該当なし"
        }
    ]
}
checklists/avd_checklist.es.json METASEP
{
    "$schema": "checklist.schema.json",
    "categories": [
        {
            "name": "Fundación"
        },
        {
            "name": "Identidad"
        },
        {
            "name": "Gestión de redes"
        },
        {
            "name": "Calcular"
        },
        {
            "name": "Almacenamiento"
        },
        {
            "name": "Seguridad"
        },
        {
            "name": "Monitoreo y Gestión"
        },
        {
            "name": "BC/DR"
        }
    ],
    "items": [
        {
            "category": "BC/DR",
            "description": "El plan de control AVD no ofrece un acuerdo de nivel de servicio respaldado financieramente. Nos esforzamos por lograr una disponibilidad mínima del 99,9 % para las direcciones URL del servicio Windows Virtual Desktop. La disponibilidad de las máquinas virtuales host de sesión en su suscripción está cubierta por el SLA de máquinas virtuales. También se debe considerar la disponibilidad de recursos/servicios dependientes y de infraestructura para satisfacer adecuadamente los requisitos globales de alta disponibilidad. ",
            "guid": "56c57ba5-9119-4bf8-b8f5-c586c7d9cdc1",
            "link": "https://azure.microsoft.com/support/legal/sla/virtual-desktop/v1_0/",
            "severity": "Alto",
            "subcategory": "Calcular",
            "text": "Determinar el SLA de alta disponibilidad esperado para aplicaciones o escritorios publicados a través de AVD"
        },
        {
            "category": "BC/DR",
            "description": "El modelo Active-Active' se puede lograr con varios grupos de hosts en diferentes regiones. No se recomienda un único grupo de hosts con máquinas virtuales de diferentes regiones. Si se van a utilizar varios grupos para los mismos usuarios, se debe resolver el problema de cómo sincronizar/replicar perfiles de usuario. FSLogix Cloud Cache podría usarse, pero debe revisarse y planificarse cuidadosamente, o los clientes pueden decidir no sincronizar / replicar en absoluto. \"Activo-pasivo\" se puede lograr mediante Azure Site Recovery (ASR) o la implementación de grupos a petición con un mecanismo automatizado.",
            "guid": "6acc076e-f9b1-441a-a989-579e76b897e7",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "Medio",
            "subcategory": "Calcular",
            "text": "Evaluar la región de recuperación ante desastres geográficos para grupos de hosts AVD"
        },
        {
            "category": "BC/DR",
            "description": "Antes de abordar la planeación y el diseño de BCDR de Windows Virtual Desktop, es importante considerar inicialmente qué aplicaciones que se consumen a través de AVD son críticas. Es posible que desee separarlas de las aplicaciones no críticas y usar un grupo de hosts independiente con un enfoque y capacidades de recuperación ante desastres diferentes.",
            "guid": "10a7da7b-e996-46e1-9d3c-4ada97cc3d13",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "Medio",
            "subcategory": "Calcular",
            "text": "Separar las aplicaciones críticas en diferentes grupos de hosts AVD"
        },
        {
            "category": "BC/DR",
            "description": "? ¿Seleccionó el nivel de resistencia adecuado para las máquinas virtuales del grupo de hosts (conjunto de disponibilidad frente a zonas de disponibilidad)? ¿Conoce las implicaciones en el SLA de alta disponibilidad y los límites de escalabilidad que vienen con AS o AZ? ? Actualmente puede implementar 399 máquinas virtuales por implementación de plantilla ARM de escritorio virtual de Windows sin conjuntos de disponibilidad o 200 máquinas virtuales por conjunto de disponibilidad. Puede aumentar el número de máquinas virtuales por implementación desactivando los conjuntos de disponibilidad en la plantilla de ARM o en la inscripción del grupo de hosts de Azure Portal. Ahora es posible implementar AZ, una AZ a la vez en este momento, necesita crear manualmente una fracción de máquinas virtuales en cada AZ deseada. ",
            "guid": "25ab225c-6f4e-4168-9fdd-dea8a4b7cdeb",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/faq",
            "severity": "Alto",
            "subcategory": "Calcular",
            "text": "Planeación de la mejor opción de resistencia para la implementación del grupo de hosts AVD"
        },
        {
            "category": "BC/DR",
            "description": "Copia de seguridad de Azure también se puede usar para proteger máquinas virtuales del grupo de hosts, esta práctica es compatible, incluso si las máquinas virtuales del grupo de hosts no tienen estado. Esta opción podría considerarse para grupos de hosts personales. ",
            "guid": "4c61fc3f-c14e-4ea6-b69e-8d9a3eec218e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "Medio",
            "subcategory": "Calcular",
            "text": "Evaluar el requisito de copia de seguridad de los hosts de sesión AVD"
        },
        {
            "category": "BC/DR",
            "description": "Si se usan imágenes personalizadas para implementar máquinas virtuales de grupos de hosts AVD, es importante asegurarse de que esos artefactos estén disponibles en todas las regiones, incluso si se trata de un desastre importante. El servicio Galería de proceso de Azure se puede usar para replicar imágenes en todas las regiones donde se implementa un grupo de hosts, con almacenamiento redundante y en varias copias.",
            "guid": "dd2e0d5d-771d-441e-9610-cc57b4a4a141",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/shared-images-portal",
            "severity": "Bajo",
            "subcategory": "Dependencias",
            "text": "Planeación de la disponibilidad de Golden Image entre regiones"
        },
        {
            "category": "BC/DR",
            "description": "Si los usuarios de la infraestructura AVD necesitan acceso a recursos locales, la alta disponibilidad de la infraestructura de red necesaria para conectarse también es crítica y debe tenerse en cuenta. Es necesario evaluar la resiliencia de la infraestructura de autenticación. Los aspectos de BCDR para aplicaciones dependientes y otros recursos deben considerarse para garantizar la disponibilidad en la ubicación secundaria de DR.",
            "guid": "fd339489-8c12-488b-9c6a-57cfb644451e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "Medio",
            "subcategory": "Dependencias",
            "text": "Evaluar las dependencias de infraestructura y aplicaciones "
        },
        {
            "category": "BC/DR",
            "description": "No todos los datos dentro de los perfiles de usuario de FSLogix pueden merecer protección contra desastres. Además, si se utiliza almacenamiento externo, por ejemplo, OneDrive o servidores de archivos/recursos compartidos, lo que queda en el perfil FSLogix es mínimo y podría perderse en algunas circunstancias extremas. En otros casos, los datos dentro del perfil se pueden reconstruir desde otros almacenamientos (por ejemplo, la Bandeja de entrada de Outlook en modo caché). ",
            "guid": "687ab077-adb5-49e5-a960-3334fdf8cc23",
            "link": "https://learn.microsoft.com/fslogix/manage-profile-content-cncpt",
            "severity": "Medio",
            "subcategory": "Almacenamiento",
            "text": "Evaluar qué datos deben protegerse dentro de los contenedores de perfil y oficina"
        },
        {
            "category": "BC/DR",
            "description": "Prevenir la pérdida de datos para los datos críticos del usuario es importante, el primer paso es evaluar qué datos deben guardarse y protegerse. Si usa OneDrive u otro almacenamiento externo, es posible que no sea necesario guardar los datos del perfil de usuario o de los contenedores de Office. Se debe considerar un mecanismo apropiado para proporcionar protección a los datos críticos del usuario. El servicio Copia de seguridad de Azure se puede usar para proteger los datos de contenedores de Office y perfiles cuando se almacenan en los niveles Standard y Premium de Azure Files. Azure NetApp Files Snapshots and Policies se puede usar para Azure NetApp Files (todos los niveles).",
            "guid": "fc4972cc-3cd2-45bf-a707-6e9eab4bed32",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "Medio",
            "subcategory": "Almacenamiento",
            "text": "Crear una estrategia de protección de copia de seguridad para contenedores de perfiles y Office"
        },
        {
            "category": "BC/DR",
            "description": "En AVD, se pueden usar múltiples mecanismos y estrategias de replicación para los datos de usuario que residen en contenedores FSLogix: Patrón de perfil #1: ¿Mecanismos de replicación de almacenamiento nativos de Azure, por ejemplo, replicación GRS estándar de Azure Files, replicación entre regiones de Azure NetApp Files o Azure Files Sync para servidores de archivos basados en máquinas virtuales? Se recomienda usar el almacenamiento replicado en zona (ZRS) o el almacenamiento con replicación geográfica (GRS) para Azure Files. LRS con resistencia solo local se puede usar si no se requiere protección de zona/región. NOTA: Azure Files Share Standard es LRS/ZRS/GRS, pero con la compatibilidad grande de 100 TB habilitada, solo se admiten LRS/ZRS. ? Patrón de perfil # 2: FSLogix Cloud Cache está integrado en un mecanismo automático para replicar contenedores entre diferentes (hasta 4) cuentas de almacenamiento. Cloud Cache solo debe usarse cuando:? Perfil de usuario o contenedores de Office disponibilidad de datos requeridos SLA de alta disponibilidad es crítico y debe ser resistente a errores de región. La opción de almacenamiento seleccionada no puede satisfacer los requisitos de BCDR. Por ejemplo, con el nivel Premium de Azure File Share o Azure File Share Standard con compatibilidad con archivos grandes habilitada, GRS no está disponible. Cuando se requiere replicación entre almacenamiento de información dispares. Patrón de perfil # 3: Solo configure la recuperación geográfica ante desastres para los datos de la aplicación y no para los contenedores de datos / perfiles del usuario: almacene los datos importantes de la aplicación en almacenamientos separados, como OneDrive u otro almacenamiento externo con su propio mecanismo de DR incorporado.",
            "guid": "9f7547c1-746d-4c56-868a-714435bd09dd",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery",
            "severity": "Medio",
            "subcategory": "Almacenamiento",
            "text": "Evaluar los requerimientos de replicación y la resiliencia del almacenamiento de almacenamiento de información de contenedores de perfiles para fines de BCDR"
        },
        {
            "category": "BC/DR",
            "description": "Recuperación ante desastres geográfica: Azure NetApp Files es esencialmente LRS (almacenamiento replicado localmente), entonces necesita diseñar algo más si desea la replicación entre regiones. La recomendación para la multiregión en este momento es Cloud Sync de NetApp, replicando en otra región de Azure (y NetApp Volume). Copia de seguridad: Las copias de seguridad son manejadas por instantáneas, pero no son automáticas, deben programarse mediante políticas. https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-manage-snapshots. Hay un límite máximo de instantáneas (255) por volumen, como se documenta aquí: https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-resource-limits.",
            "guid": "23429db7-2281-4376-85cc-57b4a4b18142",
            "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-manage-snapshots",
            "severity": "Medio",
            "subcategory": "Almacenamiento",
            "text": "Revisión de la estrategia de recuperación ante desastres de Azure NetApp Files"
        },
        {
            "category": "BC/DR",
            "description": "Recuperación ante desastres geográfica: GRS para Azure Files solo está disponible con SKU estándar y sin compatibilidad con recursos compartidos grandes, por lo que no es adecuado en la mayoría de los escenarios de clientes. Si se requiere replicación geográfica, al usar Azure File Share Premium, se debe evaluar la replicación con FSLogix Cloud Cache o solo se debe considerar la resistencia de la zona de disponibilidad (AZ) \"en la región\". Copia de seguridad: Azure Backup es totalmente compatible con Azure File Share todos los SKU y es la solución recomendada para proteger los contenedores de perfiles. Si usa OneDrive u otro almacenamiento externo, es posible que no sea necesario guardar los datos del perfil de usuario o de los contenedores de Office.",
            "guid": "3d4f3537-c134-46dc-9602-7a71efe1bd05",
            "link": "https://learn.microsoft.com/azure/backup/backup-afs",
            "severity": "Medio",
            "subcategory": "Almacenamiento",
            "text": "Revisión de la estrategia de recuperación ante desastres de Azure Files"
        },
        {
            "category": "Calcular",
            "description": "Las aplicaciones se pueden preinstalar en la(s) imagen(es) dorada, se pueden adjuntar utilizando la función MSIX & AppAttach o distribuyendo a hosts después de la implementación del grupo utilizando métodos tradicionales de distribución de SW.",
            "guid": "86ba2802-1459-4014-95d3-8e5309ccbd97",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-customize-master-image",
            "severity": "Alto",
            "subcategory": "Imagen/es dorada/s",
            "text": "Determinar cómo se implementarán las aplicaciones en los grupos de hosts AVD"
        },
        {
            "category": "Calcular",
            "description": "¿Usarán el enmascaramiento de aplicaciones fslogix que se prestaría a una sola imagen, o múltiples imágenes con diferentes aplicaciones incorporadas: ¿qué es lo que requiere que se use más de una imagen?",
            "guid": "9266bcca-274f-4aa1-abf3-9d95d44c7c89",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace",
            "severity": "Medio",
            "subcategory": "Imagen/es dorada/s",
            "text": "Estimar el número de imágenes doradas que se requerirán"
        },
        {
            "category": "Calcular",
            "description": "Determine qué SO invitado se usará para implementar cada grupo de hosts: Windows 10 frente a Windows Server, Marketplace frente a imágenes personalizadas",
            "guid": "19ca1f6d-5315-4ae5-84ba-34d4585e2213",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "Medio",
            "subcategory": "Imagen/es dorada/s",
            "text": "Determinar qué imagenes del sistema operativo usará para la implementación del grupo de hosts"
        },
        {
            "category": "Calcular",
            "description": "Si no existe nada, considere la posibilidad de usar Azure Image Builder para automatizar el proceso de compilación. ",
            "guid": "9bd7bb01-2f7b-495e-86e1-54e2aa359282",
            "link": "https://learn.microsoft.com/azure/virtual-machines/image-builder-overview",
            "severity": "Bajo",
            "subcategory": "Imagen/es dorada/s",
            "text": "Si se va a utilizar una imagen personalizada, determine si existe un proceso de compilación automatizado."
        },
        {
            "category": "Calcular",
            "description": "Evalúe la Galería de proceso de Azure.",
            "guid": "5a2adb2c-3e23-426b-b225-ca44e1696fdd",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/shared-image-galleries",
            "severity": "Bajo",
            "subcategory": "Imagen/es dorada/s",
            "text": "Si se va a utilizar una imagen personalizada, ¿existe un plan para organizar y gestionar el ciclo de vida de las imágenes?"
        },
        {
            "category": "Calcular",
            "description": "Hay algunas mejores prácticas y recomendaciones conocidas para la personalización de la imagen dorada, asegúrese de consultar el artículo al que se hace referencia. ",
            "guid": "deace4cb-1dec-44c6-90c3-fc14eebb36a3",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-customize-master-image",
            "severity": "Medio",
            "subcategory": "Imagen/es dorada/s",
            "text": "Si se va a utilizar una imagen personalizada, consulte las prácticas recomendadas para AVD sobre cómo crear una imagen maestra"
        },
        {
            "category": "Calcular",
            "description": "Este conjunto de herramientas se ha creado para aplicar automáticamente la configuración a la que se hace referencia en las notas del producto 'Optimización de Windows 10, versión 2004 para un rol de infraestructura de escritorio virtual (VDI)': https://learn.microsoft.com/windows-server/remote/remote-desktop-services/rds-vdi-recommendations-2004. Se debe considerar el uso de la herramienta y / o las optimizaciones mencionadas en el documento técnico. ",
            "guid": "829e3fec-2183-4687-a017-7a2b5945bda4",
            "link": "https://github.com/The-Virtual-Desktop-Team/Virtual-Desktop-Optimization-Tool",
            "severity": "Medio",
            "subcategory": "Imagen/es dorada/s",
            "text": "Evaluar el uso de Virtual-Desktop-Optimization-Tool"
        },
        {
            "category": "Calcular",
            "description": "Determine si ya existe una herramienta de administración de configuración para administrar la configuración de la máquina virtual del grupo de hosts después de la implementación inicial, por ejemplo, SCCM, MEM/Intune, GPO, soluciones de 3rd-party.",
            "guid": "3334fdf9-1c23-4418-8b65-285269440b4b",
            "link": "https://learn.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop-multi-session",
            "severity": "Bajo",
            "subcategory": "Imagen/es dorada/s",
            "text": "Planificar/evaluar la estrategia de gestión de la configuración del host de sesión AVD"
        },
        {
            "category": "Calcular",
            "description": "Revise el artículo proporcionado y marque 'Redirección de carpetas conocidas' y 'Archivos a petición' Las características de OneDrive deben considerarse y, finalmente, adoptarse.",
            "guid": "e3d3e084-4276-4d4b-bc01-5bcf219e4a1e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/install-office-on-AVD-master-image",
            "severity": "Medio",
            "subcategory": "Imagen/es dorada/s",
            "text": "Determinar si Microsoft OneDrive formará parte de la implementación de AVD"
        },
        {
            "category": "Calcular",
            "description": "Asegúrese de revisar este artículo y usar la versión más reciente, revisar y evaluar las exclusiones de Teams para reducir el tamaño del perfil.",
            "guid": "b5887953-5d22-4788-9d30-b66c67be5951",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/teams-on-AVD",
            "severity": "Medio",
            "subcategory": "Imagen/es dorada/s",
            "text": "Determinar si Microsoft Teams formará parte de la implementación de AVD"
        },
        {
            "category": "Calcular",
            "description": "Se recomienda encarecidamente utilizar cuentas de almacenamiento/recursos compartidos independientes para almacenar paquetes MSIX. Si es necesario, el almacenamiento puede escalar horizontalmente de forma independiente y no verse afectado por las actividades de E/S del perfil. Azure ofrece varias opciones de almacenamiento que se pueden usar para la conexión de aplicaciones MISX. Se recomienda usar Azure Files o Azure NetApp Files, ya que estas opciones ofrecen el mejor valor entre costo y gastos generales de administración. ",
            "guid": "90083845-c587-4cb3-a1ec-16a1d076ef9f",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-file-share",
            "severity": "Alto",
            "subcategory": "MSIX y AppAttach",
            "text": "No use la misma cuenta/recurso compartido de almacenamiento que los contenedores de perfil/Office "
        },
        {
            "category": "Calcular",
            "description": "En el artículo al que se hace referencia, informamos pocas pero importantes consideraciones de rendimiento para el uso de MSIX en el contexto AVD, asegúrese de revisarlo cuidadosamente.",
            "guid": "241addce-5793-477b-adb3-751ab2ac1fad",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-file-share",
            "severity": "Alto",
            "subcategory": "MSIX y AppAttach",
            "text": "Revisar las consideraciones de rendimiento para MSIX"
        },
        {
            "category": "Calcular",
            "description": "La conexión de la aplicación MSIX requiere permisos de solo lectura para acceder al recurso compartido de archivos. Si va a almacenar las aplicaciones MSIX en Azure Files, deberá asignar a todas las máquinas virtuales host de sesión permisos de control de acceso basado en roles (RBAC) de cuentas de almacenamiento y permisos del sistema de archivos de nueva tecnología (NTFS) en el recurso compartido.",
            "guid": "66e15d4d-5a2a-4db2-a3e2-326bf225ca41",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-file-share",
            "severity": "Medio",
            "subcategory": "MSIX y AppAttach",
            "text": "Comprobar los permisos de host de sesión adecuados para el recurso compartido MSIX"
        },
        {
            "category": "Calcular",
            "description": "El proveedor de software de 3rd party debe proporcionar un paquete MSIX, no se recomienda que el cliente intente el procedimiento de conversión sin el soporte adecuado del propietario de la aplicación.",
            "guid": "bd362caa-ab79-4b19-adab-81932c9fc9d1",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-faq",
            "severity": "Medio",
            "subcategory": "MSIX y AppAttach",
            "text": "Paquetes MSIX para aplicaciones de 3ª parte"
        },
        {
            "category": "Calcular",
            "description": "La aplicación MSIX adjunta no admite la actualización automática para aplicaciones MSIX, por lo que debe deshabilitarse.",
            "guid": "bb88037f-5e6b-4fbb-aed5-03547cc447e8",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-faq",
            "severity": "Bajo",
            "subcategory": "MSIX y AppAttach",
            "text": "Deshabilitar la actualización automática para paquetes MSIX"
        },
        {
            "category": "Calcular",
            "description": "Para aprovechar MSIX & App Attach, la imagen del sistema operativo invitado para el grupo de hosts AVD debe ser Windows 10 Enterprise o Windows 10 Enterprise Multi-session, versión 2004 o posterior.",
            "guid": "26128a71-f0f1-4cac-9d9e-f1d5e832e42e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-faq",
            "severity": "Medio",
            "subcategory": "MSIX y AppAttach",
            "text": "Revisar la compatibilidad con sistemas operativos"
        },
        {
            "category": "Calcular",
            "description": "Una vez seleccionada la SKU de máquina virtual que se usará para la implementación del grupo de hosts, se recomienda usar el tipo Gen2 de la SKU para una mayor seguridad y capacidades mejoradas.",
            "guid": "e4633254-3185-40a1-b120-bd563a1c8e9d",
            "link": "https://learn.microsoft.com/azure/virtual-machines/generation-2",
            "severity": "Medio",
            "subcategory": "Host de sesión",
            "text": "Evaluar el uso de la máquina virtual Gen2 para la implementación del grupo de hosts"
        },
        {
            "category": "Fundación",
            "description": "Compartido/Agrupado o Dedicado/Personal",
            "guid": "8468c55a-775c-46ee-a5b8-6ad8844ce3b2",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace",
            "severity": "Alto",
            "subcategory": "Planificación de la capacidad",
            "text": "Determinación del tipo de grupo de hosts que se va a usar"
        },
        {
            "category": "Fundación",
            "description": "Confirme que la diferencia entre asignación automática y directa se entiende bien y que la opción seleccionada es apropiada para el escenario en cuestión.",
            "guid": "b38b875b-a1cf-4204-a901-3a5d3ce474db",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type",
            "severity": "Medio",
            "subcategory": "Planificación de la capacidad",
            "text": "Para el tipo de grupo de hosts personales, decida el tipo de asignación"
        },
        {
            "category": "Fundación",
            "description": "Compruebe cuál usar y las opciones disponibles, tenga en cuenta que si se utilizará el escalado automático, lo establece en amplitud primero. ",
            "guid": "cbd8682a-6abc-4a2a-9fda-1dbf3dc95d48",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/host-pool-load-balancing",
            "severity": "Medio",
            "subcategory": "Planificación de la capacidad",
            "text": "Para Tipo de grupo de hosts agrupados, decida el método de equilibrio de carga"
        },
        {
            "category": "Fundación",
            "description": "Según sus criterios de selección, ¿cuántos grupos de anfitriones necesitaría? Deberías considerar tener varios si:? ¿Múltiples imágenes del sistema operativo? ¿Varias regiones? ¿Se requiere un HW diferente? ¿Diferentes tipos de grupo de hosts (compartido vs. personal)? ¿Diferentes requisitos de usuario y SLA (usuarios principales, ejecutivos, trabajadores de oficina frente a desarrolladores, etc.)? Diferentes configuraciones de RDP (aplicadas a nivel de grupo de hosts), consulte https://learn.microsoft.com/azure/virtual-desktop/customize-rdp-properties? Número requerido de máquinas virtuales en el grupo de hosts que supera las capacidades máximas",
            "guid": "c7c791dc-a1f6-4d56-999e-558b937d4985",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/environment-setup",
            "severity": "Alto",
            "subcategory": "Planificación de la capacidad",
            "text": "Estimar el número de grupos de hosts diferentes para implementar "
        },
        {
            "category": "Fundación",
            "description": "Utilice el enlace proporcionado para establecer un punto de partida para la decisión de SKU y, a continuación, valide mediante una prueba de rendimiento. Asegúrese de seleccionar un mínimo de 4 núcleos para producción por host de sesión (multisesión)",
            "guid": "e1112dbd-7ba0-412e-9b94-ef6e047d2ea2",
            "link": "https://learn.microsoft.com/windows-server/remote/remote-desktop-services/virtual-machine-recs",
            "severity": "Medio",
            "subcategory": "Planificación de la capacidad",
            "text": "Ejecute una prueba de rendimiento de carga de trabajo para determinar el mejor SKU de máquina virtual de Azure y el tamaño que se debe usar (determinar el número de hosts por grupo)"
        },
        {
            "category": "Fundación",
            "description": "Es fundamental comprobar la capacidad de AVD y los límites informados en el artículo al que se hace referencia. ",
            "guid": "992b1cd6-d2f5-44b2-a769-e3a691e8838a",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop",
            "severity": "Alto",
            "subcategory": "Planificación de la capacidad",
            "text": "Comprobar los límites de escalabilidad de AVD para el entorno"
        },
        {
            "category": "Fundación",
            "description": "Los grupos de hosts con GPU requieren una configuración especial, asegúrese de revisar el artículo al que se hace referencia. ",
            "guid": "c936667e-13c0-4056-94b1-e945a459837e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/configure-vm-gpu",
            "severity": "Medio",
            "subcategory": "Planificación de la capacidad",
            "text": "Determinar si los hosts de sesión requerirán GPU"
        },
        {
            "category": "Fundación",
            "description": "Siempre que sea posible, se recomienda aprovechar las SKU de VM con la función de red acelerada. Hoy en día, los sistemas operativos Windows Server son compatibles (consulte la lista en el artículo), en el futuro el sistema operativo cliente de Windows también puede incluirse. ",
            "guid": "b47a393a-0803-4272-a479-8b1578b219a4",
            "link": "https://learn.microsoft.com/azure/virtual-network/create-vm-accelerated-networking-powershell",
            "severity": "Bajo",
            "subcategory": "Planificación de la capacidad",
            "text": "Se recomienda usar SKU de máquina virtual capaces de aprovechar la característica de redes aceleradas en Azure."
        },
        {
            "category": "Fundación",
            "description": "Para una planificación e implementación adecuadas, es importante evaluar el número máximo de usuarios y el promedio de sesiones simultáneas. ",
            "guid": "bb91a33d-90ca-4e2c-a881-3706f7c0cb9f",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/faq",
            "severity": "Medio",
            "subcategory": "Clientes y Usuarios",
            "text": "Evaluar cuántos usuarios se conectarán a AVD y desde qué regiones"
        },
        {
            "category": "Fundación",
            "description": "Es posible que se requieran varios grupos de hosts para admitir diferentes conjuntos de usuarios, se recomienda estimar cuántos serán necesarios. ",
            "guid": "a1cf2049-9013-4a5d-9ce4-74dbcbd8682a",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/environment-setup",
            "severity": "Medio",
            "subcategory": "Clientes y Usuarios",
            "text": "Determinar si todos los usuarios tendrán el mismo conjunto de aplicaciones y/o diferentes configuraciones de grupo de hosts y/o imágenes de sistema operativo"
        },
        {
            "category": "Fundación",
            "description": "Se deben evaluar y revisar las dependencias de recursos externos al grupo de AVD, por ejemplo, Active Directory, recursos compartidos de archivos externos u otro almacenamiento, servicios y recursos locales, componentes de infraestructura de red como VPN y/o Express Route, servicios externos y componentes de 3rd-party. Para todos estos recursos, es necesario evaluar la latencia del grupo de hosts AVD y considerar la conectividad. Además, las consideraciones de BCDR también deben aplicarse a estas dependencias.",
            "guid": "6abca2a4-fda1-4dbf-9dc9-5d48c7c791dc",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "Bajo",
            "subcategory": "Clientes y Usuarios",
            "text": "Evaluar las dependencias externas para cada grupo de hosts"
        },
        {
            "category": "Fundación",
            "description": "Revise las limitaciones de cada cliente y compare múltiples opciones cuando sea posible.",
            "guid": "a1f6d565-99e5-458b-a37d-4985e1112dbd",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/connect-windows-7-10",
            "severity": "Medio",
            "subcategory": "Clientes y Usuarios",
            "text": "Revisar el sistema operativo del cliente utilizado y el tipo de cliente AVD"
        },
        {
            "category": "Fundación",
            "description": "Los clientes que tienen la licencia adecuada para ejecutar cargas de trabajo de Windows Virtual Desktop son elegibles para aplicar una licencia de Windows a sus máquinas virtuales host de sesión y ejecutarlas sin pagar por otra licencia.",
            "guid": "7ba012e7-b94e-4f6e-847d-2ea2992b1cd6",
            "link": "https://azure.microsoft.com/pricing/details/virtual-desktop/",
            "severity": "Bajo",
            "subcategory": "Clientes y Usuarios",
            "text": "Comprobar los requisitos de licencia"
        },
        {
            "category": "Fundación",
            "description": "Dependiendo de las ubicaciones de los usuarios y la implementación de la región AVD, los usuarios pueden tener una experiencia no óptima, por lo tanto, es importante probar lo antes posible en un entorno PoC pequeño. ",
            "guid": "d2f54b29-769e-43a6-a1e8-838ac936667e",
            "link": "https://azure.microsoft.com/services/virtual-desktop/assessment/",
            "severity": "Alto",
            "subcategory": "Clientes y Usuarios",
            "text": "Ejecute una prueba de concepto para probar la experiencia del usuario de extremo a extremo y verificar el impacto causado por la latencia de la red"
        },
        {
            "category": "Fundación",
            "description": "Determine si a los usuarios se les ofrecerán escritorios completos y/o grupos de aplicaciones remotas. ",
            "guid": "13c00567-4b1e-4945-a459-837ee7ad6c6d",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/manage-app-groups",
            "severity": "Bajo",
            "subcategory": "Clientes y Usuarios",
            "text": "Determinar si los usuarios accederán a AVD utilizando escritorios completos y/o aplicaciones remotas "
        },
        {
            "category": "Fundación",
            "description": "Actualmente, la configuración de RDP solo se puede configurar en el nivel del grupo de hosts, no por usuario o grupo.",
            "guid": "3b365a5c-7acb-4e48-abe5-4cd79f2e8776",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/customize-rdp-properties",
            "severity": "Bajo",
            "subcategory": "Clientes y Usuarios",
            "text": "¿Todos los usuarios tendrán la misma configuración de RDP? "
        },
        {
            "category": "Fundación",
            "description": "RDP Shortpath para redes administradas es una característica de Azure Virtual Desktop que establece un transporte directo basado en UDP entre el cliente de Escritorio remoto y el host de sesión. La eliminación del relé adicional reduce el tiempo de ida y vuelta, lo que mejora la experiencia del usuario con aplicaciones y métodos de entrada sensibles a la latencia. Para admitir RDP Shortpath, el cliente de Azure Virtual Desktop necesita una línea de visión directa al host de sesión y debe ejecutar Windows 10 o Windows 7 y tener instalado el cliente de escritorio de Windows.",
            "guid": "b2074747-d01a-4f61-b1aa-92ad793d9ff4",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/shortpath",
            "severity": "Medio",
            "subcategory": "Clientes y Usuarios",
            "text": "Evaluar RDP ShortPath para clientes que se conectan desde redes internas administradas"
        },
        {
            "category": "Fundación",
            "description": "AVD es un servicio no regional, los grupos de hosts se pueden crear en cualquier región, la redirección automática desde el front-end más cercano se realizará automáticamente.",
            "guid": "42e52f47-21d9-428c-8b1b-d521e44a29a9",
            "link": "https://azure.microsoft.com/global-infrastructure/services/?products=virtual-desktop",
            "severity": "Alto",
            "subcategory": "General",
            "text": "Determine en qué región o grupos de hosts AVD de Azure se implementarán."
        },
        {
            "category": "Fundación",
            "description": "Si es necesario conectarse al entorno local, evalúe la opción de conectividad actual o planee la conectividad necesaria. ",
            "guid": "dd399cfd-7b28-4dc8-9555-6202bfe4563b",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/",
            "severity": "Medio",
            "subcategory": "General",
            "text": "Determinar si se requiere conectividad híbrida para conectarse al entorno local"
        },
        {
            "category": "Fundación",
            "description": "Ejecute la herramienta 'Windows Virtual Desktop Experience Estimator' para seleccionar la mejor región de Azure para implementar grupos de hosts. Más allá de la latencia de 150 ms, la experiencia del usuario puede no ser óptima. ",
            "guid": "0d834a34-8b26-43e6-bc60-512a26498f6d",
            "link": "https://azure.microsoft.com/services/virtual-desktop/assessment/",
            "severity": "Alto",
            "subcategory": "General",
            "text": "¿Evaluó la latencia entre la ubicación de los usuarios y la infraestructura de Azure AVD?"
        },
        {
            "category": "Fundación",
            "description": "AVD almacena metadatos solo para ejecutar el servicio en ubicaciones geográficas específicas, determinar qué está disponible hoy y, si es adecuado, según los requisitos del cliente. ",
            "guid": "bad37ead-53cc-47ce-8d7a-aab3571449ab",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/data-locations",
            "severity": "Medio",
            "subcategory": "General",
            "text": "Determinar la ubicación de metadatos para el servicio AVD"
        },
        {
            "category": "Fundación",
            "description": "Compruebe si hay SKU de máquina virtual específicas, especialmente si necesita GPU o SKU de especificaciones altas y, finalmente, la disponibilidad de Azure NetApp Files si se usa. ",
            "guid": "8053d89e-89dc-47b3-9be2-a1a27f7a9e91",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
            "severity": "Bajo",
            "subcategory": "General",
            "text": "Comprobar las cuotas y la disponibilidad de Azure para tamaños de máquina virtual específicos en las regiones seleccionadas"
        },
        {
            "category": "Fundación",
            "description": "Consulte la sección BCDR para obtener más detalles.",
            "guid": "be1f38ce-f398-412b-b463-cbbac89c199d",
            "link": "https://learn.microsoft.com/azure/availability-zones/az-region",
            "severity": "Medio",
            "subcategory": "General",
            "text": "Comprobar la disponibilidad de la zona de disponibilidad (AZ) en la región seleccionada"
        },
        {
            "category": "Identidad",
            "description": "Se recomiendan los controladores de dominio de AD en Azure para reducir la latencia de los usuarios que inician sesión en hosts de sesión de AVD y, finalmente, para la integración de Azure NetApp Files y AD. ADC debe poder comunicarse con los controladores de dominio para TODOS los dominios secundarios. Como alternativa, se debe usar la conectividad local para llegar a los controladores de dominio de AD. ",
            "guid": "c14aea7e-65e8-4d9a-9aec-218e6436b073",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain",
            "severity": "Medio",
            "subcategory": "Active Directory",
            "text": "Creación de al menos dos controladores de dominio (DC) de Active Directory en un entorno de red virtual de Azure cerca del grupo de hosts AVD"
        },
        {
            "category": "Identidad",
            "description": "Se recomienda crear una unidad organizativa independiente por grupo de hosts en una jerarquía de unidades organizativas independiente. Estas unidades organizativas contendrán cuentas de máquina de hosts de sesión AVD. ",
            "guid": "6db55f57-9603-4334-adf9-cc23418db612",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace",
            "severity": "Bajo",
            "subcategory": "Active Directory",
            "text": "Crear una unidad organizativa específica en Active Directory para cada grupo de hosts"
        },
        {
            "category": "Identidad",
            "description": "Revise cuidadosamente y, finalmente, bloquee o filtre la herencia de GPO a las unidades organizativas que contienen grupos de hosts AVD. ",
            "guid": "7126504b-b47a-4393-a080-327294798b15",
            "link": "https://learn.microsoft.com/previous-versions/windows/desktop/Policy/group-policy-hierarchy",
            "severity": "Medio",
            "subcategory": "Active Directory",
            "text": "Revisar el GPO de dominio que se aplicará a la unidad organizativa y que afecta a las funcionalidades de la máquina virtual del grupo de hosts"
        },
        {
            "category": "Identidad",
            "description": "Se recomienda tener una cuenta dedicada específica con permisos específicos y sin la limitación predeterminada de 10 uniones. ",
            "guid": "347dc560-28a7-41ff-b1cd-15dd2f0d5e77",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace",
            "severity": "Medio",
            "subcategory": "Active Directory",
            "text": "Crear una cuenta de usuario dedicada con solo permisos para unir la máquina virtual al dominio"
        },
        {
            "category": "Identidad",
            "description": "Evite conceder acceso por usuario, en su lugar use grupos de AD y replíquelos con ADC en Azure AD. ",
            "guid": "2d41e361-1cc5-47b4-a4b1-410d43958a8c",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/manage-app-groups",
            "severity": "Medio",
            "subcategory": "Active Directory",
            "text": "Crear un grupo de usuarios de dominio para cada conjunto de usuarios a los que se concederá acceso a cada grupo de aplicaciones del grupo de servidores host (DAG o RAG)"
        },
        {
            "category": "Identidad",
            "description": "Como parte del procedimiento para integrar el recurso compartido de archivos de Azure y la autenticación de Active Directory, se creará una cuenta de AD para representar la cuenta de almacenamiento (recurso compartido de archivos). Puede elegir registrarse como cuenta de equipo o cuenta de inicio de sesión de servicio, consulte Preguntas frecuentes para obtener más información. Para las cuentas de equipo, hay una antigüedad de caducidad de contraseña predeterminada establecida en AD en 30 días. Del mismo modo, la cuenta de inicio de sesión del servicio puede tener una antigüedad de caducidad de contraseña predeterminada establecida en el dominio de AD o la unidad organizativa (OU). Para ambos tipos de cuenta, le recomendamos que compruebe la antigüedad de caducidad de la contraseña configurada en su entorno de AD y planee actualizar la contraseña de la identidad de la cuenta de almacenamiento de la cuenta de AD antes de la antigüedad máxima de la contraseña. Puede considerar la posibilidad de crear una nueva unidad organizativa (OU) de AD en AD y deshabilitar la directiva de caducidad de contraseñas en cuentas de equipo o cuentas de inicio de sesión de servicio en consecuencia.",
            "guid": "2289b3d6-b57c-4fc6-9546-1e1a3e3453a3",
            "link": "https://learn.microsoft.com/azure/storage/files/storage-files-identity-ad-ds-enable",
            "severity": "Bajo",
            "subcategory": "Active Directory",
            "text": "Revisión de la directiva de expiración de contraseñas de la organización para las cuentas usadas por la integración de Azure Files AD"
        },
        {
            "category": "Identidad",
            "description": "Una suscripción de Azure debe ser primaria al mismo inquilino de Azure AD, que contiene una red virtual que contiene o está conectada a la instancia de Windows Server Active Directory o Azure AD DS.",
            "guid": "6ceb5443-5125-4922-9442-93bb628537a5",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "Alto",
            "subcategory": "Requisitos",
            "text": "Un inquilino de Azure Active Directory debe estar disponible con al menos una suscripción vinculada"
        },
        {
            "category": "Identidad",
            "description": "Puede configurarlo mediante Azure AD Connect (para organizaciones híbridas) o Servicios de dominio de Azure AD (para organizaciones híbridas o en la nube).",
            "guid": "5119bf8e-8f58-4542-a7d9-cec166cd072a",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "Alto",
            "subcategory": "Requisitos",
            "text": "Un bosque/dominio de Windows Server Active Directory está sincronizado con Azure Active Directory"
        },
        {
            "category": "Identidad",
            "description": "(1) El usuario debe provenir del mismo Active Directory que está conectado a Azure AD. Windows Virtual Desktop no admite cuentas B2B o MSA. (2) El UPN que use para suscribirse a Windows Virtual Desktop debe existir en el dominio de Active Directory al que está unida la máquina virtual.",
            "guid": "f9b141a8-98a5-435e-9378-97e71ca7da7b",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "Medio",
            "subcategory": "Requisitos",
            "text": "Compruebe los requisitos de la cuenta de usuario para conectarse a Windows Virtual Desktop"
        },
        {
            "category": "Identidad",
            "description": "Las máquinas virtuales deben estar unidas a un dominio estándar o híbridas a AD. Las máquinas virtuales no se pueden unir a Azure AD.",
            "guid": "ea962a15-9394-46da-a7cc-3923266b2258",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview",
            "severity": "Medio",
            "subcategory": "Requisitos",
            "text": "Compruebe los requisitos de VM para los hosts de sesión AVD que se crearán"
        },
        {
            "category": "Identidad",
            "description": "Comparación de Servicios de dominio de Active Directory autoadministrados, Azure Active Directory y Servicios de dominio de Azure Active Directory administrados",
            "guid": "6f4a1651-bddd-4ea8-a487-cdeb4861bc3b",
            "link": "https://learn.microsoft.com/azure/active-directory-domain-services/compare-identity-solutions",
            "severity": "Bajo",
            "subcategory": "Requisitos",
            "text": "Antes de usar los Servicios de dominio de Azure Active Directory (AAD-DS) para AVD, asegúrese de revisar las limitaciones. "
        },
        {
            "category": "Monitoreo y Gestión",
            "description": "La herramienta de escalado proporciona una opción de automatización de bajo costo para los clientes que desean optimizar los costos de la máquina virtual del host de sesión. Puede usar la herramienta de escalado para programar máquinas virtuales para que se inicien y detengan en función de las horas comerciales pico y fuera de pico, escalar horizontalmente máquinas virtuales en función del número de sesiones por núcleo de CPU, escalar en máquinas virtuales durante las horas de menor actividad, dejando en ejecución el número mínimo de máquinas virtuales host de sesión. Aún no está disponible para el tipo de grupo de hosts personales, se recomienda tener una configuración independiente para cada grupo de hosts. ",
            "guid": "7138b820-102c-4e16-be30-1e6e872e52e3",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-scaling-script",
            "severity": "Bajo",
            "subcategory": "Administración",
            "text": "Evaluar el requisito de la capacidad de escalado automático del grupo de hosts"
        },
        {
            "category": "Monitoreo y Gestión",
            "description": "Azure Advisor analiza las configuraciones y la telemetría para ofrecer recomendaciones personalizadas para resolver problemas comunes. Con estas recomendaciones, puede optimizar sus recursos de Azure para ofrecer confiabilidad, seguridad, excelencia operativa, rendimiento y costo.",
            "guid": "611dd68c-5a4b-4252-8e44-a59a9c2399c4",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/azure-advisor",
            "severity": "Bajo",
            "subcategory": "Administración",
            "text": "Comprobar periódicamente las recomendaciones de Azure Advisor para AVD"
        },
        {
            "category": "Monitoreo y Gestión",
            "description": "Prepare una estrategia para administrar las actualizaciones de las imágenes doradas, por ejemplo, para aplicar revisiones de seguridad y/o actualizar las aplicaciones instaladas dentro de la imagen. Azure Image Builder Service es una solución de 1ª parte para automatizar la compilación y personalización de máquinas virtuales. Las plantillas de ARM se pueden usar para crear nuevos hosts y, a continuación, retirar los antiguos: https://github.com/Azure/RDS-Templates/tree/master/ARM-AVD-templates/AddVirtualMachinesToHostPool El enfoque recomendado es crear un nuevo grupo en paralelo, más fácil de revertir, no utilizable para un grupo dedicadoRe-implementar y aumentar el número de máquinas virtuales con la plantilla ARM también es una opción viable. Los clientes también pueden querer utilizar los métodos de distribución de software existentes para actualizar la imagen sin volver a implementarla, por ejemplo, con SCCM o similar.",
            "guid": "d7b68d0c-7555-462f-8b3e-4563b4d874a7",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/image-builder-virtual-desktop",
            "severity": "Medio",
            "subcategory": "Administración",
            "text": "Planeación de una estrategia de administración de actualizaciones de imágenes doradas"
        },
        {
            "category": "Monitoreo y Gestión",
            "description": "Los clientes pueden tener varias opciones:- Microsoft Endpoint Configuration Manager, en este artículo se explica cómo configurar Microsoft Endpoint Configuration Manager para aplicar automáticamente actualizaciones a un host de Windows Virtual Desktop que ejecuta Windows 10 Enterprise multisesión: https://learn.microsoft.com/azure/virtual-desktop/configure-automatic-updates- Microsoft Intune: https://learn.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop-multi-session- Windows Server Update Services ( WSUS)- 3rd Party that supports your OS.- Azure Update Management (Azure Automation), hoy no compatible con el sistema operativo cliente: https://learn.microsoft.com/azure/automation/update-management/overview#unsupported-operating-systemsIt recomienda alejarse de una estrategia de aplicación de parches y pasar a una estrategia de recreación de imágenes si es posible. ",
            "guid": "04722da2-9c2b-41cd-922f-54b29bade3aa",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/image-builder-virtual-desktop",
            "severity": "Medio",
            "subcategory": "Administración",
            "text": "Planeación de una estrategia de actualización y revisión del host de sesión"
        },
        {
            "category": "Monitoreo y Gestión",
            "description": "Los grupos de servidores host son una colección de una o más máquinas virtuales idénticas dentro del entorno de Windows Virtual Desktop. Se recomienda encarecidamente crear un grupo de hosts de validación donde se apliquen primero las actualizaciones de servicio. Esto le permite supervisar las actualizaciones del servicio antes de que el servicio las aplique a su entorno estándar o de no validación.",
            "guid": "d1e8c38e-c936-4667-913c-005674b1e944",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-validation-host-pool",
            "severity": "Bajo",
            "subcategory": "Administración",
            "text": "Evaluar el requisito de un entorno canario de prueba AVD"
        },
        {
            "category": "Monitoreo y Gestión",
            "description": "Un grupo de hosts AVD se puede implementar de varias maneras: Portal de Azure, plantillas de ARM, herramienta CLI de Azure, PowerShell, creación manual de máquinas virtuales con token de registro, Terraform, etc. Es importante adoptar método(s) adecuados/s para soportar la implementación automática a través de herramientas de automatización y CI/CD.",
            "guid": "a459c373-e7ed-4616-83b3-65a917ecbe48",
            "link": "https://github.com/Azure/RDS-Templates/tree/master/AVD-templates",
            "severity": "Medio",
            "subcategory": "Administración",
            "text": "Determinación de la estrategia de implementación del grupo de hosts"
        },
        {
            "category": "Monitoreo y Gestión",
            "description": "Después de registrar una máquina virtual en un grupo de hosts dentro del servicio Windows Virtual Desktop, el agente actualiza regularmente el token de la máquina virtual siempre que la máquina virtual está activa. El certificado para el token de registro es válido durante 90 días. Debido a este límite de 90 días, recomendamos que las máquinas virtuales estén en línea durante 20 minutos cada 90 días para que la máquina pueda actualizar sus tokens y actualizar el agente y los componentes de la pila en paralelo.",
            "guid": "ebe54cd7-df2e-48bb-ac35-81559bb9153e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/faq",
            "severity": "Medio",
            "subcategory": "Administración",
            "text": "Activar las máquinas virtuales regularmente cada 90 días para la actualización de tokens"
        },
        {
            "category": "Monitoreo y Gestión",
            "description": "Azure Monitor para Windows Virtual Desktop es un panel basado en libros de Azure Monitor que ayuda a los profesionales de TI a comprender sus entornos de Windows Virtual Desktop. Lea el artículo al que se hace referencia para obtener información sobre cómo configurar Azure Monitor para Windows Virtual Desktop para supervisar los entornos de Windows Virtual Desktop.",
            "guid": "63cfff1c-ac59-49ef-8d5a-83dd4de36c1c",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/azure-monitor",
            "severity": "Alto",
            "subcategory": "Monitorización",
            "text": "Habilitación de la supervisión de Azure para AVD"
        },
        {
            "category": "Monitoreo y Gestión",
            "description": "Windows Virtual Desktop usa Azure Monitor y Log Analytics para la supervisión y las alertas como muchos otros servicios de Azure. Esto permite a los administradores identificar problemas a través de una única interfaz. El servicio crea registros de actividad para las acciones administrativas y de usuario.  Cada registro de actividad se divide en las siguientes categorías: Administración, Fuente, Conexiones, Registro de host, Errores, Puntos de control. ",
            "guid": "81770afb-c4c0-4e43-a186-58d2857ed671",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/diagnostics-log-analytics",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Habilitar y redirigir la configuración de diagnóstico para áreas de trabajo, grupos de hosts, grupos de aplicaciones y máquinas virtuales host al área de trabajo de Log Analytics"
        },
        {
            "category": "Monitoreo y Gestión",
            "description": "Consulte el artículo al que se hace referencia y este adicional para configurar la supervisión y las alertas adecuadas para el almacenamiento: https://learn.microsoft.com/azure/storage/files/storage-troubleshooting-files-performance. ",
            "guid": "2463cffe-179c-4599-be0d-5973dd4ce32c",
            "link": "https://learn.microsoft.com/azure/storage/files/storage-files-monitoring?tabs=azure-portal",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Crear alertas en el almacenamiento del perfil para recibir alertas en caso de uso elevado y limitación"
        },
        {
            "category": "Monitoreo y Gestión",
            "description": "Puede usar Azure Service Health para supervisar problemas de servicio y avisos de mantenimiento para Windows Virtual Desktop. Azure Service Health puede notificarle con diferentes tipos de alertas (por ejemplo, correo electrónico o SMS), ayudarle a comprender el efecto de un problema y mantenerle actualizado a medida que se resuelve el problema.",
            "guid": "18813706-f7c4-4c0d-9e51-4548d2457ed6",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-service-alerts",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Configuración del estado del servicio de Azure para alertas AVD "
        },
        {
            "category": "Gestión de redes",
            "description": "¿Qué tipo de conectividad híbrida? ¿Ruta Express, VPN, NVA?",
            "guid": "c8639648-a652-4d6c-85e5-02965388e5de",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/",
            "severity": "Medio",
            "subcategory": "Gestión de redes",
            "text": "Revisar la arquitectura de conectividad híbrida para el entorno local"
        },
        {
            "category": "Gestión de redes",
            "description": "Evalúe los requisitos de ancho de banda, asegúrese de que el ancho de banda VPN/ER sea suficiente y que la latencia sea tolerable. ",
            "guid": "d227dd14-2b06-4c21-a799-9a646f4389a7",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/",
            "severity": "Medio",
            "subcategory": "Gestión de redes",
            "text": "Evaluar qué recursos necesitarán los usuarios para acceder desde grupos de hosts AVD a las instalaciones"
        },
        {
            "category": "Gestión de redes",
            "description": "Revise o recomiende uno nuevo donde colocar grupos de hosts AVD basados en CAF (vWAN vs. Hub & Spoke)",
            "guid": "f42c78e7-8c06-4a63-a21a-4956e6a8dc4a",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/networking-options",
            "severity": "Alto",
            "subcategory": "Gestión de redes",
            "text": "Revisar la topología de red de la zona de aterrizaje para el servicio AVD"
        },
        {
            "category": "Gestión de redes",
            "description": "Asegúrese de que cada subred tenga suficiente espacio para escalar el grupo de hosts AVD. Para diferentes grupos de hosts, se recomienda usar subredes independientes si es posible. ",
            "guid": "20e27b3e-2971-41b1-952b-eee079b588de",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "Medio",
            "subcategory": "Gestión de redes",
            "text": "Evaluación de la ubicación de redes virtuales y subredes para varios grupos de servidores host"
        },
        {
            "category": "Gestión de redes",
            "description": "Hay varias opciones disponibles. Puede usar Azure Firewall o NVA Firewall, NSG y/o Proxy. NSG no puede habilitar/deshabilitar por URL, solo puertos y protocolos. El proxy debe usarse solo como configuración explícita en el navegador del usuario. Los detalles sobre el uso de Azure Firewall Premium con AVD están aquí en https://aka.ms/AVDfirewall y aquí https://learn.microsoft.com/azure/firewall/protect-windows-virtual-desktop. Asegúrese de revisar la lista completa de requisitos para el acceso a las URL de AVD.",
            "guid": "fc4972cd-3cd2-41bf-9703-6e5e6b4bed3d",
            "link": "https://aka.ms/AVDfirewall",
            "severity": "Medio",
            "subcategory": "Gestión de redes",
            "text": "¿Necesita controlar/restringir el tráfico saliente de Internet para los hosts AVD? "
        },
        {
            "category": "Gestión de redes",
            "description": "Tenga en cuenta el uso de Azure Defender Endpoint para controlar la navegación web del usuario, consulte la sección Seguridad para obtener más detalles. ",
            "guid": "73676ae4-6691-4e88-95ad-a42223e13810",
            "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/windows-virtual-desktop-support-is-now-generally-available/ba-p/2103712",
            "severity": "Medio",
            "subcategory": "Gestión de redes",
            "text": "¿Necesita controlar/restringir el tráfico saliente de Internet solo para usuarios en hosts AVD? "
        },
        {
            "category": "Gestión de redes",
            "description": "UDR personalizado se puede aplicar a la subred del grupo de hosts de AVD, por ejemplo, para redirigir a Azure Firewall o NVA. En este caso se recomienda revisar cuidadosamente para asegurarse de que se utiliza la ruta óptima para el tráfico saliente al plano de control AVD. Las etiquetas de servicio ahora se pueden usar con UDR, luego el tráfico del plano de administración de AVD se puede incluir fácilmente en la lista blanca. https://learn.microsoft.com/azure/firewall/protect-windows-virtual-desktop#host-pool-outbound-access-to-windows-virtual-desktop ",
            "guid": "523181a9-4174-4158-93ff-7ae7c6d37431",
            "link": "https://learn.microsoft.com/azure/firewall/protect-windows-virtual-desktop",
            "severity": "Bajo",
            "subcategory": "Gestión de redes",
            "text": "Revisar UDR para la subred del grupo de hosts AVD"
        },
        {
            "category": "Gestión de redes",
            "description": "Las URL necesarias para el acceso al plano de control AVD por parte de los hosts de sesión se documentan aquí: https://learn.microsoft.com/azure/virtual-desktop/safe-url-list. Hay disponible una herramienta de comprobación para verificar la conectividad desde los hosts de sesión: https://learn.microsoft.com/azure/virtual-desktop/safe-url-list#required-url-check-tool.",
            "guid": "65c7acbe-45bb-4e60-ad89-f2e87778424d",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/safe-url-list",
            "severity": "Alto",
            "subcategory": "Gestión de redes",
            "text": "Asegúrese de que los puntos finales del plano de control AVD sean accesibles"
        },
        {
            "category": "Gestión de redes",
            "description": "Se recomienda evaluar y revisar los requisitos de ancho de banda de red para los usuarios, en función del tipo de carga de trabajo específico. El artículo al que se hace referencia proporciona estimaciones y recomendaciones generales, pero se requieren medidas específicas para un tamaño adecuado. ",
            "guid": "516785c6-fa96-4c96-ad88-408f372734c8",
            "link": "https://learn.microsoft.com/windows-server/remote/remote-desktop-services/network-guidance",
            "severity": "Bajo",
            "subcategory": "Gestión de redes",
            "text": "Compruebe el ancho de banda de red necesario para cada usuario y, en total, para la SKU de máquina virtual"
        },
        {
            "category": "Seguridad",
            "description": "Le recomendamos que no conceda a los usuarios acceso de administrador a escritorios virtuales. Si necesita paquetes de software, le recomendamos que los ponga a disposición a través de utilidades de administración de configuración como Microsoft Endpoint Manager. En un entorno multisesión, le recomendamos que no permita que los usuarios instalen software directamente.",
            "guid": "a0cdb3b5-4eb2-4eb0-9dda-a3592718e2ed",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "Medio",
            "subcategory": "Configuración del host",
            "text": "Asegúrese de que los usuarios de AVD no tengan privilegios de administrador local en los hosts AVD. "
        },
        {
            "category": "Seguridad",
            "description": "Microsoft Defender para Endpoint ahora admite Windows Virtual Desktop para Windows 10 Enterprise multisesión. Consulte el artículo para la incorporación de dispositivos de infraestructura de escritorio virtual (VDI) no persistentes: https://learn.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi",
            "guid": "b1172576-9ef6-4691-a483-5ac932223ece",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "Alto",
            "subcategory": "Configuración del host",
            "text": "Asegúrese de que se utiliza una solución antivirus y antimalware"
        },
        {
            "category": "Seguridad",
            "description": "Asegúrese de que existan las siguientes exclusiones: https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix#antivirus-exclusions .",
            "guid": "80b12308-1a54-4174-8583-3ea3ad2c2de7",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "Alto",
            "subcategory": "Configuración del host",
            "text": "Asegúrese de que las exclusiones AV adecuadas estén en su lugar"
        },
        {
            "category": "Seguridad",
            "description": "Los discos de Azure ya están cifrados en reposo de forma predeterminada con claves administradas por Microsoft. El cifrado de disco del sistema operativo de la máquina virtual host es posible y compatible con ADE y DES: los datos de usuario sensibles y persistentes no deben almacenarse en el disco host de sesión, luego deben usarse solo si es estrictamente necesario por razones de cumplimiento. El cifrado del almacenamiento FSLogix con Azure Files se puede realizar mediante SSE en Azure Storage.Para el cifrado de OneDrive, consulte este artículo: https://learn.microsoft.com/compliance/assurance/assurance-encryption-for-microsoft-365-services.",
            "guid": "0fd32907-98bc-4178-adc5-a06ca7144351",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "Bajo",
            "subcategory": "Configuración del host",
            "text": "Evaluar los requisitos de cifrado de disco para hosts AVD"
        },
        {
            "category": "Seguridad",
            "description": "Considere el uso de Azure Defender Endpoint para controlar la navegación web del usuario. ",
            "guid": "e19dd344-29eb-4722-a237-a151c5bb4e4f",
            "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/windows-virtual-desktop-support-is-now-generally-available/ba-p/2103712",
            "severity": "Medio",
            "subcategory": "Configuración del host",
            "text": "¿Necesita controlar/restringir la navegación del usuario por Internet desde los hosts de sesión AVD?"
        },
        {
            "category": "Seguridad",
            "description": "Se recomienda habilitar Azure Security Center Standard para suscripciones, máquinas virtuales, almacenes de claves y cuentas de almacenamiento. Con Azure Security Center Standard es posible evaluar y administrar vulnerabilidades, evaluar el cumplimiento de marcos comunes como PCI, fortalecer la seguridad general de su entorno AVD.",
            "guid": "1814387e-5ca9-4c26-a9b3-2ab5bdfc6998",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "Medio",
            "subcategory": "Seguridad",
            "text": "Evaluación del uso de Azure Security Center (ASC) para hosts de sesión AVD"
        },
        {
            "category": "Seguridad",
            "description": "Debe utilizarse, por ejemplo, para imponer el bloqueo del escritorio y la terminación de la sesión inactiva. Los GPO existentes aplicados al entorno local deben revisarse y, finalmente, aplicarse para proteger también los hosts AVD. ",
            "guid": "a135e337-897e-431c-97d6-8cb6a22ac19f",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "Medio",
            "subcategory": "Seguridad",
            "text": "Revisar los GPO de Active Directory para proteger las sesiones RDP"
        },
        {
            "category": "Seguridad",
            "description": "Para obtener detalles e información adicionales, consulte este artículo: https://christiaanbrinkhoff.com/2020/03/23/learn-how-to-increase-the-security-level-of-your-windows-virtual-desktop-environment-e-g-windows-client-with-azure-mfa-and-conditional-access",
            "guid": "916d697d-8ead-4ed2-9bdd-186f1ac252b9",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-mfa",
            "severity": "Bajo",
            "subcategory": "Seguridad",
            "text": "Evaluar el uso de MFA para usuarios de AVD"
        },
        {
            "category": "Seguridad",
            "description": "La habilitación del acceso condicional le permite administrar los riesgos antes de conceder a los usuarios acceso a su entorno de Windows Virtual Desktop. Al decidir a qué usuarios conceder acceso, le recomendamos que también tenga en cuenta quién es el usuario, cómo inicia sesión y qué dispositivo está usando.",
            "guid": "556246b4-3856-44b4-bc74-a748b6633ad2",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "Bajo",
            "subcategory": "Seguridad",
            "text": "Evaluar el uso del acceso condicional para los usuarios"
        },
        {
            "category": "Seguridad",
            "description": "Habilitar la recopilación de registros de auditoría le permite ver la actividad de usuarios y administradores relacionada con Windows Virtual Desktop. Este es también un requisito para habilitar y utilizar la herramienta de monitoreo AVD. Muy recomendable para habilitar. ",
            "guid": "a0916a76-4980-4ad0-b278-ee293c1bc352",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "Medio",
            "subcategory": "Seguridad",
            "text": "Habilitar el registro de diagnóstico y auditoría en el área de trabajo central de Log Analytics"
        },
        {
            "category": "Seguridad",
            "description": "AVD usa controles de acceso basados en rol (RBAC) de Azure para asignar roles a usuarios y administradores. Estos roles dan permiso a los administradores para llevar a cabo ciertas tareas. Si se requiere separación de tareas, Windows Virtual Desktop tiene funciones adicionales que permiten separar las funciones de administración para grupos host, grupos de aplicaciones y áreas de trabajo. Esta separación le permite tener un control más granular sobre las tareas administrativas. Estos roles se denominan de conformidad con los roles estándar y la metodología de privilegios mínimos de Azure.",
            "guid": "baaab757-1849-4ab8-893d-c9fc9d1bb73b",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/rbac",
            "severity": "Bajo",
            "subcategory": "Seguridad",
            "text": "Evaluar el requisito de usar roles RBAC personalizados para la administración de AVD "
        },
        {
            "category": "Seguridad",
            "description": "Un conjunto completo de mejores prácticas de seguridad y recomendaciones se encuentran en el artículo al que se hace referencia, se recomienda revisar. ",
            "guid": "36a5a67f-bb9e-4d5b-9547-8c4479816b28",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide",
            "severity": "Medio",
            "subcategory": "Seguridad",
            "text": "Revisar todas las prácticas recomendadas de seguridad para el entorno AVD"
        },
        {
            "category": "Almacenamiento",
            "description": "Azure NetApp Files, Azure Files, servidor de archivos basado en VM. No se recomienda el servidor de archivos. Azure Files Premium suele ser un buen punto de partida. Por lo general, NetApp solo se requiere para entornos de gran escala / alto rendimiento. ",
            "guid": "ed6b17db-8255-4462-b2ae-e4553afc8339",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/store-fslogix-profile",
            "severity": "Alto",
            "subcategory": "FSLogix",
            "text": "Determinar qué solución back-end de almacenamiento se usará para FSLogix Profile y Office Containers"
        },
        {
            "category": "Almacenamiento",
            "description": "La recomendación de Windows Virtual Desktop es usar el contenedor de perfiles sin el contenedor de Office, a menos que esté planeando escenarios específicos de continuidad empresarial y recuperación ante desastres (BCDR), como se describe en la sección Recuperación ante desastres a continuación. https://learn.microsoft.com/fslogix/profile-container-office-container-cncpt ",
            "guid": "df47d2d9-2881-4b1c-b5d1-e54a29759e39",
            "link": "https://learn.microsoft.com/fslogix/profile-container-office-container-cncpt",
            "severity": "Bajo",
            "subcategory": "FSLogix",
            "text": "Evaluar la posibilidad de separar los contenedores de perfiles de los contenedores de Office"
        },
        {
            "category": "Almacenamiento",
            "description": "Como punto de partida para estimar los requisitos de rendimiento de almacenamiento de contenedores de perfiles, se recomienda asumir 10 IOPS por usuario en estado estable y 50 IOPS por usuario durante el inicio y cierre de sesión.",
            "guid": "680e7828-9c93-4665-9d02-bff4564b0d93",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "Alto",
            "subcategory": "FSLogix",
            "text": "Verificar los límites de escalabilidad del almacenamiento para admitir los requisitos del grupo de hosts"
        },
        {
            "category": "Almacenamiento",
            "description": "Si se requiere una segunda región para fines de recuperación ante desastres, verifique también la disponibilidad de NetApp.",
            "guid": "4a359836-ee79-4d6c-9d3a-364a5b7abae3",
            "link": "https://azure.microsoft.com/global-infrastructure/services/",
            "severity": "Medio",
            "subcategory": "FSLogix",
            "text": "Si se utiliza el almacenamiento de archivos de NetApp, compruebe la disponibilidad del servicio de almacenamiento en su región específica."
        },
        {
            "category": "Almacenamiento",
            "description": "Evite introducir latencia y costos adicionales asociados con el tráfico de red entre regiones siempre que sea posible.",
            "guid": "8aad53cc-79e2-4e86-9673-57c549675c5e",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/fslogix-containers-azure-files",
            "severity": "Alto",
            "subcategory": "FSLogix",
            "text": "Para un rendimiento óptimo, la solución de almacenamiento y el contenedor de perfiles FSLogix deben estar en la misma ubicación del centro de datos."
        },
        {
            "category": "Almacenamiento",
            "description": "Asegúrese de configurar las siguientes exclusiones antivirus para los discos duros virtuales del contenedor de perfiles FSLogix, como se documenta en el artículo al que se hace referencia.",
            "guid": "83f63047-22ee-479d-9b5c-3632054b69ba",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "Medio",
            "subcategory": "FSLogix",
            "text": "Configure las exclusiones antivirus recomendadas para FSLogix (incluye no analizar archivos VHD(x) al conectarse)."
        },
        {
            "category": "Almacenamiento",
            "description": "La configuración básica y recomendada predeterminada está aquí: https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix#best-practice-settings-for-enterprises Consulte aquí el conjunto básico: https://learn.microsoft.com/fslogix/configure-profile-container-tutorialSee aquí para una referencia completa: https://learn.microsoft.com/fslogix/profile-container-configuration-reference ",
            "guid": "d34aad5e-8c78-4e1d-9666-7313c405674c",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "Alto",
            "subcategory": "FSLogix",
            "text": "Revise las claves del Registro FSLogix y determine cuáles aplicar"
        },
        {
            "category": "Almacenamiento",
            "description": "Se desaconsejan las conexiones simultáneas o múltiples en Windows Virtual Desktop. La práctica recomendada es crear una ubicación de perfil diferente para cada sesión (como grupo de servidores).",
            "guid": "5e985b85-9c77-43e7-b261-623b775a917e",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "Alto",
            "subcategory": "FSLogix",
            "text": "Comprobar el uso de conexiones simultáneas o múltiples al mismo perfil"
        },
        {
            "category": "Almacenamiento",
            "description": "Como estimación general, para ser validada en un entorno de prueba, para cada usuario se deben considerar primero de 5 a 15 IOPS, dependiendo de la carga de trabajo. Azure Files: Premium max 100k IOPS por recurso compartido (máx. 100TB) y hasta 5Gbps con latencia de 3ms. Tenga en cuenta cómo se aprovisiona Azure Files, es decir, IOPS estrictamente vinculadas a SIZE aprovisionado. Capacidad de dimensionamiento de ráfaga en algunos casos. Asegúrese de aprovisionar por adelantado más espacio del necesario para asegurarse de tener suficientes IOPS. NOTA: Azure Premium puede ser más barato que Standard porque no paga transacciones, luego detalles importantes a tener en cuenta. Azure NetApp Files: recuerde un máximo de 1000 direcciones IP conectadas, puede ajustar IOPS sobre la marcha, capacidad aprovisionada mínima de 4 TB. ",
            "guid": "1f348ff3-64d2-47d4-8e8b-bbc868155abb",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/store-fslogix-profile",
            "severity": "Alto",
            "subcategory": "FSLogix",
            "text": "Revisar las mejores prácticas y las consideraciones clave para el dimensionamiento del almacenamiento"
        },
        {
            "category": "Almacenamiento",
            "description": "Asegúrese de consultar la lista de prácticas recomendadas y recomendaciones descritas en el artículo al que se hace referencia.",
            "guid": "9164e990-9ae2-48c8-9c33-b6b7808bafe6",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "Medio",
            "subcategory": "FSLogix",
            "text": "Compruebe los procedimientos recomendados para Azure Files (si se usa)"
        },
        {
            "category": "Almacenamiento",
            "description": "Asegúrese de consultar la lista de prácticas recomendadas y recomendaciones descritas en el artículo al que se hace referencia.",
            "guid": "c42149d4-13a9-423c-9574-d11028ac6aae",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix",
            "severity": "Medio",
            "subcategory": "FSLogix",
            "text": "Compruebe las prácticas recomendadas para los archivos de NetApp (si se utilizan)"
        },
        {
            "category": "Almacenamiento",
            "description": "Los contenedores de perfiles tienen un tamaño máximo predeterminado de 30 GB. Si se anticipan contenedores de perfiles grandes y los clientes quieren intentar mantenerlos pequeños, considere la posibilidad de usar OneDrive para hospedar archivos de Office 365 fuera del perfil de FSLogix.",
            "guid": "01e6a84d-e5df-443d-8992-481718d5d1e5",
            "link": "https://learn.microsoft.com/fslogix/profile-container-configuration-reference",
            "severity": "Alto",
            "subcategory": "FSLogix",
            "text": "Revisar y confirmar el tamaño máximo de perfil configurado en FSLogix"
        },
        {
            "category": "Almacenamiento",
            "description": "Cloud Cache utiliza el disco local como caché y puede generar mucha presión en el disco de la máquina virtual. Se recomienda aprovechar la potencia del disco de máquina virtual temporal (y conectado localmente), si es posible en función de la SKU de máquina virtual. ",
            "guid": "b2d1215a-e114-4ba3-9df5-85ecdcd9bd3b",
            "link": "https://learn.microsoft.com/fslogix/cloud-cache-configuration-reference",
            "severity": "Medio",
            "subcategory": "FSLogix",
            "text": "Si se utiliza FSLogix Cloud Cache, mueva el directorio Cache a la unidad temporal."
        },
        {
            "category": "Almacenamiento",
            "description": "REDIRECTION.XML archivo se utiliza para controlar qué carpetas se redirigen fuera del contenedor de perfiles a la unidad C:. Las exclusiones deben ser la excepción y nunca deben usarse a menos que la exclusión específica sea completamente entendida por la persona que configura la exclusión. Las exclusiones siempre deben probarse completamente en el entorno donde se pretende implementar. La configuración de exclusiones puede afectar a la funcionalidad, la estabilidad y el rendimiento.",
            "guid": "0b50ca97-b1d2-473c-b4d9-6e98b0f912de",
            "link": "https://learn.microsoft.com/fslogix/manage-profile-content-cncpt#redirectionsxml",
            "severity": "Medio",
            "subcategory": "FSLogix",
            "text": "Revise el uso de la redirección FSLogix."
        },
        {
            "category": "Almacenamiento",
            "description": "Se debe crear un sitio de Active Directory para el entorno de red virtual de Azure donde se creará la subred ANF y ese nombre de sitio debe especificarse en la propiedad de conexión ANF al ejecutar el procedimiento de unión, como se explica en el artículo de referencia.",
            "guid": "6647e977-db49-48a8-bc35-743f17499d42",
            "link": "https://learn.microsoft.com/azure/azure-netapp-files/create-active-directory-connections",
            "severity": "Alto",
            "subcategory": "FSLogix",
            "text": "Si se usa el almacenamiento de Azure NetApp Files, compruebe la configuración del nombre del sitio de AD en la conexión de AD."
        },
        {
            "category": "Almacenamiento",
            "description": "SMB Multichannel permite a los clientes utilizar múltiples conexiones de red que proporcionan un mayor rendimiento al tiempo que reducen el costo de propiedad. El aumento del rendimiento se logra mediante la agregación de ancho de banda en varias NIC y el uso de la compatibilidad con Receive Side Scaling (RSS) para que las NIC distribuyan la carga de E/S entre varias CPU.",
            "guid": "5784b6ca-5e9e-4bcf-8b54-c95459ea7369",
            "link": "https://learn.microsoft.com/azure/storage/files/storage-files-smb-multichannel-performance",
            "severity": "Medio",
            "subcategory": "FSLogix",
            "text": "Habilite SMB multicanal cuando use un recurso compartido de archivos premium para hospedar contenedores de perfiles FSLogix."
        },
        {
            "category": "Almacenamiento",
            "description": "HDD estándar, SSD estándar o SSD premium, discos efímeros no son compatibles, no se recomiendan discos Ultra. Se recomienda evaluar Premium para el disco del sistema operativo si la densidad de usuarios no es baja y si va a utilizar Cloud Cache. ",
            "guid": "3611c818-b0a0-4bc5-80e4-3a18a9cd289c",
            "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
            "severity": "Medio",
            "subcategory": "Host de sesión ",
            "text": "Determinar qué tipo de disco administrado se utilizará para los hosts de sesión  "
        }
    ],
    "metadata": {
        "name": "Azure Virtual Desktop Review",
        "state": "GA"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Medio"
        },
        {
            "name": "Bajo"
        }
    ],
    "status": [
        {
            "description": "Esta comprobación aún no se ha examinado",
            "name": "No verificado"
        },
        {
            "description": "Hay un elemento de acción asociado a esta comprobación",
            "name": "Abrir"
        },
        {
            "description": "Esta comprobación se ha comprobado y no hay más elementos de acción asociados a ella",
            "name": "Cumplido"
        },
        {
            "description": "Recomendación entendida, pero no necesaria por los requisitos actuales",
            "name": "No es necesario"
        },
        {
            "description": "No aplicable para el diseño actual",
            "name": "N/A"
        }
    ]
}
checklists/avd_checklist.en.json METASEP
{
    "$schema": "checklist.schema.json",
    "items": [
        {
            "category": "BC/DR",
            "subcategory": "Compute",
            "text": "Determine the expected High Availability SLA for applications/desktops published through AVD",
            "description": "AVD control plan does not offer a financially backed service level agreement. We strive to attain at least 99.9% availability for the Windows Virtual Desktop service URLs. The availability of the session host virtual machines in your subscription is covered by the Virtual Machines SLA. Dependent resources/services and infrastructure availability must be also considered to properly satisfy global high-availability requirements. ",
            "guid": "56c57ba5-9119-4bf8-b8f5-c586c7d9cdc1",
            "severity": "High",
            "link": "https://azure.microsoft.com/support/legal/sla/virtual-desktop/v1_0/"
        },
        {
            "category": "BC/DR",
            "subcategory": "Compute",
            "text": "Assess Geo Disaster Recovery region for AVD Host Pools",
            "description": "Active-Active' model can be achieved with multiple host pools in different regions. A single Host Pool with VMs from different regions is not recommended.If multiple pools for same users will be used, the problem of how to synchronize/replicate user profiles must be solved. FSLogix Cloud Cache could be used, but need to be carefully reviewed and planned, or customers can decide to do not synchronize/replicate at all. 'Active-Passive' can be achieved using Azure Site Recovery (ASR) or on-demand Pool deployment with automated mechanism.",
            "guid": "6acc076e-f9b1-441a-a989-579e76b897e7",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery"
        },
        {
            "category": "BC/DR",
            "subcategory": "Compute",
            "text": "Separate critical applications in different AVD Host Pools",
            "description": "Before approaching Windows Virtual Desktop BCDR planning and design, it is important to initially consider which applications are consumed through AVD are critical. You may want to separate them from non-critical apps and use a separate Host Pool with a different disaster recovery approach and capabilities.",
            "guid": "10a7da7b-e996-46e1-9d3c-4ada97cc3d13",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery"
        },
        {
            "category": "BC/DR",
            "subcategory": "Compute",
            "text": "Plan the best resiliency option for AVD Host Pool deployment",
            "description": "? Did you select the proper resiliency level for your Host Pool VMs (Availability Set vs. Availability Zones)?? Are you aware of implications on HA SLA and scalability limits that come with AS or AZ? ? You can currently deploy 399 VMs per Windows Virtual Desktop ARM template deployment without Availability Sets, or 200 VMs per Availability Set.? You can increase the number of VMs per deployment by switching off Availability Sets in either the ARM template or the Azure portal host pool enrollment.Deploying AZ is now possible, one AZ at time at the moment, need to manually create a fraction of VMs in each desired AZ. ",
            "guid": "25ab225c-6f4e-4168-9fdd-dea8a4b7cdeb",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/faq"
        },
        {
            "category": "BC/DR",
            "subcategory": "Compute",
            "text": "Assess the requirement to backup AVD Session Hosts",
            "description": "Azure Backup can be used also to protect Host Pool VMs, this practice is supported, even if Host Pool VMs should be stateless. This option could be considered for Personal Host Pools. ",
            "guid": "4c61fc3f-c14e-4ea6-b69e-8d9a3eec218e",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery"
        },
        {
            "category": "BC/DR",
            "subcategory": "Dependencies",
            "text": "Plan for Golden Image cross-region availability",
            "description": "If custom images are used to deploy AVD Host Pool VMs, it is important to ensure those artifacts are available in all regions, even if in case of a major disaster. Azure Compute Gallery service can be used to replicate images across all regions where a Host Pool is deployed, with redundant storage and in multiple copies.",
            "guid": "dd2e0d5d-771d-441e-9610-cc57b4a4a141",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/shared-images-portal"
        },
        {
            "category": "BC/DR",
            "subcategory": "Dependencies",
            "text": "Assess Infrastructure & Application dependencies ",
            "description": "If users of the AVD infrastructure need on-premises resource access, high availability of network infrastructure required to connect is also critical and should be considered. Resiliency of authentication infrastructure needs to be assessed and evaluated. BCDR aspects for dependent applications and other resources need to be considered to ensure availability in the secondary DR location.",
            "guid": "fd339489-8c12-488b-9c6a-57cfb644451e",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery"
        },
        {
            "category": "BC/DR",
            "subcategory": "Storage",
            "text": "Assess which data need to be protected inside the Profile and Office Containers",
            "description": "Not all data inside FSLogix user profiles may deserve protection from disaster. Additionally, if external storage is used, for example OneDrive or File Servers/Shares, what is remaining in the FSLogix profile is minimal and could be lost in some extreme circumstances. In other cases, data inside the profile can be rebuilt from other storages (for example Outlook Inbox in cached mode). ",
            "guid": "687ab077-adb5-49e5-a960-3334fdf8cc23",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/fslogix/manage-profile-content-cncpt"
        },
        {
            "category": "BC/DR",
            "subcategory": "Storage",
            "text": "Build a backup protection strategy for Profile and Office Containers",
            "description": "Preventing data loss for critical user data is important, first step is to assess which data need to be saved and protected. If using OneDrive or other external storage, saving user Profile and/or Office Containers data maybe not necessary. Appropriate mechanism must be considered to provide protection for critical user data. Azure Backup service can be used to protect Profile and Office Containers data when stored on Azure Files Standard and Premium tiers. Azure NetApp Files Snapshots and Policies can be used for Azure NetApp Files (all tiers).",
            "guid": "fc4972cc-3cd2-45bf-a707-6e9eab4bed32",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery"
        },
        {
            "category": "BC/DR",
            "subcategory": "Storage",
            "text": "Assess Profile Container storage replication requirements and resiliency for BCDR purpose",
            "description": "In AVD, multiple replication mechanisms and strategies can be used for user data residing in FSLogix containers:? Profile Pattern #1: Native Azure storage replication mechanisms, for example Azure Files Standard GRS replication, Azure NetApp Files Cross Region Replication, or Azure Files Sync for VM-based file servers? Use Zone Replicated Storage (ZRS) or Geo replicated storage (GRS) for Azure Files is recommended.? LRS with local only resiliency can be used if no zone/region protection is required.? NOTE: Azure Files Share Standard is LRS/ZRS/GRS, but with 100TB large support enabled only LRS/ZRS are supported. ? Profile Pattern #2: FSLogix Cloud Cache is built in automatic mechanism to replicate containers between different (up to 4) storage accounts. Cloud Cache should be used only when:? User Profile or Office containers data availability required high-availability SLA is critical and need to be resilient to region failure.? Selected storage option is not able to satisfy BCDR requirements. For example, with Azure File Share Premium tier, or Azure File Share Standard with Large File Support enabled, GRS is not available.? When replication between disparate storage is required.? Profile Pattern #3: Only set up geo disaster recovery for application data and not for user data/profile containers: store important application data in separate storages, like OneDrive or other external storage with its own built-in DR mechanism.",
            "guid": "9f7547c1-746d-4c56-868a-714435bd09dd",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/disaster-recovery"
        },
        {
            "category": "BC/DR",
            "subcategory": "Storage",
            "text": "Review Azure NetApp Files DR strategy",
            "description": "Geo Disaster Recovery: Azure NetApp Files is essentially is LRS (locally replicated storage), then you need to architect something more if you want cross-region replication. The recommendation for cross-region at the moment is NetApp Cloud Sync, replicating to another Azure region (and NetApp Volume). Backup: Backups are handled by snapshots, but are not automatic, need to scheduled using policies. https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-manage-snapshots. There is a maximum limit of snapshots (255) per volume as documented here: https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-resource-limits.",
            "guid": "23429db7-2281-4376-85cc-57b4a4b18142",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-manage-snapshots"
        },
        {
            "category": "BC/DR",
            "subcategory": "Storage",
            "text": "Review Azure Files DR strategy",
            "description": "Geo Disaster Recovery: GRS for Azure Files is only available with standard SKU and no large share support, then not suitable in most customer scenarios. If geo-replication is required, when using Azure File Share Premium, replication with FSLogix Cloud Cache should be evaluated, or 'in-region' Availability Zone (AZ) only resiliency should be considered. Backup: Azure Backup fully supports Azure File Share all SKUs, and is the recommended solution to protect Profile Containers. If using OneDrive or other external storage, saving user Profile and/or Office Containers data maybe not necessary.",
            "guid": "3d4f3537-c134-46dc-9602-7a71efe1bd05",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/backup/backup-afs"
        },
        {
            "category": "Compute",
            "subcategory": "Golden Image/s",
            "text": "Determine how applications will be deployed in AVD Host Pools",
            "description": "Applications can be preinstalled in the golden image/s, can be attached using MSIX & AppAttach feature or distributing to hosts after pool deployment using traditional SW distribution methods.",
            "guid": "86ba2802-1459-4014-95d3-8e5309ccbd97",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-customize-master-image"
        },
        {
            "category": "Compute",
            "subcategory": "Golden Image/s",
            "text": "Estimate the number of golden images that will be required",
            "description": "Will they use fslogix application masking which would lend itself to a single image, or multi images with different applications baked in: what is necessitating more than one image to be used?",
            "guid": "9266bcca-274f-4aa1-abf3-9d95d44c7c89",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace"
        },
        {
            "category": "Compute",
            "subcategory": "Golden Image/s",
            "text": "Determine which OS image/s you will use for Host Pool deployment",
            "description": "Determine which Guest OS will be used to deploy each Host Pool: Windows 10 vs. Windows Server, Marketplace vs. Custom images",
            "guid": "19ca1f6d-5315-4ae5-84ba-34d4585e2213",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview"
        },
        {
            "category": "Compute",
            "subcategory": "Golden Image/s",
            "text": "If a custom image will be used, determine if there is an automated build process?",
            "description": "If nothing exists, consider using Azure Image Builder to automate the build process. ",
            "guid": "9bd7bb01-2f7b-495e-86e1-54e2aa359282",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/virtual-machines/image-builder-overview"
        },
        {
            "category": "Compute",
            "subcategory": "Golden Image/s",
            "text": "If a custom image will be used, is there a plan to organize and manage the lifecycle of your images?",
            "description": "Evaluate Azure Compute Gallery.",
            "guid": "5a2adb2c-3e23-426b-b225-ca44e1696fdd",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/shared-image-galleries"
        },
        {
            "category": "Compute",
            "subcategory": "Golden Image/s",
            "text": "If custom image will be used, check recommended best practices for AVD on how to build master image",
            "description": "There are some known best practices and recommendations for the golden image customization, be sure to check the referenced article. ",
            "guid": "deace4cb-1dec-44c6-90c3-fc14eebb36a3",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-customize-master-image"
        },
        {
            "category": "Compute",
            "subcategory": "Golden Image/s",
            "text": "Evaluate the usage of Virtual-Desktop-Optimization-Tool",
            "description": "This tool-set has been created to automatically apply setting referenced in white paper 'Optimizing Windows 10, version 2004 for a Virtual Desktop Infrastructure (VDI) role': https://learn.microsoft.com/windows-server/remote/remote-desktop-services/rds-vdi-recommendations-2004. Usage of the tool and/or optimizations mentioned in the white-paper should be considered. ",
            "guid": "829e3fec-2183-4687-a017-7a2b5945bda4",
            "severity": "Medium",
            "link": "https://github.com/The-Virtual-Desktop-Team/Virtual-Desktop-Optimization-Tool"
        },
        {
            "category": "Compute",
            "subcategory": "Golden Image/s",
            "text": "Plan/Assess AVD Session Host configuration management strategy",
            "description": "Determine if a configuration management tool is already in place to manage Host Pool VM configuration after initial deployment, For example SCCM, MEM/Intune, GPO, 3rd-party solutions.",
            "guid": "3334fdf9-1c23-4418-8b65-285269440b4b",
            "severity": "Low",
            "link": "https://learn.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop-multi-session"
        },
        {
            "category": "Compute",
            "subcategory": "Golden Image/s",
            "text": "Determine if Microsoft OneDrive will be part of AVD deployment",
            "description": "Review article provided and check 'Known Folder Redirection' and 'Files OnDemand' OneDrive features should be considered and eventually adopted.",
            "guid": "e3d3e084-4276-4d4b-bc01-5bcf219e4a1e",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/install-office-on-AVD-master-image"
        },
        {
            "category": "Compute",
            "subcategory": "Golden Image/s",
            "text": "Determine if Microsoft Teams will be part of AVD deployment",
            "description": "Be sure to review this article and use the latest version, review and evaluate Teams exclusions to reduce profile size.",
            "guid": "b5887953-5d22-4788-9d30-b66c67be5951",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/teams-on-AVD"
        },
        {
            "category": "Compute",
            "subcategory": "MSIX & AppAttach",
            "text": "Do not use the same storage account/share as Profile/Office containers ",
            "description": "It is highly recommended to use separate storage accounts/shares to store MSIX packages. If necessary, storage can scale out independently and not being impacted by profile I/O activities. Azure offers multiple storage options that can be used for MISX app attach. We recommend using Azure Files or Azure NetApp Files as those options offer the best value between cost and management overhead. ",
            "guid": "90083845-c587-4cb3-a1ec-16a1d076ef9f",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-file-share"
        },
        {
            "category": "Compute",
            "subcategory": "MSIX & AppAttach",
            "text": "Review performance considerations for MSIX",
            "description": "In the referenced article, we reported few but important performance considerations for MSIX usage in AVD context, be sure to carefully review.",
            "guid": "241addce-5793-477b-adb3-751ab2ac1fad",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-file-share"
        },
        {
            "category": "Compute",
            "subcategory": "MSIX & AppAttach",
            "text": "Check proper session host permissions for MSIX share",
            "description": "MSIX app attach requires read-only permissions to access the file share. If you're storing your MSIX applications in Azure Files, then for your session hosts, you'll need to assign all session host VMs both storage account role-based access control (RBAC) and file share New Technology File System (NTFS) permissions on the share.",
            "guid": "66e15d4d-5a2a-4db2-a3e2-326bf225ca41",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-file-share"
        },
        {
            "category": "Compute",
            "subcategory": "MSIX & AppAttach",
            "text": "MSIX packages for 3rd-party applications",
            "description": "3rd-party software vendor must provide a MSIX package, it is not recommended for customer to attempt  the conversion procedure without proper support from the application owner.",
            "guid": "bd362caa-ab79-4b19-adab-81932c9fc9d1",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-faq"
        },
        {
            "category": "Compute",
            "subcategory": "MSIX & AppAttach",
            "text": "Disable auto-update for MSIX packages",
            "description": "MSIX app attach doesn't support auto-update for MSIX applications, then should be disabled.",
            "guid": "bb88037f-5e6b-4fbb-aed5-03547cc447e8",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-faq"
        },
        {
            "category": "Compute",
            "subcategory": "MSIX & AppAttach",
            "text": "Review operating systems support",
            "description": "In order to leverage MSIX & App Attach, guest OS image for AVD Host pool must be Windows 10 Enterprise or Windows 10 Enterprise Multi-session, version 2004 or later.",
            "guid": "26128a71-f0f1-4cac-9d9e-f1d5e832e42e",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/app-attach-faq"
        },
        {
            "category": "Compute",
            "subcategory": "Session Host",
            "text": "Evaluate the usage of Gen2 VM for Host Pool deployment",
            "description": "Once selected the VM SKU that will be used for Host Pool deployment, it is recommended to use Gen2 type of the SKU for higher security and improved capabilities.",
            "guid": "e4633254-3185-40a1-b120-bd563a1c8e9d",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-machines/generation-2"
        },
        {
            "category": "Foundation",
            "subcategory": "Capacity Planning",
            "text": "Determine the Host Pool type to use",
            "description": "Shared/Pooled or Dedicated/Personal",
            "guid": "8468c55a-775c-46ee-a5b8-6ad8844ce3b2",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace"
        },
        {
            "category": "Foundation",
            "subcategory": "Capacity Planning",
            "text": "For Personal Host Pool type, decide on the assignment type",
            "description": "Confirm that the difference between automatic and direct assignment is well understood and the selected option is appropriate for the scenario in question.",
            "guid": "b38b875b-a1cf-4204-a901-3a5d3ce474db",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type"
        },
        {
            "category": "Foundation",
            "subcategory": "Capacity Planning",
            "text": "For Pooled Host Pool type, decide on the load balancing method",
            "description": "Check which one to use and available options, be aware that if autoscaling will be used, it sets it to breadth-first. ",
            "guid": "cbd8682a-6abc-4a2a-9fda-1dbf3dc95d48",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/host-pool-load-balancing"
        },
        {
            "category": "Foundation",
            "subcategory": "Capacity Planning",
            "text": "Estimate the number of different Host Pools to deploy ",
            "description": "Based on your selection criteria, how many Host Pools you would need? You should consider to have multiple ones if:? Multiple OS images? Multiple regions? Different HW required? Different Host Pool type (shared vs. personal)? Different user requirements and SLA (Top users, Execs, Office Worker vs. Developers, etc.)? Different RDP settings (applied at Host Pool level), see https://learn.microsoft.com/azure/virtual-desktop/customize-rdp-properties? Required number of VMs in the host pool exceeding maximum capabilities",
            "guid": "c7c791dc-a1f6-4d56-999e-558b937d4985",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/environment-setup"
        },
        {
            "category": "Foundation",
            "subcategory": "Capacity Planning",
            "text": "Run workload performance test to determine the best Azure VM SKU and size to use (determine the number of hosts per pool)",
            "description": "Use the link provided to set a starting point for SKU decision, then validate using a performance test. Ensure a minimum of 4 cores for Production is selected per Session Host (multi-session)",
            "guid": "e1112dbd-7ba0-412e-9b94-ef6e047d2ea2",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/windows-server/remote/remote-desktop-services/virtual-machine-recs"
        },
        {
            "category": "Foundation",
            "subcategory": "Capacity Planning",
            "text": "Verify AVD scalability limits for the environment",
            "description": "It is critical to check AVD capacity and limits reported in the referenced article. ",
            "guid": "992b1cd6-d2f5-44b2-a769-e3a691e8838a",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop"
        },
        {
            "category": "Foundation",
            "subcategory": "Capacity Planning",
            "text": "Determine if  Session Hosts will require GPU",
            "description": "Host Pools with GPU require special configuration, please be sure to review the referenced article. ",
            "guid": "c936667e-13c0-4056-94b1-e945a459837e",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/configure-vm-gpu"
        },
        {
            "category": "Foundation",
            "subcategory": "Capacity Planning",
            "text": "Recommended to use VM SKUs able to leverage Accelerated Networking feature in Azure.",
            "description": "Whenever is possible, it is recommended to leverage VM SKUs with Accelerated Networking feature. Today pnly Windows Server OS are supported (see list in the article), in the future Windows Client OS maybe also included. ",
            "guid": "b47a393a-0803-4272-a479-8b1578b219a4",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/virtual-network/create-vm-accelerated-networking-powershell"
        },
        {
            "category": "Foundation",
            "subcategory": "Clients & Users",
            "text": "Assess how many users will connect to AVD and from which regions",
            "description": "For proper planning and and deployment, it is important to asses the maximum number of users and average concurrent sessions. ",
            "guid": "bb91a33d-90ca-4e2c-a881-3706f7c0cb9f",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/faq"
        },
        {
            "category": "Foundation",
            "subcategory": "Clients & Users",
            "text": "Determine if all users will have the same set of applications and/or different Host Pool configurations and/or OS images",
            "description": "Multiple Host Pools maybe required to support different set of users, it is recommended to estimate how many will be necessary. ",
            "guid": "a1cf2049-9013-4a5d-9ce4-74dbcbd8682a",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/environment-setup"
        },
        {
            "category": "Foundation",
            "subcategory": "Clients & Users",
            "text": "Assess external dependencies for each Host Pool",
            "description": "The dependencies on resources external to the AVD pool should be assessed and reviewed, for example Active Directory, external file shares or other storage, on-premises services and resources, network infrastructure components like VPN and or Express Route, external services and 3rd-party components. For all these resources, latency from the AVD Host Pool needs to be evaluated and connectivity considered. Additionally, BCDR considerations need to be applied to these dependencies as well.",
            "guid": "6abca2a4-fda1-4dbf-9dc9-5d48c7c791dc",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview"
        },
        {
            "category": "Foundation",
            "subcategory": "Clients & Users",
            "text": "Review client OS used and AVD client type",
            "description": "Review limitations of each client and compare multiple options when possible.",
            "guid": "a1f6d565-99e5-458b-a37d-4985e1112dbd",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/connect-windows-7-10"
        },
        {
            "category": "Foundation",
            "subcategory": "Clients & Users",
            "text": "Check licensing requirements",
            "description": "Customers who are properly licensed to run Windows Virtual Desktop workloads are eligible to apply a Windows license to their session host virtual machines and run them without paying for another license.",
            "guid": "7ba012e7-b94e-4f6e-847d-2ea2992b1cd6",
            "severity": "Low",
            "link": "https://azure.microsoft.com/pricing/details/virtual-desktop/"
        },
        {
            "category": "Foundation",
            "subcategory": "Clients & Users",
            "text": "Run a PoC to test end-to-end user experience to verify impact caused by network latency",
            "description": "Depending on the user locations, and AVD region deployment, users may have a non-optimal experience, hence is important to test as soon as possible in a small PoC environment. ",
            "guid": "d2f54b29-769e-43a6-a1e8-838ac936667e",
            "severity": "High",
            "link": "https://azure.microsoft.com/services/virtual-desktop/assessment/"
        },
        {
            "category": "Foundation",
            "subcategory": "Clients & Users",
            "text": "Determine if users will access AVD using full desktops and/or remote applications ",
            "description": "Determine if users will be offered full desktops and/or Remote Application Groups. ",
            "guid": "13c00567-4b1e-4945-a459-837ee7ad6c6d",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/manage-app-groups"
        },
        {
            "category": "Foundation",
            "subcategory": "Clients & Users",
            "text": "All users will have the same RDP settings? ",
            "description": "RDP settings can currently only be configured at the host pool level, not per user / group.",
            "guid": "3b365a5c-7acb-4e48-abe5-4cd79f2e8776",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/customize-rdp-properties"
        },
        {
            "category": "Foundation",
            "subcategory": "Clients & Users",
            "text": "Evaluate RDP ShortPath for clients connecting from managed internal networks",
            "description": "RDP Shortpath for managed networks is a feature of Azure Virtual Desktop that establishes a direct UDP-based transport between Remote Desktop Client and Session host. The removal of extra relay reduces the round-trip time, which improves user experience with latency-sensitive applications and input methods. To support RDP Shortpath, the Azure Virtual Desktop client needs a direct line of sight to the session host, and must be running either Windows 10 or Windows 7 and have the Windows Desktop client installed.",
            "guid": "b2074747-d01a-4f61-b1aa-92ad793d9ff4",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/shortpath"
        },
        {
            "category": "Foundation",
            "subcategory": "General",
            "text": "Determine in which Azure region/s AVD Host Pools will be deployed.",
            "description": "AVD is a non-regional service, Host Pools can be created in any region, automatic redirection from closest front-end will happen automatically.",
            "guid": "42e52f47-21d9-428c-8b1b-d521e44a29a9",
            "severity": "High",
            "link": "https://azure.microsoft.com/global-infrastructure/services/?products=virtual-desktop"
        },
        {
            "category": "Foundation",
            "subcategory": "General",
            "text": "Determine if hybrid connectivity is required to connect to on-premises environment",
            "description": "If required to connect to on-premises environment, assess the current connectivity option or plan for the required connectivity. ",
            "guid": "dd399cfd-7b28-4dc8-9555-6202bfe4563b",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/"
        },
        {
            "category": "Foundation",
            "subcategory": "General",
            "text": "Did you evaluate latency between users location and Azure AVD infrastructure?",
            "description": "Run the 'Windows Virtual Desktop Experience Estimator' tool to select the best Azure region to deploy Host Pools. Beyond 150ms latency, user experience may be not optimal. ",
            "guid": "0d834a34-8b26-43e6-bc60-512a26498f6d",
            "severity": "High",
            "link": "https://azure.microsoft.com/services/virtual-desktop/assessment/"
        },
        {
            "category": "Foundation",
            "subcategory": "General",
            "text": "Determine metadata location for AVD service",
            "description": "AVD store metadata only to run the service in specific geographic locations, determine what is available today and if suitable based on customer requirements. ",
            "guid": "bad37ead-53cc-47ce-8d7a-aab3571449ab",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/data-locations"
        },
        {
            "category": "Foundation",
            "subcategory": "General",
            "text": "Check Azure quotas and availability for specific VM sizes in the selected regions",
            "description": "Check for specific VM SKUs, especially if you need GPU or high-specs SKUs, and eventually Azure NetApp Files availability if used. ",
            "guid": "8053d89e-89dc-47b3-9be2-a1a27f7a9e91",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits"
        },
        {
            "category": "Foundation",
            "subcategory": "General",
            "text": "Check for Availability Zone (AZ) availability in the selected region",
            "description": "See BCDR section for more details.",
            "guid": "be1f38ce-f398-412b-b463-cbbac89c199d",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/availability-zones/az-region"
        },
        {
            "category": "Identity",
            "subcategory": "Active Directory",
            "text": "Create at least two Active Directory Domain Controllers (DCs) in Azure VNET environment close to AVD Host Pool",
            "description": "AD DCs in Azure are recommended to reduce latency for users logging into AVD session hosts, and eventually for Azure NetApp Files and AD integration. ADC need to be able to talk to DCs for ALL child domains. As alternative, on-premise connectivity must be used to reach AD DCs. ",
            "guid": "c14aea7e-65e8-4d9a-9aec-218e6436b073",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain"
        },
        {
            "category": "Identity",
            "subcategory": "Active Directory",
            "text": "Create a specific OU in Active Directory for each Host Pool",
            "description": "Recommended to create a separate OU per Host Pool under a separate OU hierarchy. These OUs will contain machine accounts of AVD Session Hosts. ",
            "guid": "6db55f57-9603-4334-adf9-cc23418db612",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace"
        },
        {
            "category": "Identity",
            "subcategory": "Active Directory",
            "text": "Review Domain GPO that will be applied to OU and impacting Host Pool VM functionalities",
            "description": "Carefully review, and eventually block/filter inheritance of GPOs to the OUs containing AVD Host Pools. ",
            "guid": "7126504b-b47a-4393-a080-327294798b15",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/previous-versions/windows/desktop/Policy/group-policy-hierarchy"
        },
        {
            "category": "Identity",
            "subcategory": "Active Directory",
            "text": "Create a dedicated user account with only permissions to join VM to the domain",
            "description": "Recommended to have a specific dedicated account with specific permissions, and without the default 10 joins limitation. ",
            "guid": "347dc560-28a7-41ff-b1cd-15dd2f0d5e77",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace"
        },
        {
            "category": "Identity",
            "subcategory": "Active Directory",
            "text": "Create a domain user group for each set of users that will be granted access to each Host Pool Application Group (DAG or RAG)",
            "description": "Avoid granting access per user, instead use AD groups and replicate them using ADC in Azure AD. ",
            "guid": "2d41e361-1cc5-47b4-a4b1-410d43958a8c",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/manage-app-groups"
        },
        {
            "category": "Identity",
            "subcategory": "Active Directory",
            "text": "Review your organization password expiration policy for accounts used by Azure Files AD integration",
            "description": "As part of the procedure to integrate Azure File Share and Active Directory authentication, an AD account to represent the storage account (file share) will be created. You can choose to register as a computer account or service logon account, see FAQ for details. For computer accounts, there is a default password expiration age set in AD at 30 days. Similarly, the service logon account may have a default password expiration age set on the AD domain or Organizational Unit (OU). For both account types, we recommend you check the password expiration age configured in your AD environment and plan to update the password of your storage account identity of the AD account before the maximum password age. You can consider creating a new AD Organizational Unit (OU) in AD and disabling password expiration policy on computer accounts or service logon accounts accordingly.",
            "guid": "2289b3d6-b57c-4fc6-9546-1e1a3e3453a3",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/storage/files/storage-files-identity-ad-ds-enable"
        },
        {
            "category": "Identity",
            "subcategory": "Requirements",
            "text": "An Azure Active Directory tenant must be available with at least one subscription linked",
            "description": "An Azure subscription must be parented to the same Azure AD tenant, that contains a virtual network that either contains or is connected to the Windows Server Active Directory or Azure AD DS instance.",
            "guid": "6ceb5443-5125-4922-9442-93bb628537a5",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview"
        },
        {
            "category": "Identity",
            "subcategory": "Requirements",
            "text": "A Windows Server Active Directory forest/domain is in sync with Azure Active Directory",
            "description": "You can configure this using Azure AD Connect (for hybrid organizations) or Azure AD Domain Services (for hybrid or cloud organizations).",
            "guid": "5119bf8e-8f58-4542-a7d9-cec166cd072a",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview"
        },
        {
            "category": "Identity",
            "subcategory": "Requirements",
            "text": "Check User Account requirements to connect to Windows Virtual Desktop",
            "description": "(1) The user must be sourced from the same Active Directory that's connected to Azure AD. Windows Virtual Desktop does not support B2B or MSA accounts. (2) The UPN you use to subscribe to Windows Virtual Desktop must exist in the Active Directory domain the VM is joined to.",
            "guid": "f9b141a8-98a5-435e-9378-97e71ca7da7b",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview"
        },
        {
            "category": "Identity",
            "subcategory": "Requirements",
            "text": "Check VM requirements for AVD Session Hosts that will be created",
            "description": "VMs must be Standard domain-joined or Hybrid AD-joined. Virtual machines can't be Azure AD-joined.",
            "guid": "ea962a15-9394-46da-a7cc-3923266b2258",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/overview"
        },
        {
            "category": "Identity",
            "subcategory": "Requirements",
            "text": "Before using Azure Active Directory Domain Services (AAD-DS) for AVD, be sure to review the limitations. ",
            "description": "Compare self-managed Active Directory Domain Services, Azure Active Directory, and managed Azure Active Directory Domain Services",
            "guid": "6f4a1651-bddd-4ea8-a487-cdeb4861bc3b",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/active-directory-domain-services/compare-identity-solutions"
        },
        {
            "category": "Monitoring and Management",
            "subcategory": "Management",
            "text": "Assess the requirement for host pool auto-scaling capability",
            "description": "The scaling tool provides a low-cost automation option for customers who want to optimize their session host VM costs. You can use the scaling tool to schedule VMs to start and stop based on Peak and Off-Peak business hours, scale out VMs based on number of sessions per CPU core, scale in VMs during Off-Peak hours, leaving the minimum number of session host VMs running. Not available yet for Personal Host Pool type, recommended to have a separate setup for each host pool. ",
            "guid": "7138b820-102c-4e16-be30-1e6e872e52e3",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-scaling-script"
        },
        {
            "category": "Monitoring and Management",
            "subcategory": "Management",
            "text": "Periodically check Azure Advisor recommendations for AVD",
            "description": "Azure Advisor analyzes your configurations and telemetry to offer personalized recommendations to solve common problems. With these recommendations, you can optimize your Azure resources for reliability, security, operational excellence, performance, and cost.",
            "guid": "611dd68c-5a4b-4252-8e44-a59a9c2399c4",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/azure-advisor"
        },
        {
            "category": "Monitoring and Management",
            "subcategory": "Management",
            "text": "Plan for a golden image update management strategy",
            "description": "Prepare a strategy to manage updates to golden images, for example to apply security hotfixes and/or update applications installed inside the image. Azure Image Builder Service is a 1st party solution for automating the build and customization of VMs. ARM templates can be used to create new hosts, then decommission the old ones: https://github.com/Azure/RDS-Templates/tree/master/ARM-AVD-templates/AddVirtualMachinesToHostPool Recommended approach is to create a new pool side-by-side, easier to rollback, not usable for dedicated poolRe-deploy and increase the number of VMs with the ARM template is also a viable option. Customers may also want to use existing software distribution methods to update image without re-deploy, for example with SCCM or similar.",
            "guid": "d7b68d0c-7555-462f-8b3e-4563b4d874a7",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/image-builder-virtual-desktop"
        },
        {
            "category": "Monitoring and Management",
            "subcategory": "Management",
            "text": "Plan for a Session Host patching and update strategy",
            "description": "Customers can have several options:- Microsoft Endpoint Configuration Manager, this article explains how to configure Microsoft Endpoint Configuration Manager to automatically apply updates to a Windows Virtual Desktop host running Windows 10 Enterprise multi-session: https://learn.microsoft.com/azure/virtual-desktop/configure-automatic-updates- Microsoft Intune: https://learn.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop-multi-session- Windows Server Update Services (WSUS)- 3rd Party that supports you OS.- Azure Update Management (Azure Automation), today not supported for client OS: https://learn.microsoft.com/azure/automation/update-management/overview#unsupported-operating-systemsIt is recommended to move away from a patching strategy and move to a re-imaging strategy if possible. ",
            "guid": "04722da2-9c2b-41cd-922f-54b29bade3aa",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-machines/windows/image-builder-virtual-desktop"
        },
        {
            "category": "Monitoring and Management",
            "subcategory": "Management",
            "text": "Assess the requirement for a AVD test canary environment",
            "description": "Host pools are a collection of one or more identical virtual machines within Windows Virtual Desktop environment. We highly recommend you create a validation host pool where service updates are applied first. This allows you to monitor service updates before the service applies them to your standard or non-validation environment.",
            "guid": "d1e8c38e-c936-4667-913c-005674b1e944",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/create-validation-host-pool"
        },
        {
            "category": "Monitoring and Management",
            "subcategory": "Management",
            "text": "Determine Host Pool deployment strategy",
            "description": "A AVD Host Pool can be deployed in several ways: Azure Portal, ARM templates, Azure CLI tool, Powershell, manual VM creation with registration token, Terraform, etc. It is important to adopt proper method/s to support automatic deployment through automation and CI/CD tools.",
            "guid": "a459c373-e7ed-4616-83b3-65a917ecbe48",
            "severity": "Medium",
            "link": "https://github.com/Azure/RDS-Templates/tree/master/AVD-templates"
        },
        {
            "category": "Monitoring and Management",
            "subcategory": "Management",
            "text": "Turn on VMs regularly every 90 days for token refresh",
            "description": "After you register a VM to a host pool within the Windows Virtual Desktop service, the agent regularly refreshes the VM's token whenever the VM is active. The certificate for the registration token is valid for 90 days. Because of this 90-day limit, we recommend VMs to be online for 20 minutes every 90 days so that the machine can refresh its tokens and update the agent and side-by-side stack components.",
            "guid": "ebe54cd7-df2e-48bb-ac35-81559bb9153e",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/faq"
        },
        {
            "category": "Monitoring and Management",
            "subcategory": "Monitoring",
            "text": "Enable Azure Monitoring for AVD",
            "description": "Azure Monitor for Windows Virtual Desktop is a dashboard built on Azure Monitor Workbooks that helps IT professionals understand their Windows Virtual Desktop environments. Read the referenced article to learn how to set up Azure Monitor for Windows Virtual Desktop to monitor your Windows Virtual Desktop environments.",
            "guid": "63cfff1c-ac59-49ef-8d5a-83dd4de36c1c",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/azure-monitor"
        },
        {
            "category": "Monitoring and Management",
            "subcategory": "Monitoring",
            "text": "Enable and redirect diagnostic settings for Workspaces, Host Pools, Application Groups and Host VMs to Log Analytics workspace",
            "description": "Windows Virtual Desktop uses Azure Monitor and Log Analytics for monitoring and alerts like many other Azure services. This lets admins identify issues through a single interface. The service creates activity logs for both user and administrative actions.  Each activity log falls under the following categories: Management, Feed, Connections, Host Registration, Errors, Checkpoints. ",
            "guid": "81770afb-c4c0-4e43-a186-58d2857ed671",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/diagnostics-log-analytics"
        },
        {
            "category": "Monitoring and Management",
            "subcategory": "Monitoring",
            "text": "Create alerts on the profile storage to be alerted in case of high usage and throttling",
            "description": "See the referenced article and this additional one to setup proper monitoring and alerting for storage: https://learn.microsoft.com/azure/storage/files/storage-troubleshooting-files-performance. ",
            "guid": "2463cffe-179c-4599-be0d-5973dd4ce32c",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/storage/files/storage-files-monitoring?tabs=azure-portal"
        },
        {
            "category": "Monitoring and Management",
            "subcategory": "Monitoring",
            "text": "Configure Azure Service Health for AVD alerts ",
            "description": "You can use Azure Service Health to monitor service issues and health advisories for Windows Virtual Desktop. Azure Service Health can notify you with different types of alerts (for example, email or SMS), help you understand the effect of an issue, and keep you updated as the issue resolves.",
            "guid": "18813706-f7c4-4c0d-9e51-4548d2457ed6",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-service-alerts"
        },
        {
            "category": "Networking",
            "subcategory": "Networking",
            "text": "Review hybrid connectivity architecture for on-premises environment",
            "description": "Which type of hybrid connectivity? Express Route, VPN, NVA?",
            "guid": "c8639648-a652-4d6c-85e5-02965388e5de",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/"
        },
        {
            "category": "Networking",
            "subcategory": "Networking",
            "text": "Assess which resources users will need to access from AVD Host Pools to on-premises",
            "description": "Evaluate the bandwidth requirements, ensure VPN/ER bandwidth will be enough, and latency tolerable. ",
            "guid": "d227dd14-2b06-4c21-a799-9a646f4389a7",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/"
        },
        {
            "category": "Networking",
            "subcategory": "Networking",
            "text": "Review landing zone networking topology for AVD service",
            "description": "Review or recommend a new one where to place AVD Host Pools based on CAF (vWAN vs. Hub & Spoke)",
            "guid": "f42c78e7-8c06-4a63-a21a-4956e6a8dc4a",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/networking-options"
        },
        {
            "category": "Networking",
            "subcategory": "Networking",
            "text": "Assess VNET and subnet placement for multiple Host Pools",
            "description": "Ensure each subnet will have enough space to scale the AVD Host Pool. For different Host Pools, it is recommended to use separate subnets  if possible. ",
            "guid": "20e27b3e-2971-41b1-952b-eee079b588de",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix"
        },
        {
            "category": "Networking",
            "subcategory": "Networking",
            "text": "Need to control/restrict Internet outbound traffic for AVD hosts? ",
            "description": "Several options are available. You can use Azure Firewall or NVA Firewall, NSG and/or Proxy. NSG is not able to enable/disable by URL, only ports and protocols.Proxy should be used only as explicit setting in user browser. Details on using Azure Firewall Premium with AVD are here on https://aka.ms/AVDfirewall and here https://learn.microsoft.com/azure/firewall/protect-windows-virtual-desktop. Be sure to review full list of requirements for AVD URLs access.",
            "guid": "fc4972cd-3cd2-41bf-9703-6e5e6b4bed3d",
            "severity": "Medium",
            "link": "https://aka.ms/AVDfirewall"
        },
        {
            "category": "Networking",
            "subcategory": "Networking",
            "text": "Need to control/restrict Internet outbound traffic only for users on AVD hosts? ",
            "description": "Consider the usage of Azure Defender Endpoint to control user web navigation, see the Security section for more details. ",
            "guid": "73676ae4-6691-4e88-95ad-a42223e13810",
            "severity": "Medium",
            "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/windows-virtual-desktop-support-is-now-generally-available/ba-p/2103712"
        },
        {
            "category": "Networking",
            "subcategory": "Networking",
            "text": "Review UDR for AVD Host Pool subnet",
            "description": "Custom UDR can be applied to AVD Host Pool subnet, for example to redirect to Azure Firewall or NVA. In this case is recommended to carefully review to ensure optimal path for outbound traffic to AVD control plane is used. Service Tags can now be used with UDR, then AVD management plane traffic can be easily whitelisted. https://learn.microsoft.com/azure/firewall/protect-windows-virtual-desktop#host-pool-outbound-access-to-windows-virtual-desktop ",
            "guid": "523181a9-4174-4158-93ff-7ae7c6d37431",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/firewall/protect-windows-virtual-desktop"
        },
        {
            "category": "Networking",
            "subcategory": "Networking",
            "text": "Ensure AVD control plane endpoints are accessible",
            "description": "Required URLs for AVD control plane access by session hosts are documented here: https://learn.microsoft.com/azure/virtual-desktop/safe-url-list. A check tool is available to verify connectivity from the session hosts: https://learn.microsoft.com/azure/virtual-desktop/safe-url-list#required-url-check-tool.",
            "guid": "65c7acbe-45bb-4e60-ad89-f2e87778424d",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/safe-url-list"
        },
        {
            "category": "Networking",
            "subcategory": "Networking",
            "text": "Check the network bandwidth required for each user and in total for the VM SKU",
            "description": "It is recommended to assess and review networking bandwidth requirements for users, based on the specific workload type. The referenced article provide general estimations and recommendations, but specific measure are required for proper sizing. ",
            "guid": "516785c6-fa96-4c96-ad88-408f372734c8",
            "severity": "Low",
            "link": "https://learn.microsoft.com/windows-server/remote/remote-desktop-services/network-guidance"
        },
        {
            "category": "Security",
            "subcategory": "Host Configuration",
            "text": "Ensure AVD users will not have local admin privileges on AVD Hosts. ",
            "description": "We recommend you don't grant your users admin access to virtual desktops. If you need software packages, we recommend you make them available through configuration management utilities like Microsoft Endpoint Manager. In a multi-session environment, we recommend you don't let users install software directly.",
            "guid": "a0cdb3b5-4eb2-4eb0-9dda-a3592718e2ed",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide"
        },
        {
            "category": "Security",
            "subcategory": "Host Configuration",
            "text": "Ensure anti-virus and anti-malware solution is used",
            "description": "Microsoft Defender for Endpoint now supports Windows Virtual Desktop for Windows 10 Enterprise multi-session.Check article for onboarding non-persistent virtual desktop infrastructure (VDI) devices: https://learn.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi",
            "guid": "b1172576-9ef6-4691-a483-5ac932223ece",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide"
        },
        {
            "category": "Security",
            "subcategory": "Host Configuration",
            "text": "Ensure proper AV exclusions are in place",
            "description": "Be sure the following exclusions are in place: https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix#antivirus-exclusions .",
            "guid": "80b12308-1a54-4174-8583-3ea3ad2c2de7",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix"
        },
        {
            "category": "Security",
            "subcategory": "Host Configuration",
            "text": "Assess disk encryption requirements for AVD Hosts",
            "description": "Disks in Azure are already encrypted at rest by default with Microsoft managed keys.Host VM OS disk encryption is possible and supported using ADE and DES: sensible and persistent user data should not be stored on the Session Host disk, then it should be used only if strictly required for compliance reason. Encryption of FSLogix storage using Azure Files can be done using SSE on Azure Storage.For OneDrive encryption, see this article: https://learn.microsoft.com/compliance/assurance/assurance-encryption-for-microsoft-365-services.",
            "guid": "0fd32907-98bc-4178-adc5-a06ca7144351",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide"
        },
        {
            "category": "Security",
            "subcategory": "Host Configuration",
            "text": "Need to control/restrict user Internet navigation from AVD session hosts?",
            "description": "Consider the usage of Azure Defender Endpoint to control user web navigation. ",
            "guid": "e19dd344-29eb-4722-a237-a151c5bb4e4f",
            "severity": "Medium",
            "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/windows-virtual-desktop-support-is-now-generally-available/ba-p/2103712"
        },
        {
            "category": "Security",
            "subcategory": "Security",
            "text": "Evaluate the usage of Azure Security Center (ASC) for AVD Session Hosts",
            "description": "We recommend you enable Azure Security Center Standard for subscriptions, virtual machines, key vaults, and storage accounts.With Azure Security Center Standard is possible to assess and manage vulnerabilities, assess compliance with common frameworks like PCI, strengthen the overall security of your AVD environment.",
            "guid": "1814387e-5ca9-4c26-a9b3-2ab5bdfc6998",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide"
        },
        {
            "category": "Security",
            "subcategory": "Security",
            "text": "Review Active Directory GPOs to secure RDP sessions",
            "description": "Should be used, for example to impose desktop lockout and idle session termination. Existing GPOs applied to on-premises environment should be reviewed and eventually applied to secure also AVD Hosts. ",
            "guid": "a135e337-897e-431c-97d6-8cb6a22ac19f",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide"
        },
        {
            "category": "Security",
            "subcategory": "Security",
            "text": "Evaluate the usage of MFA for AVD users",
            "description": "For additional details and insights, see this article: https://christiaanbrinkhoff.com/2020/03/23/learn-how-to-increase-the-security-level-of-your-windows-virtual-desktop-environment-e-g-windows-client-with-azure-mfa-and-conditional-access",
            "guid": "916d697d-8ead-4ed2-9bdd-186f1ac252b9",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-mfa"
        },
        {
            "category": "Security",
            "subcategory": "Security",
            "text": "Evaluate the usage of Conditional Access for users",
            "description": "Enabling Conditional Access lets you manage risks before you grant users access to your Windows Virtual Desktop environment. When deciding which users to grant access to, we recommend you also consider who the user is, how they sign in, and which device they're using.",
            "guid": "556246b4-3856-44b4-bc74-a748b6633ad2",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide"
        },
        {
            "category": "Security",
            "subcategory": "Security",
            "text": "Enable diagnostic and audit logging to central Log Analytics workspace",
            "description": "Enabling audit log collection lets you view user and admin activity related to Windows Virtual Desktop. This is also a requirement to enable and use AVD Monitoring tool. Highly recommended to enable. ",
            "guid": "a0916a76-4980-4ad0-b278-ee293c1bc352",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide"
        },
        {
            "category": "Security",
            "subcategory": "Security",
            "text": "Assess the requirement to use custom RBAC roles for AVD management ",
            "description": "AVD uses Azure role-based access controls (RBAC) to assign roles to users and admins. These roles give admins permission to carry out certain tasks. If separation of duties is required, Windows Virtual Desktop has additional roles that let you separate management roles for host pools, app groups, and workspaces. This separation lets you have more granular control over administrative tasks. These roles are named in compliance with Azure's standard roles and least-privilege methodology.",
            "guid": "baaab757-1849-4ab8-893d-c9fc9d1bb73b",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/rbac"
        },
        {
            "category": "Security",
            "subcategory": "Security",
            "text": "Review all security best practices for AVD environment",
            "description": "A comprehensive set of security best practices and recommendations are contained in the referenced article, it is recommended to review. ",
            "guid": "36a5a67f-bb9e-4d5b-9547-8c4479816b28",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide"
        },
        {
            "category": "Storage",
            "subcategory": "FSLogix",
            "text": "Determine which storage backend solution will be used for FSLogix Profile and Office Containers",
            "description": "Azure NetApp Files, Azure Files, VM based File Server. File-server not recommended. Azure Files Premium typically a good starting point. NetApp only usually required for large scale / high-performant environment. ",
            "guid": "ed6b17db-8255-4462-b2ae-e4553afc8339",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/store-fslogix-profile"
        },
        {
            "category": "Storage",
            "subcategory": "FSLogix",
            "text": "Evaluate the possibility to separate Profile Containers from Office Containers",
            "description": "The recommendation in Windows Virtual Desktop is to use Profile Container without Office Container unless you are planning for specific Business Continuity and Disaster Recovery (BCDR) scenarios as described in the Disaster Recovery section below. https://learn.microsoft.com/fslogix/profile-container-office-container-cncpt ",
            "guid": "df47d2d9-2881-4b1c-b5d1-e54a29759e39",
            "severity": "Low",
            "link": "https://learn.microsoft.com/fslogix/profile-container-office-container-cncpt"
        },
        {
            "category": "Storage",
            "subcategory": "FSLogix",
            "text": "Verify storage scalability limits to support Host Pool requirements",
            "description": "As a starting point for estimating profile container storage performance requirements we recommend to assume 10 IOPS per user in the steady state and 50 IOPS per user during sign-in/sign-out.",
            "guid": "680e7828-9c93-4665-9d02-bff4564b0d93",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix"
        },
        {
            "category": "Storage",
            "subcategory": "FSLogix",
            "text": "If NetApp Files storage is used, check storage service availability in your specific region.",
            "description": "If a second region is required for DR purposes verify NetApp availability there as well.",
            "guid": "4a359836-ee79-4d6c-9d3a-364a5b7abae3",
            "severity": "Medium",
            "link": "https://azure.microsoft.com/global-infrastructure/services/"
        },
        {
            "category": "Storage",
            "subcategory": "FSLogix",
            "text": "For optimal performance, the storage solution and the FSLogix profile container should be in the same data-center location.",
            "description": "Avoid introducing additional latency and costs associated with cross-region network traffic where possible.",
            "guid": "8aad53cc-79e2-4e86-9673-57c549675c5e",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/fslogix-containers-azure-files"
        },
        {
            "category": "Storage",
            "subcategory": "FSLogix",
            "text": "Configure the recommended antivirus exclusions for FSLogix (includes not scanning VHD(x) files on connect).",
            "description": "Make sure to configure the following antivirus exclusions for FSLogix Profile Container virtual hard drives, as documented in the referenced article.",
            "guid": "83f63047-22ee-479d-9b5c-3632054b69ba",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix"
        },
        {
            "category": "Storage",
            "subcategory": "FSLogix",
            "text": "Review FSLogix registry keys and determine which ones to apply",
            "description": "Default basic and recommended settings are here: https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix#best-practice-settings-for-enterprises See here for core set: https://learn.microsoft.com/fslogix/configure-profile-container-tutorialSee here for complete reference: https://learn.microsoft.com/fslogix/profile-container-configuration-reference ",
            "guid": "d34aad5e-8c78-4e1d-9666-7313c405674c",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix"
        },
        {
            "category": "Storage",
            "subcategory": "FSLogix",
            "text": "Check usage of concurrent or multiple connections to the same profile",
            "description": "Concurrent or multiple connections are discouraged in Windows Virtual Desktop. The best practice is to create a different profile location for each session (as a host pool).",
            "guid": "5e985b85-9c77-43e7-b261-623b775a917e",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix"
        },
        {
            "category": "Storage",
            "subcategory": "FSLogix",
            "text": "Review best practices and key considerations for storage sizing",
            "description": "As a general estimation, to be validated in a test environment, for each user 5 - 15 IOPS should be first considered, depending on the workload. Azure Files: Premium max 100k IOPS per share (max 100TB) and up to 5Gbps with 3ms latency. Be aware of how Azure Files is provisioned, that is IOPS strictly tied t'o provisioned SIZE. Burst sizing capability in some cases. Be sure to provision UPFRONT more space than required to be sure to have enough IOPS. NOTE: Azure Premium maybe cheaper than Standard because you don't pay transactions, then important detail to keep in mind.Azure NetApp Files: remember max 1000 IPs connected, can adjust IOPS on the fly, minimum 4TB provisioned capacity. ",
            "guid": "1f348ff3-64d2-47d4-8e8b-bbc868155abb",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/virtual-desktop/store-fslogix-profile"
        },
        {
            "category": "Storage",
            "subcategory": "FSLogix",
            "text": "Check best-practices for Azure Files (if used)",
            "description": "Make sure to check the list of best practices and recommendations described in the referenced article.",
            "guid": "9164e990-9ae2-48c8-9c33-b6b7808bafe6",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix"
        },
        {
            "category": "Storage",
            "subcategory": "FSLogix",
            "text": "Check best-practices for NetApp Files (if used)",
            "description": "Make sure to check the list of best practices and recommendations described in the referenced article.",
            "guid": "c42149d4-13a9-423c-9574-d11028ac6aae",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/AVD/windows-virtual-desktop-fslogix"
        },
        {
            "category": "Storage",
            "subcategory": "FSLogix",
            "text": "Review and confirm configured maximum profile size in FSLogix",
            "description": "Profile containers have a default max size of 30GB. If large Profile Containers are anticipated, and customers wants to try to keep them small, consider using OneDrive to host Office 365 files outside the FSLogix profile.",
            "guid": "01e6a84d-e5df-443d-8992-481718d5d1e5",
            "severity": "High",
            "link": "https://learn.microsoft.com/fslogix/profile-container-configuration-reference"
        },
        {
            "category": "Storage",
            "subcategory": "FSLogix",
            "text": "If FSLogix Cloud Cache is used, move the Cache directory to temporary drive.",
            "description": "Cloud Cache uses local disk as cache and may generate lot of pressure on the VM disk. Recommended to leverage the power of temporary (and locally attached) VM disk, if possible based on the VM SKU. ",
            "guid": "b2d1215a-e114-4ba3-9df5-85ecdcd9bd3b",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/fslogix/cloud-cache-configuration-reference"
        },
        {
            "category": "Storage",
            "subcategory": "FSLogix",
            "text": "Review the usage of FSLogix redirection.",
            "description": "REDIRECTION.XML file is used to control what folders are redirected out of the profile container to the C: drive. Exclusions should be the exception and should never be used unless the specific exclusion is completely understood by the person configuring the exclusion. Exclusions should always be fully tested in the environment where they are intended to be implemented. Configuring exclusions may impact functionality, stability and performance.",
            "guid": "0b50ca97-b1d2-473c-b4d9-6e98b0f912de",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/fslogix/manage-profile-content-cncpt#redirectionsxml"
        },
        {
            "category": "Storage",
            "subcategory": "FSLogix",
            "text": "If Azure NetApp Files storage is used, check AD Site name setting in the AD Connection.",
            "description": "An Active Directory Site should be created for the Azure virtual network environment where ANF subnet will be created, and that site name should be specified in the ANF connection property when executing the join procedure as explained in the reference article.",
            "guid": "6647e977-db49-48a8-bc35-743f17499d42",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/azure-netapp-files/create-active-directory-connections"
        },
        {
            "category": "Storage",
            "subcategory": "FSLogix",
            "text": "Enable SMB multichannel when using a premium file share to host FSLogix profile containers.",
            "description": "SMB Multichannel enables clients to use multiple network connections that provide increased performance while lowering the cost of ownership. Increased performance is achieved through bandwidth aggregation over multiple NICs and utilizing Receive Side Scaling (RSS) support for NICs to distribute the IO load across multiple CPUs.",
            "guid": "5784b6ca-5e9e-4bcf-8b54-c95459ea7369",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/storage/files/storage-files-smb-multichannel-performance"
        },
        {
            "category": "Storage",
            "subcategory": "Session Host ",
            "text": "Determine which type of managed disk will be used for the Session Hosts  ",
            "description": "Standard HDD, Standard SSD, or Premium SSD, Ephemeral disks are not supported, Ultra-Disks not recommended. Recommended to evaluate Premium for OS disk if user density is not low, and if you are going to use Cloud Cache. ",
            "guid": "3611c818-b0a0-4bc5-80e4-3a18a9cd289c",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types"
        }
    ],
    "categories": [
        {
            "name": "Foundation"
        },
        {
            "name": "Identity"
        },
        {
            "name": "Networking"
        },
        {
            "name": "Compute"
        },
        {
            "name": "Storage"
        },
        {
            "name": "Security"
        },
        {
            "name": "Monitoring and Management"
        },
        {
            "name": "BC/DR"
        }
    ],
    "status": [
        {
            "name": "Not verified",
            "description": "This check has not been looked at yet"
        },
        {
            "name": "Open",
            "description": "There is an action item associated to this check"
        },
        {
            "name": "Fulfilled",
            "description": "This check has been verified, and there are no further action items associated to it"
        },
        {
            "name": "Not required",
            "description": "Recommendation understood, but not needed by current requirements"
        },
        {
            "name": "N/A",
            "description": "Not applicable for current design"
        }
    ],
    "severities": [
        {
            "name": "High"
        },
        {
            "name": "Medium"
        },
        {
            "name": "Low"
        }
    ],
    "metadata": {
        "name": "Azure Virtual Desktop Review",
        "timestamp": "Feb 14, 2023",
        "state": "GA"
    }
}
checklists/asb_security_checklist.pt.json METASEP
{
    "categories": [
        {
            "name": "Segurança"
        }
    ],
    "items": [
        {
            "category": "Segurança",
            "description": "O Barramento de Serviço Premium do Azure fornece criptografia de dados em repouso. Se você usar sua própria chave, os dados ainda serão criptografados usando a chave gerenciada pela Microsoft, mas, além disso, a chave gerenciada pela Microsoft será criptografada usando a chave gerenciada pelo cliente. ",
            "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
            "severity": "Baixo",
            "subcategory": "Proteção de Dados",
            "text": "Usar a opção de chave gerenciada pelo cliente na criptografia de dados em repouso quando necessário",
            "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/"
        },
        {
            "category": "Segurança",
            "description": "A comunicação entre um aplicativo cliente e um namespace do Barramento de Serviço do Azure é criptografada usando TLS (Transport Layer Security). Os namespaces do Barramento de Serviço do Azure permitem que os clientes enviem e recebam dados com o TLS 1.0 e superior. Para impor medidas de segurança mais rigorosas, você pode configurar o namespace do Service Bus para exigir que os clientes enviem e recebam dados com uma versão mais recente do TLS.",
            "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
            "severity": "Média",
            "subcategory": "Proteção de Dados",
            "text": "Impor uma versão mínima necessária do Transport Layer Security (TLS) para solicitações ",
            "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/"
        },
        {
            "category": "Segurança",
            "description": "Quando você cria um namespace do Barramento de Serviço, uma regra SAS chamada RootManageSharedAccessKey é criada automaticamente para o namespace. Essa política tem permissões de Gerenciar para todo o namespace. É recomendável que você trate essa regra como uma conta raiz administrativa e não a use em seu aplicativo.  Recomenda-se o uso do AAD como um provedor de autenticação com RBAC. ",
            "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
            "severity": "Média",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "Evite usar a conta root quando não for necessário",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/"
        },
        {
            "category": "Segurança",
            "description": "Um aplicativo cliente do Barramento de Serviço em execução dentro de um aplicativo do Serviço de Aplicativo do Azure ou em uma máquina virtual com entidades gerenciadas habilitadas para suporte a recursos do Azure não precisa manipular regras e chaves SAS ou quaisquer outros tokens de acesso. O aplicativo cliente só precisa do endereço do ponto de extremidade do namespace do Service Bus Messaging. ",
            "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity",
            "severity": "Média",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "Quando possível, seu aplicativo deve estar usando uma identidade gerenciada para autenticar no Barramento de Serviço do Azure. Caso contrário, considere ter a credencial de armazenamento (SAS, credencial da entidade de serviço) no Cofre da Chave do Azure ou em um serviço equivalente",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "Segurança",
            "description": "Ao criar permissões, forneça controle refinado sobre o acesso de um cliente ao Barramento de Serviço do Azure. As permissões no Barramento de Serviço do Azure podem e devem ser definidas para o nível de recurso individual, por exemplo, fila, tópico ou assinatura. ",
            "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
            "severity": "Alto",
            "subcategory": "Gerenciamento de Identidade e Acesso",
            "text": "Usar RBAC do plano de dados de privilégios mínimos",
            "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/"
        },
        {
            "category": "Segurança",
            "description": "Os logs de recursos do Barramento de Serviço do Azure incluem logs operacionais, rede virtual e logs de filtragem de IP. Os logs de auditoria de tempo de execução capturam informações de diagnóstico agregadas para várias operações de acesso ao plano de dados (como enviar ou receber mensagens) no Service Bus.",
            "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Habilite o log para investigação de segurança. Usar o Azure Monitor para rastrear logs de recursos e logs de auditoria de tempo de execução (atualmente disponíveis somente na camada premium)",
            "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/"
        },
        {
            "category": "Segurança",
            "description": "O Barramento de Serviço do Azure, por padrão, tem um endereço IP público e pode ser acessado pela Internet. Os pontos de extremidade privados permitem que o tráfego entre sua rede virtual e o Barramento de Serviço do Azure percorra a rede backbone da Microsoft. Além disso, você deve desabilitar pontos de extremidade públicos se eles não forem usados. ",
            "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
            "severity": "Média",
            "subcategory": "Rede",
            "text": "Considere o uso de pontos de extremidade privados para acessar o Barramento de Serviço do Azure e desabilitar o acesso à rede pública, quando aplicável.",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "Segurança",
            "description": "Com o firewall IP, você pode restringir o ponto de extremidade público ainda mais a apenas um conjunto de endereços IPv4 ou intervalos de endereços IPv4 na notação CIDR (Roteamento entre Domínios Sem Classe). ",
            "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
            "severity": "Média",
            "subcategory": "Rede",
            "text": "Considere permitir apenas o acesso ao namespace do Barramento de Serviço do Azure a partir de endereços IP ou intervalos específicos",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        }
    ],
    "metadata": {
        "name": "Azure Service Bus Review"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Média"
        },
        {
            "name": "Baixo"
        }
    ],
    "status": [
        {
            "description": "Esta verificação ainda não foi analisada",
            "name": "Não verificado"
        },
        {
            "description": "Há um item de ação associado a essa verificação",
            "name": "Abrir"
        },
        {
            "description": "Essa verificação foi verificada e não há mais itens de ação associados a ela",
            "name": "Cumprido"
        },
        {
            "description": "Recomendação entendida, mas não necessária pelos requisitos atuais",
            "name": "Não é necessário"
        },
        {
            "description": "Não aplicável ao projeto atual",
            "name": "N/A"
        }
    ]
}
checklists/asb_security_checklist.ko.json METASEP
{
    "categories": [
        {
            "name": "안전"
        }
    ],
    "items": [
        {
            "category": "안전",
            "description": "Azure 서비스 버스 프리미엄은 미사용 데이터의 암호화를 제공합니다. 사용자 고유의 키를 사용하는 경우 데이터는 여전히 Microsoft 관리형 키를 사용하여 암호화되지만 Microsoft 관리형 키는 고객 관리형 키를 사용하여 암호화됩니다. ",
            "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
            "severity": "낮다",
            "subcategory": "데이터 보호",
            "text": "필요한 경우 미사용 데이터 암호화에서 고객 관리형 키 옵션 사용",
            "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/"
        },
        {
            "category": "안전",
            "description": "클라이언트 응용 프로그램과 Azure 서비스 버스 네임스페이스 간의 통신은 TLS(전송 계층 보안)를 사용하여 암호화됩니다. Azure 서비스 버스 네임스페이스를 사용하면 클라이언트가 TLS 1.0 이상을 사용하여 데이터를 보내고 받을 수 있습니다. 더 엄격한 보안 조치를 적용하려면 클라이언트가 최신 버전의 TLS를 사용하여 데이터를 보내고 받도록 Service Bus 네임스페이스를 구성할 수 있습니다.",
            "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
            "severity": "보통",
            "subcategory": "데이터 보호",
            "text": "요청에 필요한 최소 버전의 TLS(전송 계층 보안) 적용 ",
            "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/"
        },
        {
            "category": "안전",
            "description": "서비스 버스 네임스페이스를 만들면 네임스페이스에 대해 RootManageSharedAccessKey라는 SAS 규칙이 자동으로 만들어집니다. 이 정책에는 전체 네임스페이스에 대한 관리 권한이 있습니다. 이 규칙을 관리 루트 계정처럼 취급하고 애플리케이션에서 사용하지 않는 것이 좋습니다.  AAD를 RBAC와 함께 인증 공급자로 사용하는 것이 좋습니다. ",
            "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
            "severity": "보통",
            "subcategory": "ID 및 액세스 관리",
            "text": "필요하지 않은 경우 루트 계정을 사용하지 마십시오.",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/"
        },
        {
            "category": "안전",
            "description": "Azure 앱 서비스 응용 프로그램 내에서 또는 Azure 리소스 지원을 위해 관리되는 엔터티를 사용하도록 설정된 가상 컴퓨터에서 실행되는 서비스 버스 클라이언트 앱은 SAS 규칙 및 키 또는 기타 액세스 토큰을 처리할 필요가 없습니다. 클라이언트 앱에는 서비스 버스 메시징 네임스페이스의 끝점 주소만 필요합니다. ",
            "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity",
            "severity": "보통",
            "subcategory": "ID 및 액세스 관리",
            "text": "가능한 경우 응용 프로그램에서 관리 ID를 사용하여 Azure 서비스 버스에 인증해야 합니다. 그렇지 않은 경우 Azure Key Vault 또는 이와 동등한 서비스에 스토리지 자격 증명(SAS, 서비스 주체 자격 증명)이 있는 것이 좋습니다.",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "안전",
            "description": "사용 권한을 만들 때 Azure Service Bus에 대한 클라이언트의 액세스를 세부적으로 제어할 수 있습니다. Azure Service Bus의 사용 권한은 개별 리소스 수준(예: 큐, 항목 또는 구독)으로 범위를 지정할 수 있으며 그래야 합니다. ",
            "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
            "severity": "높다",
            "subcategory": "ID 및 액세스 관리",
            "text": "최소 권한 데이터부 RBAC 사용",
            "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/"
        },
        {
            "category": "안전",
            "description": "Azure 서비스 버스 리소스 로그에는 작업 로그, 가상 네트워크 및 IP 필터링 로그가 포함됩니다. 런타임 감사 로그는 Service Bus의 다양한 데이터 평면 액세스 작업(예: 메시지 보내기 또는 받기)에 대한 집계된 진단 정보를 캡처합니다.",
            "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "보안 조사를 위해 로깅을 사용하도록 설정합니다. Azure Monitor를 사용하여 리소스 로그 및 런타임 감사 로그 추적(현재 프리미엄 계층에서만 사용 가능)",
            "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/"
        },
        {
            "category": "안전",
            "description": "Azure 서비스 버스는 기본적으로 공용 IP 주소를 가지며 인터넷에 연결할 수 있습니다. 프라이빗 엔드포인트는 가상 네트워크와 Azure 서비스 버스 간의 트래픽이 Microsoft 백본 네트워크를 통해 통과하도록 허용합니다. 그 외에도 퍼블릭 엔드포인트를 사용하지 않는 경우 비활성화해야 합니다. ",
            "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
            "severity": "보통",
            "subcategory": "네트워킹",
            "text": "프라이빗 엔드포인트를 사용하여 Azure Service Bus에 액세스하고 해당하는 경우 공용 네트워크 액세스를 사용하지 않도록 설정하는 것이 좋습니다.",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "안전",
            "description": "IP 방화벽을 사용하면 퍼블릭 엔드포인트를 CIDR(클래스 없는 도메인 간 라우팅) 표기법의 IPv4 주소 집합 또는 IPv4 주소 범위로만 추가로 제한할 수 있습니다. ",
            "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
            "severity": "보통",
            "subcategory": "네트워킹",
            "text": "특정 IP 주소 또는 범위에서 Azure 서비스 버스 네임스페이스에 대한 액세스만 허용하는 것이 좋습니다.",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        }
    ],
    "metadata": {
        "name": "Azure Service Bus Review"
    },
    "severities": [
        {
            "name": "높다"
        },
        {
            "name": "보통"
        },
        {
            "name": "낮다"
        }
    ],
    "status": [
        {
            "description": "이 검사는 아직 검토되지 않았습니다.",
            "name": "확인되지 않음"
        },
        {
            "description": "이 검사와 연결된 작업 항목이 있습니다.",
            "name": "열다"
        },
        {
            "description": "이 검사가 확인되었으며 연결된 추가 작업 항목이 없습니다.",
            "name": "성취"
        },
        {
            "description": "권장 사항을 이해했지만 현재 요구 사항에서 필요하지 않음",
            "name": "필요하지 않음"
        },
        {
            "description": "현재 디자인에는 적용되지 않음",
            "name": "해당 없음"
        }
    ]
}
checklists/asb_security_checklist.ja.json METASEP
{
    "categories": [
        {
            "name": "安全"
        }
    ],
    "items": [
        {
            "category": "安全",
            "description": "Azure サービス バス プレミアムでは、保存データの暗号化が提供されます。独自のキーを使用する場合、データは引き続き Microsoft マネージド キーを使用して暗号化されますが、さらに Microsoft マネージド キーはカスタマー マネージド キーを使用して暗号化されます。",
            "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
            "severity": "低い",
            "subcategory": "データ保護",
            "text": "必要に応じて、保存データの暗号化でカスタマー マネージド キー オプションを使用する",
            "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/"
        },
        {
            "category": "安全",
            "description": "クライアント アプリケーションと Azure Service Bus 名前空間間の通信は、トランスポート層セキュリティ (TLS) を使用して暗号化されます。Azure サービス バス名前空間を使用すると、クライアントは TLS 1.0 以降を使用してデータを送受信できます。より厳格なセキュリティ対策を適用するには、クライアントが新しいバージョンの TLS を使用してデータを送受信することを要求するように Service Bus 名前空間を構成できます。",
            "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
            "severity": "中程度",
            "subcategory": "データ保護",
            "text": "要求に最低限必要なバージョンのトランスポート層セキュリティ (TLS) を適用する",
            "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/"
        },
        {
            "category": "安全",
            "description": "Service Bus 名前空間を作成すると、その名前空間に対して RootManageSharedAccessKey という名前の SAS 規則が自動的に作成されます。このポリシーには、名前空間全体に対する管理アクセス許可があります。このルールは管理ルートアカウントのように扱い、アプリケーションでは使用しないことをお勧めします。 RBAC で認証プロバイダーとして AAD を使用することをお勧めします。",
            "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
            "severity": "中程度",
            "subcategory": "ID およびアクセス管理",
            "text": "不要な場合はrootアカウントを使用しないでください",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/"
        },
        {
            "category": "安全",
            "description": "Azure App Service アプリケーション内、または Azure リソースのサポートが有効になっているマネージド エンティティを持つ仮想マシンで実行されている Service Bus クライアント アプリは、SAS の規則とキー、またはその他のアクセス トークンを処理する必要はありません。クライアント アプリに必要なのは、Service Bus メッセージング名前空間のエンドポイント アドレスのみです。",
            "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity",
            "severity": "中程度",
            "subcategory": "ID およびアクセス管理",
            "text": "可能であれば、アプリケーションはマネージド ID を使用して Azure Service Bus に対する認証を行う必要があります。そうでない場合は、ストレージ資格情報 (SAS、サービス プリンシパル資格情報) を Azure Key Vault または同等のサービスに配置することを検討してください。",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "安全",
            "description": "アクセス許可を作成するときは、Azure Service Bus へのクライアントのアクセスをきめ細かく制御します。 Azure Service Bus のアクセス許可は、個々のリソース レベル (キュー、トピック、サブスクリプションなど) にスコープを設定でき、またそうする必要があります。",
            "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
            "severity": "高い",
            "subcategory": "ID およびアクセス管理",
            "text": "最小特権データ プレーン RBAC を使用する",
            "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/"
        },
        {
            "category": "安全",
            "description": "Azure サービス バス リソース ログには、操作ログ、仮想ネットワーク、IP フィルタリング ログが含まれます。ランタイム監査ログは、Service Bus でのさまざまなデータ プレーン アクセス操作 (メッセージの送信や受信など) に関する集計された診断情報をキャプチャします。",
            "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "セキュリティ調査のログ記録を有効にします。Azure Monitor を使用してリソース ログとランタイム監査ログをトレースする (現在は Premium レベルでのみ使用可能)",
            "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/"
        },
        {
            "category": "安全",
            "description": "Azure サービス バスには既定でパブリック IP アドレスがあり、インターネットでアクセスできます。プライベート エンドポイントでは、仮想ネットワークと Azure Service Bus 間のトラフィックが Microsoft バックボーン ネットワーク経由で通過できます。それに加えて、パブリックエンドポイントが使用されていない場合は無効にする必要があります。",
            "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
            "severity": "中程度",
            "subcategory": "ネットワーキング",
            "text": "プライベート エンドポイントを使用して Azure Service Bus にアクセスし、該当する場合はパブリック ネットワーク アクセスを無効にすることを検討してください。",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "安全",
            "description": "IP ファイアウォールを使用すると、パブリック エンドポイントを CIDR (クラスレス ドメイン間ルーティング) 表記の IPv4 アドレスまたは IPv4 アドレス範囲のセットのみに制限できます。",
            "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
            "severity": "中程度",
            "subcategory": "ネットワーキング",
            "text": "特定の IP アドレスまたは範囲からの Azure Service Bus 名前空間へのアクセスのみを許可することを検討してください",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        }
    ],
    "metadata": {
        "name": "Azure Service Bus Review"
    },
    "severities": [
        {
            "name": "高い"
        },
        {
            "name": "中程度"
        },
        {
            "name": "低い"
        }
    ],
    "status": [
        {
            "description": "このチェックはまだ確認されていません",
            "name": "未確認"
        },
        {
            "description": "このチェックに関連付けられているアクションアイテムがあります",
            "name": "開ける"
        },
        {
            "description": "このチェックは検証済みであり、それ以上のアクションアイテムは関連付けられていません",
            "name": "達成"
        },
        {
            "description": "推奨事項は理解されていますが、現在の要件では必要ありません",
            "name": "必須ではありません"
        },
        {
            "description": "現在のデザインには適用できません",
            "name": "該当なし"
        }
    ]
}
checklists/asb_security_checklist.es.json METASEP
{
    "categories": [
        {
            "name": "Seguridad"
        }
    ],
    "items": [
        {
            "category": "Seguridad",
            "description": "Azure Service Bus Premium proporciona cifrado de datos en reposo. Si usa su propia clave, los datos aún se cifran con la clave administrada por Microsoft, pero además la clave administrada por Microsoft se cifrará con la clave administrada por el cliente. ",
            "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key",
            "severity": "Bajo",
            "subcategory": "Protección de datos",
            "text": "Usar la opción de clave administrada por el cliente en el cifrado de datos en reposo cuando sea necesario",
            "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/"
        },
        {
            "category": "Seguridad",
            "description": "La comunicación entre una aplicación cliente y un espacio de nombres de Azure Service Bus se cifra mediante Seguridad de la capa de transporte (TLS). Los espacios de nombres de Azure Service Bus permiten a los clientes enviar y recibir datos con TLS 1.0 y versiones posteriores. Para aplicar medidas de seguridad más estrictas, puede configurar el espacio de nombres de Service Bus para que requiera que los clientes envíen y reciban datos con una versión más reciente de TLS.",
            "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version",
            "severity": "Medio",
            "subcategory": "Protección de datos",
            "text": "Aplicar una versión mínima requerida de Seguridad de la capa de transporte (TLS) para las solicitudes ",
            "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/"
        },
        {
            "category": "Seguridad",
            "description": "Al crear un espacio de nombres de Service Bus, se crea automáticamente una regla SAS denominada RootManageSharedAccessKey para el espacio de nombres. Esta directiva tiene permisos de administración para todo el espacio de nombres. Se recomienda tratar esta regla como una cuenta raíz administrativa y no usarla en la aplicación.  Se recomienda usar AAD como proveedor de autenticación con RBAC. ",
            "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies",
            "severity": "Medio",
            "subcategory": "Gestión de identidades y accesos",
            "text": "Evite usar una cuenta root cuando no sea necesario",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/"
        },
        {
            "category": "Seguridad",
            "description": "Una aplicación cliente de Service Bus que se ejecuta dentro de una aplicación del Servicio de aplicaciones de Azure o en una máquina virtual con entidades administradas habilitadas para la compatibilidad con recursos de Azure no necesita controlar reglas y claves de SAS, ni ningún otro token de acceso. La aplicación cliente solo necesita la dirección de extremo del espacio de nombres Mensajería de Service Bus. ",
            "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity",
            "severity": "Medio",
            "subcategory": "Gestión de identidades y accesos",
            "text": "Siempre que sea posible, la aplicación debe usar una identidad administrada para autenticarse en Azure Service Bus. Si no es así, considere la posibilidad de tener la credencial de almacenamiento (SAS, credencial de entidad de servicio) en Azure Key Vault o un servicio equivalente",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "Seguridad",
            "description": "Al crear permisos, proporcione un control detallado sobre el acceso de un cliente a Azure Service Bus. Los permisos de Azure Service Bus pueden y deben limitarse al nivel de recurso individual, por ejemplo, cola, tema o suscripción. ",
            "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus",
            "severity": "Alto",
            "subcategory": "Gestión de identidades y accesos",
            "text": "Usar RBAC del plano de datos con privilegios mínimos",
            "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/"
        },
        {
            "category": "Seguridad",
            "description": "Los registros de recursos de Azure Service Bus incluyen registros operativos, redes virtuales y registros de filtrado de IP. Los registros de auditoría en tiempo de ejecución capturan información de diagnóstico agregada para diversas operaciones de acceso al plano de datos (como enviar o recibir mensajes) en Service Bus.",
            "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Habilite el registro para la investigación de seguridad. Usar Azure Monitor para realizar un seguimiento de los registros de recursos y los registros de auditoría en tiempo de ejecución (actualmente disponible solo en el nivel premium)",
            "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/"
        },
        {
            "category": "Seguridad",
            "description": "De forma predeterminada, Azure Service Bus tiene una dirección IP pública y es accesible desde Internet. Los puntos de conexión privados permiten que el tráfico entre la red virtual y Azure Service Bus atraviese la red troncal de Microsoft. Además de eso, debe deshabilitar los puntos finales públicos si no se usan. ",
            "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service",
            "severity": "Medio",
            "subcategory": "Gestión de redes",
            "text": "Considere la posibilidad de usar puntos de conexión privados para acceder a Azure Service Bus y deshabilitar el acceso a la red pública cuando corresponda.",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/"
        },
        {
            "category": "Seguridad",
            "description": "Con el firewall IP, puede restringir el punto final público a solo un conjunto de direcciones IPv4 o intervalos de direcciones IPv4 en notación CIDR (Classless Inter-Domain Routing). ",
            "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering",
            "severity": "Medio",
            "subcategory": "Gestión de redes",
            "text": "Considere la posibilidad de permitir solo el acceso al espacio de nombres de Azure Service Bus desde direcciones IP o intervalos específicos",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/"
        }
    ],
    "metadata": {
        "name": "Azure Service Bus Review"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Medio"
        },
        {
            "name": "Bajo"
        }
    ],
    "status": [
        {
            "description": "Esta comprobación aún no se ha examinado",
            "name": "No verificado"
        },
        {
            "description": "Hay un elemento de acción asociado a esta comprobación",
            "name": "Abrir"
        },
        {
            "description": "Esta comprobación se ha comprobado y no hay más elementos de acción asociados a ella",
            "name": "Cumplido"
        },
        {
            "description": "Recomendación entendida, pero no necesaria por los requisitos actuales",
            "name": "No es necesario"
        },
        {
            "description": "No aplicable para el diseño actual",
            "name": "N/A"
        }
    ]
}
checklists/asb_security_checklist.en.json METASEP
{
    "items": [
        {
            "category": "Security",
            "subcategory": "Data Protection",
            "text": "Use customer-managed key option in data at rest encryption when required",
            "description": "Azure Service Bus Premium provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ",
            "guid": "87af4a79-1f89-439b-ba47-768e14c11567",
            "severity": "Low",
            "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key"
        },
        {
            "category": "Security",
            "subcategory": "Data Protection",
            "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ",
            "description": "Communication between a client application and an Azure Service Bus namespace is encrypted using Transport Layer Security (TLS). Azure Service Bus namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Service Bus namespace to require that clients send and receive data with a newer version of TLS.",
            "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Management",
            "text": "Avoid using root account when it is not necessary",
            "description": "When you create a Service Bus namespace, a SAS rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has Manage permissions for the entire namespace. It's recommended that you treat this rule like an administrative root account and don't use it in your application.  Using AAD as an authentication provider with RBAC is recommended. ",
            "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Management",
            "text": "When possible, your application should be using a managed identity to authenticate to Azure Service Bus. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service",
            "description": "A Service Bus client app running inside an Azure App Service application or in a virtual machine with enabled managed entities for Azure resources support does not need to handle SAS rules and keys, or any other access tokens. The client app only needs the endpoint address of the Service Bus Messaging namespace. ",
            "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Management",
            "text": "Use least privilege data plane RBAC",
            "description": "When creating permissions, provide fine-grained control over a client's access to Azure Service Bus. Permissions in Azure Service Bus can and should be scoped to the individual resource level e.g. queue, topic or subscription. ",
            "guid": "f615658d-e558-4f93-9249-b831112dbd7e",
            "severity": "High",
            "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus"
        },
        {
            "category": "Security",
            "subcategory": "Monitoring",
            "text": "Enable logging for security investigation. Use Azure Monitor to trace resource logs and runtime audit logs (currently available only in the premium tier)",
            "description": "Azure Service Bus resource logs include operational logs,  virtual network and IP filtering logs. Runtime audit logs capture aggregated diagnostic information for various data plane access operations (such as send or receive messages) in Service Bus.",
            "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference"
        },
        {
            "category": "Security",
            "subcategory": "Networking",
            "text": "Consider using private endpoints to access Azure Service Bus and disable public network access when applicable.",
            "description": "Azure Service Bus by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Service Bus traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ",
            "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service"
        },
        {
            "category": "Security",
            "subcategory": "Networking",
            "text": "Consider only allowing access to Azure Service Bus namespace from specific IP addresses or ranges",
            "description": "With IP firewall, you can restrict the public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ",
            "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a",
            "severity": "Medium",
            "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/",
            "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering"
        }
    ],
    "categories": [
        {
            "name": "Security"
        }
    ],
    "status": [
        {
            "name": "Not verified",
            "description": "This check has not been looked at yet"
        },
        {
            "name": "Open",
            "description": "There is an action item associated to this check"
        },
        {
            "name": "Fulfilled",
            "description": "This check has been verified, and there are no further action items associated to it"
        },
        {
            "name": "Not required",
            "description": "Recommendation understood, but not needed by current requirements"
        },
        {
            "name": "N/A",
            "description": "Not applicable for current design"
        }
    ],
    "severities": [
        {
            "name": "High"
        },
        {
            "name": "Medium"
        },
        {
            "name": "Low"
        }
    ],
    "metadata": {
        "name": "Azure Service Bus Review",
        "timestamp": "Feb 10, 2023",
        "state": "Preview"
    }
}
checklists/appsvc_security_checklist.pt.json METASEP
{
    "$schema": "checklist.schema.json",
    "categories": [
        {
            "name": "Segurança"
        }
    ],
    "items": [
        {
            "category": "Segurança",
            "description": "Use o Cofre da Chave do Azure para armazenar todos os segredos de que o aplicativo precisa.  O Cofre da Chave fornece um ambiente seguro e auditado para armazenar segredos e está bem integrado ao Serviço de Aplicativo por meio do SDK do Cofre da Chave ou das Referências do Cofre da Chave do Serviço de Aplicativo.",
            "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
            "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
            "severity": "Alto",
            "subcategory": "Proteção de Dados",
            "text": "Usar o Cofre da Chave para armazenar segredos"
        },
        {
            "category": "Segurança",
            "description": "Use uma Identidade Gerenciada para se conectar ao Cofre da Chave usando o SDK do Cofre da Chave ou por meio das Referências do Cofre da Chave do Serviço de Aplicativo.",
            "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
            "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
            "severity": "Alto",
            "subcategory": "Proteção de Dados",
            "text": "Usar a Identidade Gerenciada para se conectar ao Cofre da Chave"
        },
        {
            "category": "Segurança",
            "description": "Armazene o certificado TLS do Serviço de Aplicativo no Cofre da Chave.",
            "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
            "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
            "severity": "Alto",
            "subcategory": "Proteção de Dados",
            "text": "Use o Cofre da Chave para armazenar o certificado TLS."
        },
        {
            "category": "Segurança",
            "description": "Os sistemas que processam informações confidenciais devem ser isolados.  Para fazer isso, use Planos de Serviço de Aplicativo ou Ambientes de Serviço de Aplicativo separados e considere o uso de diferentes assinaturas ou grupos de gerenciamento.",
            "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
            "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
            "severity": "Média",
            "subcategory": "Proteção de Dados",
            "text": "Isolar sistemas que processam informações confidenciais"
        },
        {
            "category": "Segurança",
            "description": "Os discos locais no Serviço de Aplicativo não são criptografados e os dados confidenciais não devem ser armazenados neles.  (Por exemplo: D:\\\\Local e %TMP%).",
            "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
            "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
            "severity": "Média",
            "subcategory": "Proteção de Dados",
            "text": "Não armazene dados confidenciais no disco local"
        },
        {
            "category": "Segurança",
            "description": "Para aplicativos Web autenticados, use um Provedor de Identidade bem estabelecido, como o Azure AD ou o Azure AD B2C.  Aproveite a estrutura do aplicativo de sua escolha para se integrar a esse provedor ou use o recurso de Autenticação/Autorização do Serviço de Aplicativo.",
            "guid": "919ca0b2-c121-459e-814b-933df574eccc",
            "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
            "severity": "Média",
            "subcategory": "Controle de Identidade e Acesso",
            "text": "Usar um Provedor de Identidade estabelecido para autenticação"
        },
        {
            "category": "Segurança",
            "description": "Implante código no Serviço de Aplicativo a partir de um ambiente controlado e confiável, como um pipeline de implantação de DevOps bem gerenciado e seguro. Isso evita que o código que não foi controlado por versão e verificado seja implantado a partir de um host mal-intencionado.",
            "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
            "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
            "severity": "Alto",
            "subcategory": "Controle de Identidade e Acesso",
            "text": "Implantar a partir de um ambiente confiável"
        },
        {
            "category": "Segurança",
            "description": "Desative a autenticação básica para FTP/FTPS e para WebDeploy/SCM.  Isso desabilita o acesso a esses serviços e impõe o uso de pontos de extremidade protegidos do Azure AD para implantação.  Observe que o site do SCM também pode ser aberto usando credenciais do Azure AD.",
            "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
            "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
            "severity": "Alto",
            "subcategory": "Controle de Identidade e Acesso",
            "text": "Desabilitar a autenticação básica"
        },
        {
            "category": "Segurança",
            "description": "Sempre que possível, use a Identidade Gerenciada para se conectar aos recursos protegidos do Azure AD.  Se isso não for possível, armazene segredos no Cofre da Chave e conecte-se ao Cofre da Chave usando uma Identidade Gerenciada.",
            "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
            "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
            "severity": "Alto",
            "subcategory": "Controle de Identidade e Acesso",
            "text": "Usar a Identidade Gerenciada para se conectar a recursos"
        },
        {
            "category": "Segurança",
            "description": "Ao usar imagens armazenadas no Registro de Contêiner do Azure, extraia-as usando uma Identidade Gerenciada.",
            "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
            "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
            "severity": "Alto",
            "subcategory": "Controle de Identidade e Acesso",
            "text": "Extrair contêineres usando uma identidade gerenciada"
        },
        {
            "category": "Segurança",
            "description": "Ao definir as configurações de diagnóstico do Serviço de Aplicativo, você pode enviar toda a telemetria para o Log Analytics como o destino central para registro em log e monitoramento. Isso permite que você monitore a atividade de tempo de execução do Serviço de Aplicativo, como logs HTTP, logs de aplicativos, logs de plataforma, ...",
            "guid": "47768314-c115-4775-a2ea-55b46ad48408",
            "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
            "severity": "Média",
            "subcategory": "Registro em log e monitoramento",
            "text": "Enviar logs de tempo de execução do Serviço de Aplicativo para o Log Analytics"
        },
        {
            "category": "Segurança",
            "description": "Configure uma configuração de diagnóstico para enviar o registro de atividades para o Log Analytics como o destino central para registro em log e monitoramento. Isso permite que você monitore a atividade do plano de controle no próprio recurso do Serviço de Aplicativo.",
            "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
            "severity": "Média",
            "subcategory": "Registro em log e monitoramento",
            "text": "Enviar logs de atividade do Serviço de Aplicativo para o Log Analytics"
        },
        {
            "category": "Segurança",
            "description": "Controle o acesso à rede de saída usando uma combinação de integração de rede virtual regional, grupos de segurança de rede e UDR's.  O tráfego deve ser roteado para um NVA, como o Firewall do Azure.  Certifique-se de monitorar os logs do Firewall.",
            "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
            "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
            "severity": "Média",
            "subcategory": "Segurança de rede",
            "text": "O acesso à rede de saída deve ser controlado"
        },
        {
            "category": "Segurança",
            "description": "Você pode fornecer um IP de saída estável usando a integração de rede virtual e um gateway NAT de rede virtual ou um NVA como o Firewall do Azure.  Isso permite que a parte receptora permita a lista de permissões com base no IP, caso isso seja necessário.  Observe que, para comunicações com os Serviços do Azure, muitas vezes não há necessidade de depender do endereço IP e mecanismos como Pontos de Extremidade de Serviço devem ser usados.  (Além disso, o uso de pontos de extremidade privados na extremidade receptora evita que o SNAT aconteça e fornece um intervalo de IP de saída estável.)",
            "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
            "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
            "severity": "Baixo",
            "subcategory": "Segurança de rede",
            "text": "Garantir um IP estável para comunicações de saída para endereços de Internet"
        },
        {
            "category": "Segurança",
            "description": "Controle o acesso à rede de entrada usando uma combinação de Restrições de Acesso ao Serviço de Aplicativo, Pontos de Extremidade de Serviço ou Pontos de Extremidade Privados. Diferentes restrições de acesso podem ser necessárias e configuradas para o próprio aplicativo Web e o site do SCM.",
            "guid": "0725769e-e669-41a4-a34a-c932223ece80",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
            "severity": "Alto",
            "subcategory": "Segurança de rede",
            "text": "O acesso à rede de entrada deve ser controlado"
        },
        {
            "category": "Segurança",
            "description": "Proteja-se contra tráfego de entrada mal-intencionado usando um Firewall de Aplicativo Web, como o Gateway de Aplicativo ou o Azure Front Door.  Certifique-se de monitorar os logs do WAF.",
            "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
            "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
            "severity": "Alto",
            "subcategory": "Segurança de rede",
            "text": "Usar um WAF na frente do Serviço de Aplicativo"
        },
        {
            "category": "Segurança",
            "description": "Certifique-se de que o WAF não pode ser ignorado bloqueando o acesso apenas ao WAF.  Use uma combinação de Restrições de Acesso, Pontos de Extremidade de Serviço e Pontos de Extremidade Privados.",
            "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
            "severity": "Alto",
            "subcategory": "Segurança de rede",
            "text": "Evite que o WAF seja ignorado"
        },
        {
            "category": "Segurança",
            "description": "Defina a política TLS mínima como 1.2 na configuração do Serviço de Aplicativo.",
            "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
            "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
            "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
            "severity": "Média",
            "subcategory": "Segurança de rede",
            "text": "Definir a política TLS mínima como 1.2"
        },
        {
            "category": "Segurança",
            "description": "Configure o Serviço de Aplicativo para usar somente HTTPS.  Isso faz com que o Serviço de Aplicativo redirecione de HTTP para HTTPS.  Considere fortemente o uso de HTTP Strict Transport Security (HSTS) em seu código ou em seu WAF, que informa aos navegadores que o site só deve ser acessado usando HTTPS.",
            "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
            "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
            "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
            "severity": "Alto",
            "subcategory": "Segurança de rede",
            "text": "Usar somente HTTPS"
        },
        {
            "category": "Segurança",
            "description": "Não use curingas em sua configuração de CORS, pois isso permite que todas as origens acessem o serviço (derrotando assim o propósito do CORS). Especificamente, permita apenas as origens que você espera que possam acessar o serviço.",
            "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
            "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
            "severity": "Alto",
            "subcategory": "Segurança de rede",
            "text": "Curingas não devem ser usados para CORS"
        },
        {
            "category": "Segurança",
            "description": "A depuração remota não deve ser ativada na produção, pois isso abre portas adicionais no serviço, o que aumenta a superfície de ataque. Observe que o serviço ativa a depuração remota automaticamente após 48 horas.",
            "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
            "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
            "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
            "severity": "Alto",
            "subcategory": "Segurança de rede",
            "text": "Desativar a depuração remota"
        },
        {
            "category": "Segurança",
            "description": "Habilite o Defender para o Serviço de Aplicativo.  Isso (entre outras ameaças) detecta comunicações com endereços IP maliciosos conhecidos.  Revise as recomendações do Defender for App Service como parte de suas operações.",
            "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
            "severity": "Média",
            "subcategory": "Segurança de rede",
            "text": "Habilitar o Defender para Nuvem - Defender para o Serviço de Aplicativo"
        },
        {
            "category": "Segurança",
            "description": "O Azure fornece proteção DDoS Basic em sua rede, que pode ser aprimorada com recursos inteligentes do DDoS Standard que aprendem sobre padrões de tráfego normais e podem detectar comportamentos incomuns. O DDoS Standard se aplica a uma Rede Virtual, portanto, ele deve ser configurado para o recurso de rede na frente do aplicativo, como o Gateway de Aplicativo ou um NVA.",
            "guid": "223ece80-b123-4071-a541-6415833ea3ad",
            "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
            "severity": "Média",
            "subcategory": "Segurança de rede",
            "text": "Habilitar o padrão de proteção DDOS na rede virtual WAF"
        },
        {
            "category": "Segurança",
            "description": "Ao usar imagens armazenadas no Registro de Contêiner do Azure, extraia-as em uma rede virtual do Registro de Contêiner do Azure usando seu ponto de extremidade privado e a configuração do aplicativo 'WEBSITE_PULL_IMAGE_OVER_VNET'.",
            "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
            "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
            "severity": "Média",
            "subcategory": "Segurança de rede",
            "text": "Puxar contêineres por uma rede virtual"
        },
        {
            "category": "Segurança",
            "description": "Realizar um teste de penetração no aplicativo web seguindo as regras de teste de penetração de engajamento.",
            "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
            "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
            "severity": "Média",
            "subcategory": "Testes de Penetração",
            "text": "Realizar um teste de penetração"
        },
        {
            "category": "Segurança",
            "description": "Implante código confiável que foi validado e verificado em busca de vulnerabilidades de acordo com as práticas de DevSecOps.",
            "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
            "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
            "severity": "Média",
            "subcategory": "Gerenciamento de vulnerabilidades",
            "text": "Implantar código validado"
        },
        {
            "category": "Segurança",
            "description": "Use as versões mais recentes de plataformas, linguagens de programação, protocolos e estruturas suportados.",
            "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
            "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
            "severity": "Alto",
            "subcategory": "Gerenciamento de vulnerabilidades",
            "text": "Use plataformas, linguagens, protocolos e frameworks atualizados"
        }
    ],
    "metadata": {
        "name": "Azure App Security Review",
        "state": "Preview"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Média"
        },
        {
            "name": "Baixo"
        }
    ],
    "status": [
        {
            "description": "Esta verificação ainda não foi analisada",
            "name": "Não verificado"
        },
        {
            "description": "Há um item de ação associado a essa verificação",
            "name": "Abrir"
        },
        {
            "description": "Essa verificação foi verificada e não há mais itens de ação associados a ela",
            "name": "Cumprido"
        },
        {
            "description": "Não aplicável ao projeto atual",
            "name": "N/A"
        },
        {
            "description": "Não é necessário",
            "name": "Não é necessário"
        }
    ]
}
checklists/appsvc_security_checklist.ko.json METASEP
{
    "$schema": "checklist.schema.json",
    "categories": [
        {
            "name": "안전"
        }
    ],
    "items": [
        {
            "category": "안전",
            "description": "Azure 키 자격 증명 모음을 사용하여 애플리케이션에 필요한 모든 비밀을 저장합니다.  Key Vault는 비밀을 저장하기 위한 안전하고 감사된 환경을 제공하며 Key Vault SDK 또는 앱 서비스 키 자격 증명 모음 참조를 통해 앱 서비스와 잘 통합됩니다.",
            "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
            "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
            "severity": "높다",
            "subcategory": "데이터 보호",
            "text": "키 자격 증명 모음을 사용하여 비밀 저장"
        },
        {
            "category": "안전",
            "description": "관리 ID를 사용하여 키 자격 증명 모음 SDK를 사용하거나 앱 서비스 키 자격 증명 모음 참조를 통해 키 자격 증명 모음에 연결합니다.",
            "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
            "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
            "severity": "높다",
            "subcategory": "데이터 보호",
            "text": "관리 ID를 사용하여 키 자격 증명 모음에 연결"
        },
        {
            "category": "안전",
            "description": "앱 서비스 TLS 인증서를 키 자격 증명 모음에 저장합니다.",
            "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
            "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
            "severity": "높다",
            "subcategory": "데이터 보호",
            "text": "키 자격 증명 모음을 사용하여 TLS 인증서를 저장합니다."
        },
        {
            "category": "안전",
            "description": "중요한 정보를 처리하는 시스템은 격리되어야 합니다.  이렇게 하려면 별도의 앱 서비스 계획 또는 앱 서비스 환경을 사용하고 다른 구독 또는 관리 그룹의 사용을 고려합니다.",
            "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
            "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
            "severity": "보통",
            "subcategory": "데이터 보호",
            "text": "중요한 정보를 처리하는 시스템 격리"
        },
        {
            "category": "안전",
            "description": "App Service의 로컬 디스크는 암호화되지 않으며 중요한 데이터를 저장해서는 안 됩니다.  (예: D:\\\\Local 및 %TMP%).",
            "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
            "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
            "severity": "보통",
            "subcategory": "데이터 보호",
            "text": "중요한 데이터를 로컬 디스크에 저장하지 마십시오."
        },
        {
            "category": "안전",
            "description": "인증된 웹 애플리케이션의 경우 Azure AD 또는 Azure AD B2C와 같은 잘 설정된 ID 공급자를 사용합니다.  선택한 응용 프로그램 프레임워크를 활용하여 이 공급자와 통합하거나 App Service 인증/권한 부여 기능을 사용합니다.",
            "guid": "919ca0b2-c121-459e-814b-933df574eccc",
            "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
            "severity": "보통",
            "subcategory": "ID 및 액세스 제어",
            "text": "인증을 위해 설정된 ID 공급자 사용"
        },
        {
            "category": "안전",
            "description": "잘 관리되고 안전한 DevOps 배포 파이프라인과 같이 제어되고 신뢰할 수 있는 환경에서 App Service에 코드를 배포합니다. 이렇게 하면 버전이 제어되지 않고 확인되지 않은 코드가 악성 호스트에서 배포되는 것을 방지할 수 있습니다.",
            "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
            "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
            "severity": "높다",
            "subcategory": "ID 및 액세스 제어",
            "text": "신뢰할 수 있는 환경에서 배포"
        },
        {
            "category": "안전",
            "description": "FTP/FTPS 및 웹 배포/SCM 모두에 대해 기본 인증을 사용하지 않도록 설정합니다.  이렇게 하면 이러한 서비스에 대한 액세스가 비활성화되고 배포에 Azure AD 보안 엔드포인트를 사용하도록 적용됩니다.  SCM 사이트는 Azure AD 자격 증명을 사용하여 열 수도 있습니다.",
            "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
            "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
            "severity": "높다",
            "subcategory": "ID 및 액세스 제어",
            "text": "기본 인증 사용 안 함"
        },
        {
            "category": "안전",
            "description": "가능한 경우 관리 ID를 사용하여 Azure AD 보안 리소스에 연결합니다.  이렇게 할 수 없는 경우 Key Vault에 비밀을 저장하고 대신 관리 ID를 사용하여 Key Vault에 연결합니다.",
            "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
            "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
            "severity": "높다",
            "subcategory": "ID 및 액세스 제어",
            "text": "관리 ID를 사용하여 리소스에 연결"
        },
        {
            "category": "안전",
            "description": "Azure 컨테이너 레지스트리에 저장된 이미지를 사용하는 경우 관리 ID를 사용하여 이미지를 끌어옵니다.",
            "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
            "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
            "severity": "높다",
            "subcategory": "ID 및 액세스 제어",
            "text": "관리 ID를 사용하여 컨테이너 끌어오기"
        },
        {
            "category": "안전",
            "description": "App Service의 진단 설정을 구성하여 로깅 및 모니터링을 위한 중앙 대상으로 Log Analytics에 모든 원격 분석을 보낼 수 있습니다. 이를 통해 HTTP 로그, 응용 프로그램 로그, 플랫폼 로그 등과 같은 App Service의 런타임 활동을 모니터링할 수 있습니다.",
            "guid": "47768314-c115-4775-a2ea-55b46ad48408",
            "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
            "severity": "보통",
            "subcategory": "로깅 및 모니터링",
            "text": "앱 서비스 런타임 로그를 로그 분석으로 보내기"
        },
        {
            "category": "안전",
            "description": "활동 로그를 로깅 및 모니터링을 위한 중앙 대상으로 Log Analytics로 보내도록 진단 설정을 지정합니다. 이렇게 하면 App Service 리소스 자체에서 컨트롤 평면 작업을 모니터링할 수 있습니다.",
            "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
            "severity": "보통",
            "subcategory": "로깅 및 모니터링",
            "text": "로그 분석에 앱 서비스 활동 로그 보내기"
        },
        {
            "category": "안전",
            "description": "지역 VNet 통합, 네트워크 보안 그룹 및 UDR의 조합을 사용하여 아웃바운드 네트워크 액세스를 제어합니다.  트래픽은 Azure 방화벽과 같은 NVA로 라우팅되어야 합니다.  방화벽의 로그를 모니터링해야 합니다.",
            "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
            "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
            "severity": "보통",
            "subcategory": "네트워크 보안",
            "text": "아웃바운드 네트워크 액세스를 제어해야 합니다."
        },
        {
            "category": "안전",
            "description": "VNet 통합을 사용하고 VNet NAT 게이트웨이 또는 Azure 방화벽과 같은 NVA를 사용하여 안정적인 아웃바운드 IP를 제공할 수 있습니다.  이렇게 하면 수신 당사자가 필요한 경우 IP를 기반으로 허용 목록에 추가할 수 있습니다.  Azure 서비스에 대한 통신의 경우 IP 주소에 의존할 필요가 없는 경우가 많으며 서비스 엔드포인트와 같은 메커니즘을 대신 사용해야 합니다.  (또한 수신 쪽에서 프라이빗 엔드포인트를 사용하면 SNAT가 발생하지 않고 안정적인 아웃바운드 IP 범위가 제공됩니다.)",
            "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
            "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
            "severity": "낮다",
            "subcategory": "네트워크 보안",
            "text": "인터넷 주소로의 아웃바운드 통신을 위한 안정적인 IP 보장"
        },
        {
            "category": "안전",
            "description": "App Service 액세스 제한, 서비스 엔드포인트 또는 프라이빗 엔드포인트의 조합을 사용하여 인바운드 네트워크 액세스를 제어합니다. 웹앱 자체와 SCM 사이트에 대해 서로 다른 액세스 제한이 필요하고 구성할 수 있습니다.",
            "guid": "0725769e-e669-41a4-a34a-c932223ece80",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
            "severity": "높다",
            "subcategory": "네트워크 보안",
            "text": "인바운드 네트워크 액세스를 제어해야 합니다."
        },
        {
            "category": "안전",
            "description": "응용 프로그램 게이트웨이 또는 Azure Front Door와 같은 웹 응용 프로그램 방화벽을 사용하여 악의적인 인바운드 트래픽으로부터 보호합니다.  WAF의 로그를 모니터링해야 합니다.",
            "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
            "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
            "severity": "높다",
            "subcategory": "네트워크 보안",
            "text": "앱 서비스 앞에서 WAF 사용"
        },
        {
            "category": "안전",
            "description": "WAF에 대한 액세스만 잠가 WAF를 우회할 수 없는지 확인합니다.  액세스 제한, 서비스 엔드포인트 및 프라이빗 엔드포인트의 조합을 사용합니다.",
            "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
            "severity": "높다",
            "subcategory": "네트워크 보안",
            "text": "WAF가 우회되지 않도록 합니다."
        },
        {
            "category": "안전",
            "description": "앱 서비스 구성에서 최소 TLS 정책을 1.2로 설정합니다.",
            "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
            "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
            "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
            "severity": "보통",
            "subcategory": "네트워크 보안",
            "text": "최소 TLS 정책을 1.2로 설정"
        },
        {
            "category": "안전",
            "description": "HTTPS만 사용하도록 앱 서비스를 구성합니다.  이로 인해 앱 서비스가 HTTP에서 HTTPS로 리디렉션됩니다.  코드 또는 WAF에서 HTTP 엄격한 전송 보안(HSTS)을 사용하여 HTTPS를 통해서만 사이트에 액세스해야 함을 브라우저에 알리는 것이 좋습니다.",
            "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
            "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
            "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
            "severity": "높다",
            "subcategory": "네트워크 보안",
            "text": "HTTPS만 사용"
        },
        {
            "category": "안전",
            "description": "CORS 구성에서 와일드카드를 사용하면 모든 원본이 서비스에 액세스할 수 있으므로 CORS의 목적이 무효화됩니다. 특히 서비스에 액세스할 수 있을 것으로 예상되는 원본만 허용합니다.",
            "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
            "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
            "severity": "높다",
            "subcategory": "네트워크 보안",
            "text": "와일드카드는 CORS에 사용할 수 없습니다."
        },
        {
            "category": "안전",
            "description": "원격 디버깅은 서비스에서 추가 포트를 열어 공격 노출 영역을 증가시키므로 프로덕션 환경에서 설정해서는 안 됩니다. 서비스는 48시간 후에 자동으로 원격 디버깅을 설정합니다.",
            "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
            "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
            "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
            "severity": "높다",
            "subcategory": "네트워크 보안",
            "text": "원격 디버깅 끄기"
        },
        {
            "category": "안전",
            "description": "앱 서비스에 대해 Defender를 사용하도록 설정합니다.  이것은 (다른 위협 중에서도) 알려진 악성 IP 주소에 대한 통신을 탐지합니다.  작업의 일부로 앱 서비스용 Defender의 권장 사항을 검토합니다.",
            "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
            "severity": "보통",
            "subcategory": "네트워크 보안",
            "text": "클라우드용 수비수 - 앱 서비스용 수비수 사용"
        },
        {
            "category": "안전",
            "description": "Azure는 네트워크에서 DDoS 기본 보호를 제공하며, 이는 정상적인 트래픽 패턴을 학습하고 비정상적인 동작을 검색할 수 있는 지능형 DDoS 표준 기능으로 개선할 수 있습니다. DDoS 표준은 가상 네트워크에 적용되므로 응용 프로그램 게이트웨이 또는 NVA와 같은 앱 앞의 네트워크 리소스에 대해 구성해야 합니다.",
            "guid": "223ece80-b123-4071-a541-6415833ea3ad",
            "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
            "severity": "보통",
            "subcategory": "네트워크 보안",
            "text": "WAF VNet에서 DDOS 보호 표준 사용"
        },
        {
            "category": "안전",
            "description": "Azure 컨테이너 레지스트리에 저장된 이미지를 사용하는 경우 프라이빗 엔드포인트 및 앱 설정 'WEBSITE_PULL_IMAGE_OVER_VNET'을 사용하여 Azure 컨테이너 레지스트리에서 가상 네트워크를 통해 이미지를 끌어옵니다.",
            "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
            "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
            "severity": "보통",
            "subcategory": "네트워크 보안",
            "text": "가상 네트워크를 통해 컨테이너 끌어오기"
        },
        {
            "category": "안전",
            "description": "침투 테스트 참여 규칙에 따라 웹 응용 프로그램에서 침투 테스트를 수행합니다.",
            "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
            "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
            "severity": "보통",
            "subcategory": "침투 테스트",
            "text": "침투 테스트 수행"
        },
        {
            "category": "안전",
            "description": "DevSecOps 사례에 따라 취약성에 대해 유효성을 검사하고 검사한 신뢰할 수 있는 코드를 배포합니다.",
            "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
            "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
            "severity": "보통",
            "subcategory": "취약성 관리",
            "text": "검증된 코드 배포"
        },
        {
            "category": "안전",
            "description": "지원되는 플랫폼, 프로그래밍 언어, 프로토콜 및 프레임워크의 최신 버전을 사용합니다.",
            "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
            "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
            "severity": "높다",
            "subcategory": "취약성 관리",
            "text": "최신 플랫폼, 언어, 프로토콜 및 프레임워크 사용"
        }
    ],
    "metadata": {
        "name": "Azure App Security Review",
        "state": "Preview"
    },
    "severities": [
        {
            "name": "높다"
        },
        {
            "name": "보통"
        },
        {
            "name": "낮다"
        }
    ],
    "status": [
        {
            "description": "이 검사는 아직 검토되지 않았습니다.",
            "name": "확인되지 않음"
        },
        {
            "description": "이 검사와 연결된 작업 항목이 있습니다.",
            "name": "열다"
        },
        {
            "description": "이 검사가 확인되었으며 연결된 추가 작업 항목이 없습니다.",
            "name": "성취"
        },
        {
            "description": "현재 디자인에는 적용되지 않음",
            "name": "해당 없음"
        },
        {
            "description": "필요하지 않음",
            "name": "필요하지 않음"
        }
    ]
}
checklists/appsvc_security_checklist.ja.json METASEP
{
    "$schema": "checklist.schema.json",
    "categories": [
        {
            "name": "安全"
        }
    ],
    "items": [
        {
            "category": "安全",
            "description": "Azure Key Vault を使用して、アプリケーションに必要なシークレットを格納します。 Key Vault は、シークレットを格納するための安全で監査された環境を提供し、Key Vault SDK または App Service Key Vault リファレンスを通じて App Service と適切に統合されています。",
            "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
            "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
            "severity": "高い",
            "subcategory": "データ保護",
            "text": "Key Vault を使用してシークレットを格納する"
        },
        {
            "category": "安全",
            "description": "マネージド ID を使用して、Key Vault SDK を使用するか、App Service Key Vault 参照を使用して Key Vault に接続します。",
            "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
            "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
            "severity": "高い",
            "subcategory": "データ保護",
            "text": "マネージド ID を使用して Key Vault に接続する"
        },
        {
            "category": "安全",
            "description": "アプリ サービスの TLS 証明書をキー コンテナーに格納します。",
            "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
            "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
            "severity": "高い",
            "subcategory": "データ保護",
            "text": "キー コンテナーを使用して TLS 証明書を格納します。"
        },
        {
            "category": "安全",
            "description": "機密情報を処理するシステムは分離する必要があります。 これを行うには、個別の App Service プランまたは App Service 環境を使用し、異なるサブスクリプションまたは管理グループの使用を検討してください。",
            "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
            "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
            "severity": "中程度",
            "subcategory": "データ保護",
            "text": "機密情報を処理するシステムを分離する"
        },
        {
            "category": "安全",
            "description": "App Service 上のローカル ディスクは暗号化されていないため、機密データをそれらのディスクに格納しないでください。 (例: D:\\\\Local および %TMP%)。",
            "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
            "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
            "severity": "中程度",
            "subcategory": "データ保護",
            "text": "機密データをローカルディスクに保存しない"
        },
        {
            "category": "安全",
            "description": "認証された Web アプリケーションの場合は、Azure AD や Azure AD B2C などの確立された ID プロバイダーを使用します。 選択したアプリケーション フレームワークを利用して、このプロバイダーと統合するか、App Service の認証/承認機能を使用します。",
            "guid": "919ca0b2-c121-459e-814b-933df574eccc",
            "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
            "severity": "中程度",
            "subcategory": "ID とアクセス制御",
            "text": "認証に確立された ID プロバイダーを使用する"
        },
        {
            "category": "安全",
            "description": "適切に管理され、セキュリティで保護された DevOps デプロイ パイプラインなど、制御された信頼できる環境から App Service にコードをデプロイします。これにより、バージョン管理されておらず、悪意のあるホストから展開されることが確認されていないコードを回避できます。",
            "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
            "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
            "severity": "高い",
            "subcategory": "ID とアクセス制御",
            "text": "信頼できる環境からデプロイする"
        },
        {
            "category": "安全",
            "description": "FTP/FTPS と WebDeploy/SCM の両方の基本認証を無効にします。 これにより、これらのサービスへのアクセスが無効になり、デプロイに Azure AD のセキュリティで保護されたエンドポイントの使用が強制されます。 SCM サイトは、Azure AD 資格情報を使用して開くこともできます。",
            "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
            "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
            "severity": "高い",
            "subcategory": "ID とアクセス制御",
            "text": "基本認証を無効にする"
        },
        {
            "category": "安全",
            "description": "可能な場合は、マネージド ID を使用して Azure AD のセキュリティで保護されたリソースに接続します。 これが不可能な場合は、シークレットを Key Vault に格納し、代わりにマネージド ID を使用して Key Vault に接続します。",
            "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
            "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
            "severity": "高い",
            "subcategory": "ID とアクセス制御",
            "text": "マネージド ID を使用してリソースに接続する"
        },
        {
            "category": "安全",
            "description": "Azure コンテナー レジストリに格納されているイメージを使用する場合は、マネージド ID を使用してこれらをプルします。",
            "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
            "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
            "severity": "高い",
            "subcategory": "ID とアクセス制御",
            "text": "マネージド ID を使用したコンテナーのプル"
        },
        {
            "category": "安全",
            "description": "App Service の診断設定を構成することで、すべてのテレメトリをログ記録と監視の中心的な宛先として Log Analytics に送信できます。これにより、HTTPログ、アプリケーションログ、プラットフォームログなどのApp Serviceの実行時アクティビティを監視できます。",
            "guid": "47768314-c115-4775-a2ea-55b46ad48408",
            "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
            "severity": "中程度",
            "subcategory": "ログ記録と監視",
            "text": "App Service ランタイム ログをログ分析に送信する"
        },
        {
            "category": "安全",
            "description": "ログ記録と監視の中心的な宛先として Log Analytics にアクティビティ ログを送信するように診断設定を設定します。これにより、App Service リソース自体のコントロール プレーン アクティビティを監視できます。",
            "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
            "severity": "中程度",
            "subcategory": "ログ記録と監視",
            "text": "App Service アクティビティ ログをログ分析に送信する"
        },
        {
            "category": "安全",
            "description": "リージョン VNet 統合、ネットワーク セキュリティ グループ、および UDR の組み合わせを使用して、送信ネットワーク アクセスを制御します。 トラフィックは、Azure ファイアウォールなどの NVA にルーティングする必要があります。 ファイアウォールのログを必ず監視してください。",
            "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
            "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
            "severity": "中程度",
            "subcategory": "ネットワークセキュリティ",
            "text": "送信ネットワーク アクセスを制御する必要がある"
        },
        {
            "category": "安全",
            "description": "安定した送信 IP を提供するには、VNet 統合を使用し、VNet NAT ゲートウェイまたは Azure ファイアウォールなどの NVA を使用します。 これにより、受信側は必要に応じて IP に基づいて許可リストに登録できます。 Azure Services への通信では、多くの場合、IP アドレスに依存する必要はなく、代わりにサービス エンドポイントなどのメカニズムを使用する必要があることに注意してください。 (また、受信側でプライベート エンドポイントを使用すると、SNAT の発生が回避され、安定した送信 IP 範囲が提供されます)。",
            "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
            "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
            "severity": "低い",
            "subcategory": "ネットワークセキュリティ",
            "text": "インターネットアドレスへのアウトバウンド通信の安定したIPを確保する"
        },
        {
            "category": "安全",
            "description": "App Service アクセス制限、サービス エンドポイント、またはプライベート エンドポイントの組み合わせを使用して、受信ネットワーク アクセスを制御します。Web アプリ自体と SCM サイトに対して異なるアクセス制限を要求し、構成することができます。",
            "guid": "0725769e-e669-41a4-a34a-c932223ece80",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
            "severity": "高い",
            "subcategory": "ネットワークセキュリティ",
            "text": "受信ネットワーク アクセスを制御する必要がある"
        },
        {
            "category": "安全",
            "description": "アプリケーション ゲートウェイや Azure Front Door などの Web アプリケーション ファイアウォールを使用して、悪意のある受信トラフィックから保護します。 WAF のログを必ず監視してください。",
            "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
            "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
            "severity": "高い",
            "subcategory": "ネットワークセキュリティ",
            "text": "アプリ サービスの前で WAF を使用する"
        },
        {
            "category": "安全",
            "description": "WAF のみへのアクセスをロックダウンして、WAF をバイパスできないことを確認します。 アクセス制限、サービス エンドポイント、プライベート エンドポイントを組み合わせて使用します。",
            "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
            "severity": "高い",
            "subcategory": "ネットワークセキュリティ",
            "text": "WAFがバイパスされないようにする"
        },
        {
            "category": "安全",
            "description": "App Service 構成で最小 TLS ポリシーを 1.2 に設定します。",
            "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
            "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
            "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
            "severity": "中程度",
            "subcategory": "ネットワークセキュリティ",
            "text": "最小 TLS ポリシーを 1.2 に設定する"
        },
        {
            "category": "安全",
            "description": "HTTPS のみを使用するようにアプリ サービスを構成します。 これにより、App Service は HTTP から HTTPS にリダイレクトされます。 コード内または WAF から HTTP 厳密トランスポート セキュリティ (HSTS) を使用して、HTTPS のみを使用してサイトにアクセスする必要があることをブラウザーに通知することを強く検討してください。",
            "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
            "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
            "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
            "severity": "高い",
            "subcategory": "ネットワークセキュリティ",
            "text": "HTTPS のみを使用する"
        },
        {
            "category": "安全",
            "description": "CORS 設定では、すべてのオリジンがサービスにアクセスできる (CORS の目的が無効になるため) ワイルドカードを使用しないでください。具体的には、サービスにアクセスできると予想されるオリジンのみを許可します。",
            "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
            "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
            "severity": "高い",
            "subcategory": "ネットワークセキュリティ",
            "text": "ワイルドカードは CORS に使用しないでください"
        },
        {
            "category": "安全",
            "description": "リモート デバッグは、サービスに追加のポートが開かれ、攻撃対象領域が増えるため、運用環境で有効にしないでください。サービスは 48 時間後に自動的にリモート デバッグをオンにすることに注意してください。",
            "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
            "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
            "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
            "severity": "高い",
            "subcategory": "ネットワークセキュリティ",
            "text": "リモート デバッグをオフにする"
        },
        {
            "category": "安全",
            "description": "アプリ サービスの Defender を有効にします。 これは(他の脅威の中でも)既知の悪意のあるIPアドレスへの通信を検出します。 運用の一環として、アプリ サービスの Defender からの推奨事項を確認します。",
            "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
            "severity": "中程度",
            "subcategory": "ネットワークセキュリティ",
            "text": "クラウドの Defender を有効にする - アプリ サービスの Defender"
        },
        {
            "category": "安全",
            "description": "Azure はネットワーク上で DDoS Basic 保護を提供しますが、通常のトラフィック パターンについて学習し、異常な動作を検出できるインテリジェントな DDoS 標準機能で改善できます。DDoS 標準は仮想ネットワークに適用されるため、アプリケーション ゲートウェイや NVA など、アプリの前のネットワーク リソース用に構成する必要があります。",
            "guid": "223ece80-b123-4071-a541-6415833ea3ad",
            "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
            "severity": "中程度",
            "subcategory": "ネットワークセキュリティ",
            "text": "WAF VNet で DDOS 保護標準を有効にする"
        },
        {
            "category": "安全",
            "description": "Azure コンテナー レジストリに格納されているイメージを使用する場合は、プライベート エンドポイントとアプリ設定 \"WEBSITE_PULL_IMAGE_OVER_VNET\" を使用して、Azure コンテナー レジストリから仮想ネットワーク経由でこれらをプルします。",
            "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
            "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
            "severity": "中程度",
            "subcategory": "ネットワークセキュリティ",
            "text": "仮想ネットワーク経由でコンテナーをプルする"
        },
        {
            "category": "安全",
            "description": "エンゲージメントの侵入テストルールに従って、Webアプリケーションで侵入テストを実施します。",
            "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
            "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
            "severity": "中程度",
            "subcategory": "ペネトレーションテスト",
            "text": "侵入テストの実施"
        },
        {
            "category": "安全",
            "description": "DevSecOps プラクティスに従って脆弱性が検証およびスキャンされた信頼できるコードをデプロイします。",
            "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
            "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
            "severity": "中程度",
            "subcategory": "脆弱性管理",
            "text": "検証済みのコードをデプロイする"
        },
        {
            "category": "安全",
            "description": "サポートされているプラットフォーム、プログラミング言語、プロトコル、およびフレームワークの最新バージョンを使用します。",
            "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
            "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
            "severity": "高い",
            "subcategory": "脆弱性管理",
            "text": "最新のプラットフォーム、言語、プロトコル、フレームワークを使用する"
        }
    ],
    "metadata": {
        "name": "Azure App Security Review",
        "state": "Preview"
    },
    "severities": [
        {
            "name": "高い"
        },
        {
            "name": "中程度"
        },
        {
            "name": "低い"
        }
    ],
    "status": [
        {
            "description": "このチェックはまだ確認されていません",
            "name": "未確認"
        },
        {
            "description": "このチェックに関連付けられているアクションアイテムがあります",
            "name": "開ける"
        },
        {
            "description": "このチェックは検証済みであり、それ以上のアクションアイテムは関連付けられていません",
            "name": "達成"
        },
        {
            "description": "現在のデザインには適用できません",
            "name": "該当なし"
        },
        {
            "description": "必須ではありません",
            "name": "必須ではありません"
        }
    ]
}
checklists/appsvc_security_checklist.es.json METASEP
{
    "$schema": "checklist.schema.json",
    "categories": [
        {
            "name": "Seguridad"
        }
    ],
    "items": [
        {
            "category": "Seguridad",
            "description": "Use Azure Key Vault para almacenar los secretos que necesita la aplicación.  Key Vault proporciona un entorno seguro y auditado para almacenar secretos y está bien integrado con App Service a través del SDK de Key Vault o las referencias de Key Vault del Servicio de aplicaciones.",
            "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
            "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
            "severity": "Alto",
            "subcategory": "Protección de datos",
            "text": "Usar Key Vault para almacenar secretos"
        },
        {
            "category": "Seguridad",
            "description": "Use una identidad administrada para conectarse al Almacén de claves mediante el SDK del Almacén de claves o a través de las referencias del Almacén de claves del Servicio de aplicaciones.",
            "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
            "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references",
            "severity": "Alto",
            "subcategory": "Protección de datos",
            "text": "Usar Managed Identity para conectarse a Key Vault"
        },
        {
            "category": "Seguridad",
            "description": "Almacene el certificado TLS del Servicio de aplicaciones en el Almacén de claves.",
            "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
            "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate",
            "severity": "Alto",
            "subcategory": "Protección de datos",
            "text": "Utilice Key Vault para almacenar el certificado TLS."
        },
        {
            "category": "Seguridad",
            "description": "Los sistemas que procesan información confidencial deben estar aislados.  Para ello, use planes del Servicio de aplicaciones o entornos del Servicio de aplicaciones independientes y considere el uso de diferentes suscripciones o grupos de administración.",
            "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
            "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans",
            "severity": "Medio",
            "subcategory": "Protección de datos",
            "text": "Aislar los sistemas que procesan información confidencial"
        },
        {
            "category": "Seguridad",
            "description": "Los discos locales del Servicio de aplicaciones no están cifrados y los datos confidenciales no deben almacenarse en ellos.  (Por ejemplo: D:\\\\Local y %TMP%).",
            "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
            "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access",
            "severity": "Medio",
            "subcategory": "Protección de datos",
            "text": "No almacene datos confidenciales en el disco local"
        },
        {
            "category": "Seguridad",
            "description": "Para la aplicación web autenticada, use un proveedor de identidades bien establecido, como Azure AD o Azure AD B2C.  Aproveche el marco de aplicación de su elección para integrarse con este proveedor o use la característica Autenticación/autorización del Servicio de aplicaciones.",
            "guid": "919ca0b2-c121-459e-814b-933df574eccc",
            "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization",
            "severity": "Medio",
            "subcategory": "Identidad y control de acceso",
            "text": "Usar un proveedor de identidades establecido para la autenticación"
        },
        {
            "category": "Seguridad",
            "description": "Implemente código en el Servicio de aplicaciones desde un entorno controlado y de confianza, como una canalización de implementación de DevOps bien administrada y segura. Esto evita el código que no estaba controlado por la versión y se verificó que se implementara desde un host malintencionado.",
            "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
            "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices",
            "severity": "Alto",
            "subcategory": "Identidad y control de acceso",
            "text": "Implementación desde un entorno de confianza"
        },
        {
            "category": "Seguridad",
            "description": "Deshabilite la autenticación básica tanto para FTP/FTPS como para WebDeploy/SCM.  Esto deshabilita el acceso a estos servicios y exige el uso de puntos de conexión protegidos de Azure AD para la implementación.  Tenga en cuenta que el sitio de SCM también se puede abrir con credenciales de Azure AD.",
            "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
            "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication",
            "severity": "Alto",
            "subcategory": "Identidad y control de acceso",
            "text": "Deshabilitar la autenticación básica"
        },
        {
            "category": "Seguridad",
            "description": "Siempre que sea posible, use Identidad administrada para conectarse a los recursos protegidos de Azure AD.  Si esto no es posible, almacene los secretos en Key Vault y conéctese a Key Vault mediante una identidad administrada en su lugar.",
            "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
            "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp",
            "severity": "Alto",
            "subcategory": "Identidad y control de acceso",
            "text": "Usar la identidad administrada para conectarse a los recursos"
        },
        {
            "category": "Seguridad",
            "description": "Cuando use imágenes almacenadas en Azure Container Registry, extráigalas mediante una identidad administrada.",
            "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
            "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry",
            "severity": "Alto",
            "subcategory": "Identidad y control de acceso",
            "text": "Extracción de contenedores mediante una identidad administrada"
        },
        {
            "category": "Seguridad",
            "description": "Al configurar las opciones de diagnóstico del Servicio de aplicaciones, puede enviar toda la telemetría a Log Analytics como destino central para el registro y la supervisión. Esto le permite supervisar la actividad en tiempo de ejecución del Servicio de aplicaciones, como registros HTTP, registros de aplicaciones, registros de plataforma, ...",
            "guid": "47768314-c115-4775-a2ea-55b46ad48408",
            "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs",
            "severity": "Medio",
            "subcategory": "Registro y supervisión",
            "text": "Enviar registros de tiempo de ejecución del Servicio de aplicaciones a Log Analytics"
        },
        {
            "category": "Seguridad",
            "description": "Configure una configuración de diagnóstico para enviar el registro de actividad a Log Analytics como destino central para el registro y la supervisión. Esto permite supervisar la actividad del plano de control en el propio recurso del Servicio de aplicaciones.",
            "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log",
            "severity": "Medio",
            "subcategory": "Registro y supervisión",
            "text": "Enviar registros de actividad del Servicio de aplicaciones a Log Analytics"
        },
        {
            "category": "Seguridad",
            "description": "Controle el acceso saliente a la red mediante una combinación de integración de red virtual regional, grupos de seguridad de red y UDR.  El tráfico debe enrutarse a un NVA como Azure Firewall.  Asegúrese de supervisar los registros del cortafuegos.",
            "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
            "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration",
            "severity": "Medio",
            "subcategory": "Seguridad de red",
            "text": "El acceso a la red saliente debe ser controlado"
        },
        {
            "category": "Seguridad",
            "description": "Puede proporcionar una IP saliente estable mediante la integración de red virtual y una puerta de enlace NAT de red virtual o un NVA como Azure Firewall.  Esto permite a la parte receptora permitir la lista basada en IP, en caso de que sea necesario.  Tenga en cuenta que para las comunicaciones hacia los servicios de Azure a menudo no es necesario depender de la dirección IP y en su lugar se deben usar mecánicas como los puntos de conexión de servicio.  (Además, el uso de extremos privados en el extremo receptor evita que ocurra SNAT y proporciona un rango estable de IP saliente).",
            "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
            "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration",
            "severity": "Bajo",
            "subcategory": "Seguridad de red",
            "text": "Garantizar una IP estable para las comunicaciones salientes hacia direcciones de Internet"
        },
        {
            "category": "Seguridad",
            "description": "Controle el acceso entrante a la red mediante una combinación de restricciones de acceso al Servicio de aplicaciones, extremos de servicio o extremos privados. Se pueden requerir y configurar diferentes restricciones de acceso para la propia aplicación web y el sitio de SCM.",
            "guid": "0725769e-e669-41a4-a34a-c932223ece80",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
            "severity": "Alto",
            "subcategory": "Seguridad de red",
            "text": "El acceso a la red entrante debe ser controlado"
        },
        {
            "category": "Seguridad",
            "description": "Protéjase contra el tráfico entrante malintencionado mediante un firewall de aplicaciones web como Application Gateway o Azure Front Door.  Asegúrese de monitorear los registros del WAF.",
            "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
            "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints",
            "severity": "Alto",
            "subcategory": "Seguridad de red",
            "text": "Usar un WAF delante del Servicio de aplicaciones"
        },
        {
            "category": "Seguridad",
            "description": "Asegúrese de que el WAF no se puede omitir bloqueando el acceso solo al WAF.  Use una combinación de restricciones de acceso, extremos de servicio y extremos privados.",
            "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions",
            "severity": "Alto",
            "subcategory": "Seguridad de red",
            "text": "Evitar que se omita WAF"
        },
        {
            "category": "Seguridad",
            "description": "Establezca la directiva TLS mínima en 1.2 en Configuración del Servicio de aplicaciones.",
            "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant",
            "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
            "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
            "severity": "Medio",
            "subcategory": "Seguridad de red",
            "text": "Establezca la directiva TLS mínima en 1.2"
        },
        {
            "category": "Seguridad",
            "description": "Configure el Servicio de aplicaciones para usar solo HTTPS.  Esto hace que el Servicio de aplicaciones redirija de HTTP a HTTPS.  Considere seriamente el uso de HTTP Strict Transport Security (HSTS) en su código o desde su WAF, que informa a los navegadores que solo se debe acceder al sitio mediante HTTPS.",
            "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant",
            "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
            "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
            "severity": "Alto",
            "subcategory": "Seguridad de red",
            "text": "Usar solo HTTPS"
        },
        {
            "category": "Seguridad",
            "description": "No utilice comodines en la configuración de CORS, ya que esto permite que todos los orígenes accedan al servicio (frustrando así el propósito de CORS). Específicamente solo permite los orígenes que esperas poder acceder al servicio.",
            "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
            "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api",
            "severity": "Alto",
            "subcategory": "Seguridad de red",
            "text": "Los comodines no deben utilizarse para CORS"
        },
        {
            "category": "Seguridad",
            "description": "La depuración remota no debe activarse en producción, ya que esto abre puertos adicionales en el servicio, lo que aumenta la superficie de ataque. Tenga en cuenta que el servicio activa la depuración remota automáticamente después de 48 horas.",
            "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant",
            "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
            "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
            "severity": "Alto",
            "subcategory": "Seguridad de red",
            "text": "Desactivar la depuración remota"
        },
        {
            "category": "Seguridad",
            "description": "Habilite Defender para el Servicio de aplicaciones.  Esto (entre otras amenazas) detecta comunicaciones a direcciones IP maliciosas conocidas.  Revise las recomendaciones de Defender for App Service como parte de sus operaciones.",
            "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction",
            "severity": "Medio",
            "subcategory": "Seguridad de red",
            "text": "Habilitar Defender for Cloud - Defender for App Service"
        },
        {
            "category": "Seguridad",
            "description": "Azure proporciona protección DDoS Basic en su red, que se puede mejorar con funcionalidades DDoS Standard inteligentes que aprenden sobre los patrones de tráfico normales y pueden detectar comportamientos inusuales. DDoS Standard se aplica a una red virtual, por lo que debe configurarse para el recurso de red frente a la aplicación, como Application Gateway o un NVA.",
            "guid": "223ece80-b123-4071-a541-6415833ea3ad",
            "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview",
            "severity": "Medio",
            "subcategory": "Seguridad de red",
            "text": "Habilitar el estándar de protección DDOS en la red virtual WAF"
        },
        {
            "category": "Seguridad",
            "description": "Cuando use imágenes almacenadas en Azure Container Registry, extráigalas a través de una red virtual de Azure Container Registry mediante su punto de conexión privado y la configuración de la aplicación 'WEBSITE_PULL_IMAGE_OVER_VNET'.",
            "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
            "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry",
            "severity": "Medio",
            "subcategory": "Seguridad de red",
            "text": "Extracción de contenedores a través de una red virtual"
        },
        {
            "category": "Seguridad",
            "description": "Realice una prueba de penetración en la aplicación web siguiendo las reglas de compromiso de las pruebas de penetración.",
            "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
            "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing",
            "severity": "Medio",
            "subcategory": "Pruebas de penetración",
            "text": "Realizar una prueba de penetración"
        },
        {
            "category": "Seguridad",
            "description": "Implemente código de confianza validado y analizado en busca de vulnerabilidades de acuerdo con las prácticas de DevSecOps.",
            "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
            "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure",
            "severity": "Medio",
            "subcategory": "Gestión de vulnerabilidades",
            "text": "Implementar código validado"
        },
        {
            "category": "Seguridad",
            "description": "Utilice las últimas versiones de plataformas, lenguajes de programación, protocolos y marcos compatibles.",
            "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
            "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime",
            "severity": "Alto",
            "subcategory": "Gestión de vulnerabilidades",
            "text": "Utilice plataformas, lenguajes, protocolos y marcos actualizados"
        }
    ],
    "metadata": {
        "name": "Azure App Security Review",
        "state": "Preview"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Medio"
        },
        {
            "name": "Bajo"
        }
    ],
    "status": [
        {
            "description": "Esta comprobación aún no se ha examinado",
            "name": "No verificado"
        },
        {
            "description": "Hay un elemento de acción asociado a esta comprobación",
            "name": "Abrir"
        },
        {
            "description": "Esta comprobación se ha comprobado y no hay más elementos de acción asociados a ella",
            "name": "Cumplido"
        },
        {
            "description": "No aplicable para el diseño actual",
            "name": "N/A"
        },
        {
            "description": "No es necesario",
            "name": "No es necesario"
        }
    ]
}
checklists/appsvc_security_checklist.en.json METASEP
{
    "$schema": "checklist.schema.json",
    "items": [
        {
            "category": "Security",
            "subcategory": "Data Protection",
            "text": "Use Key Vault to store secrets",
            "description": "Use Azure Key Vault to store any secrets the application needs.  Key Vault provides a safe and audited environment for storing secrets and is well-integrated with App Service through the Key Vault SDK or App Service Key Vault References.",
            "guid": "834ac932-223e-4ce8-8b12-3071a5416415",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references"
        },
        {
            "category": "Security",
            "subcategory": "Data Protection",
            "text": "Use Managed Identity to connect to Key Vault",
            "description": "Use a Managed Identity to connect to Key Vault either using the Key Vault SDK or through App Service Key Vault References.",
            "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references"
        },
        {
            "category": "Security",
            "subcategory": "Data Protection",
            "text": "Use Key Vault to store TLS certificate.",
            "description": "Store the App Service TLS certificate in Key Vault.",
            "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate"
        },
        {
            "category": "Security",
            "subcategory": "Data Protection",
            "text": "Isolate systems that process sensitive information",
            "description": "Systems that process sensitive information should be isolated.  To do so, use separate App Service Plans or App Service Environments and consider the use of different subscriptions or management groups.",
            "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans"
        },
        {
            "category": "Security",
            "subcategory": "Data Protection",
            "text": "Do not store sensitive data on local disk",
            "description": "Local disks on App Service are not encrypted and sensitive data should not be stored on those.  (For example: D:\\\\Local and %TMP%).",
            "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Control",
            "text": "Use an established Identity Provider for authentication",
            "description": "For authenticated web application, use a well established Identity Provider like Azure AD or Azure AD B2C.  Leverage the application framework of your choice to integrate with this provider or use the App Service Authentication / Authorization feature.",
            "guid": "919ca0b2-c121-459e-814b-933df574eccc",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Control",
            "text": "Deploy from a trusted environment",
            "description": "Deploy code to App Service from a controlled and trusted environment, like a well-managed and secured DevOps deployment pipeline. This avoids code that was not version controlled and verified to be deployed from a malicious host.",
            "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Control",
            "text": "Disable basic authentication",
            "description": "Disable basic authentication for both FTP/FTPS and for WebDeploy/SCM.  This disables access to these services and enforces the use of Azure AD secured endpoints for deployment.  Note that the SCM site can also be opened using Azure AD credentials.",
            "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Control",
            "text": "Use Managed Identity to connect to resources",
            "description": "Where possible use Managed Identity to connect to Azure AD secured resources.  If this is not possible, store secrets in Key Vault and connect to Key Vault using a Managed Identity instead.",
            "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Control",
            "text": "Pull containers using a Managed Identity",
            "description": "Where using images stored in Azure Container Registry, pull these using a Managed Identity.",
            "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry"
        },
        {
            "category": "Security",
            "subcategory": "Logging and Monitoring",
            "text": "Send App Service runtime logs to Log Analytics",
            "description": "By configuring the diagnostic settings of App Service, you can send all telemetry to Log Analytics as the central destination for logging and monitoring. This allows you to monitor runtime activity of App Service such as HTTP logs, application logs, platform logs, ...",
            "guid": "47768314-c115-4775-a2ea-55b46ad48408",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs"
        },
        {
            "category": "Security",
            "subcategory": "Logging and Monitoring",
            "text": "Send App Service activity logs to Log Analytics",
            "description": "Set up a diagnostic setting to send the activity log to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the App Service resource itself.",
            "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Outbound network access should be controlled",
            "description": "Control outbound network access using a combination of regional VNet integration, network security groups and UDR's.  Traffic should be routed to an NVA such as Azure Firewall.  Ensure to monitor the Firewall's logs.",
            "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Ensure a stable IP for outbound communications towards internet addresses",
            "description": "You can provide a stable outbound IP by using VNet integration and using a VNet NAT Gateway or an NVA like Azure Firewall.  This allows the receiving party to allow-list based on IP, should that be needed.  Note that for communications towards Azure Services often there's no need to depend on the IP address and mechanics like Service Endpoints should be used instead.  (Also the use of private endpoints on the receiving end avoids for SNAT to happen and provides a stable outbound IP range.)",
            "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Inbound network access should be controlled",
            "description": "Control inbound network access using a combination of App Service Access Restrictions, Service Endpoints or Private Endpoints. Different access restrictions can be required and configured for the web app itself and the SCM site.",
            "guid": "0725769e-e669-41a4-a34a-c932223ece80",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Use a WAF in front of App Service",
            "description": "Protect against malicious inbound traffic using a Web Application Firewall like Application Gateway or Azure Front Door.  Make sure to monitor the WAF's logs.",
            "guid": "b123071a-5416-4415-a33e-a3ad2c2de732",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Avoid for WAF to be bypassed",
            "description": "Make sure the WAF cannot be bypassed by locking down access to only the WAF.  Use a combination of Access Restrictions, Service Endpoints and Private Endpoints.",
            "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Set minimum TLS policy to 1.2",
            "description": "Set minimum TLS policy to 1.2 in App Service configuration.",
            "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions",
            "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Use HTTPS only",
            "description": "Configure App Service to use HTTPS only.  This causes App Service to redirect from HTTP to HTTPS.  Strongly consider the use of HTTP Strict Transport Security (HSTS) in your code or from your WAF, which informs browsers that the site should only be accessed using HTTPS.",
            "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https",
            "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Wildcards must not be used for CORS",
            "description": "Do not use wildcards in your CORS configuration, as this allows all origins to access the service (thereby defeating the purpose of CORS). Specifically only allow the origins that you expect to be able to access the service.",
            "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Turn off remote debugging",
            "description": "Remote debugging must not be turned on in production as this opens additional ports on the service which increases the attack surface. Note that the service does turn of remote debugging automatically after 48 hours.",
            "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings",
            "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Enable Defender for Cloud - Defender for App Service",
            "description": "Enable Defender for App Service.  This (amongst other threats) detects communications to known malicious IP addresses.  Review the recommendations from Defender for App Service as part of your operations.",
            "guid": "18d2ddb1-0725-4769-be66-91a4834ac932",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Enable DDOS Protection Standard on the WAF VNet",
            "description": "Azure provides DDoS Basic protection on its network, which can be improved with intelligent DDoS Standard capabilities which learns about normal traffic patterns and can detect unusual behavior. DDoS Standard applies to a Virtual Network so it must be configured for the network resource in front of the app, such as Application Gateway or an NVA.",
            "guid": "223ece80-b123-4071-a541-6415833ea3ad",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Pull containers over a Virtual Network",
            "description": "Where using images stored in Azure Container Registry, pull these over a virtual network from Azure Container Registry using its private endpoint and the app setting 'WEBSITE_PULL_IMAGE_OVER_VNET'.",
            "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry"
        },
        {
            "category": "Security",
            "subcategory": "Penetration Testing",
            "text": "Conduct a penetration test",
            "description": "Conduct a penetration test on the web application following the penetration testing rules of engagement.",
            "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing"
        },
        {
            "category": "Security",
            "subcategory": "Vulnerability Management",
            "text": "Deploy validated code",
            "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.",
            "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure"
        },
        {
            "category": "Security",
            "subcategory": "Vulnerability Management",
            "text": "Use up-to-date platforms, languages, protocols and frameworks",
            "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.",
            "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime"
        }
    ],
    "categories": [
        {
            "name": "Security"
        }
    ],
    "status": [
        {
            "name": "Not verified",
            "description": "This check has not been looked at yet"
        },
        {
            "name": "Open",
            "description": "There is an action item associated to this check"
        },
        {
            "name": "Fulfilled",
            "description": "This check has been verified, and there are no further action items associated to it"
        },
        {
            "name": "N/A",
            "description": "Not applicable for current design"
        },
        {
            "name": "Not required",
            "description": "Not required"
        }
    ],
    "severities": [
        {
            "name": "High"
        },
        {
            "name": "Medium"
        },
        {
            "name": "Low"
        }
    ],
    "metadata": {
        "name": "Azure App Security Review",
        "timestamp": "Feb 10, 2023",
        "state": "Preview"
    }
}
checklists/apim_checklist.pt.json METASEP
{
    "$schema": "checklist.schema.json",
    "categories": [
        {
            "name": "Gerenciamento de Identidade e Acesso"
        },
        {
            "name": "Topologia e conectividade de rede"
        },
        {
            "name": "Segurança"
        },
        {
            "name": "Gestão"
        },
        {
            "name": "Governança"
        },
        {
            "name": "Automação de plataforma e DevOps"
        }
    ],
    "items": [
        {
            "category": "Gestão",
            "guid": "06862505-2d9a-4874-9491-2837b00a3475",
            "link": "https://learn.microsoft.com/azure/api-management/backends",
            "severity": "Média",
            "subcategory": "Práticas recomendadas",
            "text": "Usar o recurso Back-ends para eliminar configurações redundantes de back-end de API"
        },
        {
            "category": "Gestão",
            "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
            "severity": "Média",
            "subcategory": "Práticas recomendadas",
            "text": "Usar Valores Nomeados para armazenar valores comuns que podem ser usados em políticas"
        },
        {
            "category": "Gestão",
            "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
            "severity": "Média",
            "subcategory": "Continuidade de negócios e recuperação de desastres",
            "text": "Implantar em várias regiões do Azure"
        },
        {
            "category": "Gestão",
            "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
            "link": "https://learn.microsoft.com/azure/api-management/high-availability",
            "severity": "Média",
            "subcategory": "Continuidade de negócios e recuperação de desastres",
            "text": "Implante pelo menos duas unidades de escala distribuídas em duas zonas de disponibilidade por região para obter a melhor disponibilidade e desempenho"
        },
        {
            "category": "Gestão",
            "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
            "severity": "Alto",
            "subcategory": "Continuidade de negócios e recuperação de desastres",
            "text": "Verifique se há uma rotina de backup automatizada"
        },
        {
            "category": "Gestão",
            "guid": "f96ddac5-77ec-4fa9-8833-4327f052059e",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-cache-external",
            "severity": "Média",
            "subcategory": "Desempenho e escalabilidade",
            "text": "Considere o uso de uma política de cache externo para APIs que podem se beneficiar do cache",
            "training": "https://learn.microsoft.com/training/modules/improve-api-performance-with-apim-caching-policy/"
        },
        {
            "category": "Gestão",
            "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
            "severity": "Baixo",
            "subcategory": "Desempenho e escalabilidade",
            "text": "Se você precisar registrar em altos níveis de desempenho, considere a política de Hubs de Eventos"
        },
        {
            "category": "Gestão",
            "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
            "severity": "Média",
            "subcategory": "Desempenho e escalabilidade",
            "text": "Aplicar políticas de limitação para controlar o número de solicitações por segundo",
            "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/"
        },
        {
            "category": "Gestão",
            "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
            "severity": "Média",
            "subcategory": "Desempenho e escalabilidade",
            "text": "Configurar o dimensionamento automático para expandir o número de instâncias quando a carga aumenta"
        },
        {
            "category": "Gestão",
            "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
            "severity": "Média",
            "subcategory": "Desempenho e escalabilidade",
            "text": "Implante gateways auto-hospedados onde o Azure não tem uma região próxima às APIs de back-end."
        },
        {
            "category": "Governança",
            "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
            "severity": "Média",
            "subcategory": "Práticas recomendadas de desenvolvimento",
            "text": "Implementar uma política de tratamento de erros a nível global"
        },
        {
            "category": "Governança",
            "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
            "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
            "severity": "Média",
            "subcategory": "Práticas recomendadas de desenvolvimento",
            "text": "Certifique-se de que todas as políticas de APIs incluam um <base/> elemento."
        },
        {
            "category": "Governança",
            "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
            "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
            "severity": "Média",
            "subcategory": "Práticas recomendadas de desenvolvimento",
            "text": "Use fragmentos de política para evitar repetir as mesmas definições de políticas em várias APIs"
        },
        {
            "category": "Governança",
            "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
            "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
            "severity": "Média",
            "subcategory": "Monetização",
            "text": "Se você planeja monetizar suas APIs, revise o artigo \"suporte de monetização\" para obter as práticas recomendadas"
        },
        {
            "category": "Governança",
            "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
            "severity": "Alto",
            "subcategory": "Monitorização",
            "text": "Habilitar Configurações de Diagnóstico para exportar logs para o Azure Monitor"
        },
        {
            "category": "Governança",
            "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Habilite o Application Insights para telemetria mais detalhada"
        },
        {
            "category": "Governança",
            "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
            "severity": "Alto",
            "subcategory": "Monitorização",
            "text": "Configurar alertas sobre as métricas mais críticas"
        },
        {
            "category": "Gerenciamento de Identidade e Acesso",
            "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
            "severity": "Alto",
            "subcategory": "Proteção de dados",
            "text": "Verifique se os certificados SSL personalizados são armazenados em um Cofre de Chaves do Azure para que possam ser acessados e atualizados com segurança"
        },
        {
            "category": "Gerenciamento de Identidade e Acesso",
            "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
            "severity": "Alto",
            "subcategory": "Identidade",
            "text": "Proteger solicitações de entrada para APIs (plano de dados) com o Azure AD"
        },
        {
            "category": "Gerenciamento de Identidade e Acesso",
            "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
            "severity": "Média",
            "subcategory": "Identidade",
            "text": "Usar o AD do Azure para autenticar usuários no Portal do Desenvolvedor"
        },
        {
            "category": "Gerenciamento de Identidade e Acesso",
            "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
            "severity": "Média",
            "subcategory": "Acesso privilegiado",
            "text": "Criar grupos apropriados para controlar a visibilidade dos produtos"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
            "severity": "Média",
            "subcategory": "Segurança",
            "text": "Implantar o serviço em uma rede virtual (VNET)"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
            "severity": "Média",
            "subcategory": "Segurança",
            "text": "Implante NSG (security groups, grupos de segurança de rede) em suas sub-redes para restringir ou monitorar o tráfego"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
            "severity": "Média",
            "subcategory": "Segurança",
            "text": "Implantar pontos de extremidade privados para filtrar o tráfego de entrada quando a VNET não é usada"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
            "severity": "Alto",
            "subcategory": "Segurança",
            "text": "Desabilitar o acesso à rede pública"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "7519e385-a88b-4d34-966b-6269d686e890",
            "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
            "severity": "Média",
            "subcategory": "Conectividade",
            "text": "Usar o Azure Front Door para implantação em várias regiões"
        },
        {
            "category": "Automação de plataforma e DevOps",
            "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
            "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
            "severity": "Média",
            "subcategory": "Automação",
            "text": "Simplifique o gerenciamento com scripts de automação do PowerShell"
        },
        {
            "category": "Automação de plataforma e DevOps",
            "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
            "severity": "Média",
            "subcategory": "Práticas recomendadas",
            "text": "Revise as práticas recomendadas de DevOps do Cloud Adaption Framework APIM Landing Zone Accelerator"
        },
        {
            "category": "Automação de plataforma e DevOps",
            "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
            "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
            "severity": "Média",
            "subcategory": "Práticas recomendadas",
            "text": "Promova o uso da extensão Visual Studio Code APIM para um desenvolvimento de API mais rápido"
        },
        {
            "category": "Automação de plataforma e DevOps",
            "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
            "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
            "severity": "Média",
            "subcategory": "DevOps",
            "text": "Implementar DevOps e CI/CD em seu fluxo de trabalho"
        },
        {
            "category": "Segurança",
            "guid": "b6439493-426a-45f3-9697-cf65baee208d",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
            "severity": "Média",
            "subcategory": "Apis",
            "text": "Proteger APIs usando autenticação de certificado de cliente"
        },
        {
            "category": "Segurança",
            "guid": "2a67d143-1033-4c0a-8732-680896478f08",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
            "severity": "Média",
            "subcategory": "Apis",
            "text": "Serviços de back-end seguros usando autenticação de certificado de cliente"
        },
        {
            "category": "Segurança",
            "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
            "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
            "severity": "Média",
            "subcategory": "Apis",
            "text": "Revise o artigo \"Recomendações para mitigar as 10 principais ameaças da segurança da API OWASP\" e verifique o que é aplicável às suas APIs"
        },
        {
            "category": "Segurança",
            "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
            "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
            "severity": "Média",
            "subcategory": "Apis",
            "text": "Usar o recurso Autorizações para simplificar o gerenciamento do token OAuth 2.0 para suas APIs de back-end"
        },
        {
            "category": "Segurança",
            "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
            "severity": "Alto",
            "subcategory": "Cifras",
            "text": "Use a versão mais recente do TLS ao criptografar informações em trânsito. Desative protocolos e cifras desatualizados e desnecessários sempre que possível."
        },
        {
            "category": "Segurança",
            "guid": "f8af3d94-1d2b-4070-846f-849197524258",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
            "severity": "Alto",
            "subcategory": "Proteção de dados",
            "text": "Verifique se os segredos (valores nomeados) são armazenados em um Cofre de Chaves do Azure para que possam ser acessados e atualizados com segurança"
        },
        {
            "category": "Segurança",
            "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
            "severity": "Média",
            "subcategory": "Identidades",
            "text": "Usar identidades gerenciadas para autenticar em outros recursos do Azure sempre que possível"
        },
        {
            "category": "Segurança",
            "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
            "severity": "Alto",
            "subcategory": "Rede",
            "text": "Usar o WAF (firewall de aplicativos Web) implantando o Gateway de Aplicativo na frente do APIM"
        }
    ],
    "metadata": {
        "name": "Azure API Management Review"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Média"
        },
        {
            "name": "Baixo"
        }
    ],
    "status": [
        {
            "description": "Esta verificação ainda não foi analisada",
            "name": "Não verificado"
        },
        {
            "description": "Há um item de ação associado a essa verificação",
            "name": "Abrir"
        },
        {
            "description": "Essa verificação foi verificada e não há mais itens de ação associados a ela",
            "name": "Cumprido"
        },
        {
            "description": "Recomendação entendida, mas não necessária pelos requisitos atuais",
            "name": "Não é necessário"
        },
        {
            "description": "Não aplicável ao projeto atual",
            "name": "N/A"
        }
    ]
}
checklists/apim_checklist.ko.json METASEP
{
    "$schema": "checklist.schema.json",
    "categories": [
        {
            "name": "ID 및 액세스 관리"
        },
        {
            "name": "네트워크 토폴로지 및 연결"
        },
        {
            "name": "안전"
        },
        {
            "name": "경영"
        },
        {
            "name": "거버넌스"
        },
        {
            "name": "플랫폼 자동화 및 데브옵스"
        }
    ],
    "items": [
        {
            "category": "경영",
            "guid": "06862505-2d9a-4874-9491-2837b00a3475",
            "link": "https://learn.microsoft.com/azure/api-management/backends",
            "severity": "보통",
            "subcategory": "권장사항",
            "text": "백엔드 기능을 사용하여 중복 API 백엔드 구성 제거"
        },
        {
            "category": "경영",
            "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
            "severity": "보통",
            "subcategory": "권장사항",
            "text": "명명된 값을 사용하여 정책에서 사용할 수 있는 공통 값 저장"
        },
        {
            "category": "경영",
            "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
            "severity": "보통",
            "subcategory": "비즈니스 연속성 및 재해 복구",
            "text": "여러 Azure 지역에 배포"
        },
        {
            "category": "경영",
            "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
            "link": "https://learn.microsoft.com/azure/api-management/high-availability",
            "severity": "보통",
            "subcategory": "비즈니스 연속성 및 재해 복구",
            "text": "최상의 가용성과 성능을 위해 지역당 두 개의 가용성 영역에 분산된 두 개 이상의 배율 단위 배포"
        },
        {
            "category": "경영",
            "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
            "severity": "높다",
            "subcategory": "비즈니스 연속성 및 재해 복구",
            "text": "자동화된 백업 루틴이 있는지 확인"
        },
        {
            "category": "경영",
            "guid": "f96ddac5-77ec-4fa9-8833-4327f052059e",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-cache-external",
            "severity": "보통",
            "subcategory": "성능 및 확장성",
            "text": "캐싱을 활용할 수 있는 API에 대해 외부 캐시 정책 사용 고려",
            "training": "https://learn.microsoft.com/training/modules/improve-api-performance-with-apim-caching-policy/"
        },
        {
            "category": "경영",
            "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
            "severity": "낮다",
            "subcategory": "성능 및 확장성",
            "text": "고성능 수준에서 기록해야 하는 경우 Event Hubs 정책을 고려합니다."
        },
        {
            "category": "경영",
            "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
            "severity": "보통",
            "subcategory": "성능 및 확장성",
            "text": "제한 정책을 적용하여 초당 요청 수 제어",
            "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/"
        },
        {
            "category": "경영",
            "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
            "severity": "보통",
            "subcategory": "성능 및 확장성",
            "text": "부하가 증가할 때 인스턴스 수를 확장하도록 자동 크기 조정 구성"
        },
        {
            "category": "경영",
            "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
            "severity": "보통",
            "subcategory": "성능 및 확장성",
            "text": "Azure에 백 엔드 API에 가까운 지역이 없는 자체 호스팅 게이트웨이를 배포합니다."
        },
        {
            "category": "거버넌스",
            "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
            "severity": "보통",
            "subcategory": "개발 권장사항",
            "text": "전역 수준에서 오류 처리 정책 구현"
        },
        {
            "category": "거버넌스",
            "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
            "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
            "severity": "보통",
            "subcategory": "개발 권장사항",
            "text": "모든 API 정책에 요소가 포함되어 <base/> 있는지 확인합니다."
        },
        {
            "category": "거버넌스",
            "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
            "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
            "severity": "보통",
            "subcategory": "개발 권장사항",
            "text": "정책 조각을 사용하여 여러 API에서 동일한 정책 정의가 반복되지 않도록 합니다."
        },
        {
            "category": "거버넌스",
            "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
            "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
            "severity": "보통",
            "subcategory": "수익 창출",
            "text": "API로 수익을 창출할 계획이라면 '수익화 지원' 문서에서 권장사항을 검토하세요."
        },
        {
            "category": "거버넌스",
            "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
            "severity": "높다",
            "subcategory": "모니터링",
            "text": "진단 설정을 사용하도록 설정하여 로그를 Azure 모니터로 내보내기"
        },
        {
            "category": "거버넌스",
            "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "더 자세한 원격 분석을 위해 응용 프로그램 인사이트 사용"
        },
        {
            "category": "거버넌스",
            "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
            "severity": "높다",
            "subcategory": "모니터링",
            "text": "가장 중요한 메트릭에 대한 경고 구성"
        },
        {
            "category": "ID 및 액세스 관리",
            "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
            "severity": "높다",
            "subcategory": "데이터 보호",
            "text": "사용자 지정 SSL 인증서가 Azure 키 자격 증명 모음에 저장되어 안전하게 액세스하고 업데이트할 수 있는지 확인합니다."
        },
        {
            "category": "ID 및 액세스 관리",
            "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
            "severity": "높다",
            "subcategory": "신원",
            "text": "Azure AD를 사용하여 API(데이터 평면)로 들어오는 요청 보호"
        },
        {
            "category": "ID 및 액세스 관리",
            "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
            "severity": "보통",
            "subcategory": "신원",
            "text": "Azure AD를 사용하여 개발자 포털에서 사용자 인증"
        },
        {
            "category": "ID 및 액세스 관리",
            "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
            "severity": "보통",
            "subcategory": "권한 있는 액세스",
            "text": "제품의 가시성을 제어하기 위해 적절한 그룹 만들기"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
            "severity": "보통",
            "subcategory": "안전",
            "text": "VNET(가상 네트워크) 내에 서비스 배포"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
            "severity": "보통",
            "subcategory": "안전",
            "text": "서브넷에 NSG(네트워크 보안 그룹)를 배포하여 트래픽을 제한하거나 모니터링합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
            "severity": "보통",
            "subcategory": "안전",
            "text": "프라이빗 엔드포인트를 배포하여 VNET을 사용하지 않을 때 들어오는 트래픽을 필터링합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
            "severity": "높다",
            "subcategory": "안전",
            "text": "공용 네트워크 액세스 사용 안 함"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "7519e385-a88b-4d34-966b-6269d686e890",
            "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
            "severity": "보통",
            "subcategory": "인터넷",
            "text": "다중 지역 배포에 Azure 프런트 도어 사용"
        },
        {
            "category": "플랫폼 자동화 및 데브옵스",
            "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
            "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
            "severity": "보통",
            "subcategory": "자동화",
            "text": "PowerShell 자동화 스크립트로 관리 간소화"
        },
        {
            "category": "플랫폼 자동화 및 데브옵스",
            "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
            "severity": "보통",
            "subcategory": "권장사항",
            "text": "클라우드 적응 프레임워크 APIM 랜딩 존 가속기에서 DevOps 모범 사례 검토"
        },
        {
            "category": "플랫폼 자동화 및 데브옵스",
            "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
            "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
            "severity": "보통",
            "subcategory": "권장사항",
            "text": "더 빠른 API 개발을 위해 비주얼 스튜디오 코드 APIM 확장의 사용 촉진"
        },
        {
            "category": "플랫폼 자동화 및 데브옵스",
            "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
            "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
            "severity": "보통",
            "subcategory": "데브옵스",
            "text": "워크플로에서 DevOps 및 CI/CD 구현"
        },
        {
            "category": "안전",
            "guid": "b6439493-426a-45f3-9697-cf65baee208d",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
            "severity": "보통",
            "subcategory": "증권 시세 표시기",
            "text": "클라이언트 인증서 인증을 사용하는 보안 API"
        },
        {
            "category": "안전",
            "guid": "2a67d143-1033-4c0a-8732-680896478f08",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
            "severity": "보통",
            "subcategory": "증권 시세 표시기",
            "text": "클라이언트 인증서 인증을 사용하는 보안 백엔드 서비스"
        },
        {
            "category": "안전",
            "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
            "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
            "severity": "보통",
            "subcategory": "증권 시세 표시기",
            "text": "'OWASP API 보안 상위 10개 위협을 완화하기 위한 권장 사항' 문서를 검토하고 API에 적용할 수 있는 항목을 확인합니다."
        },
        {
            "category": "안전",
            "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
            "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
            "severity": "보통",
            "subcategory": "증권 시세 표시기",
            "text": "권한 부여 기능을 사용하여 백 엔드 API에 대한 OAuth 2.0 토큰 관리 간소화"
        },
        {
            "category": "안전",
            "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
            "severity": "높다",
            "subcategory": "암호",
            "text": "전송 중인 정보를 암호화할 때 최신 TLS 버전을 사용합니다. 가능한 경우 오래되고 불필요한 프로토콜과 암호를 비활성화합니다."
        },
        {
            "category": "안전",
            "guid": "f8af3d94-1d2b-4070-846f-849197524258",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
            "severity": "높다",
            "subcategory": "데이터 보호",
            "text": "비밀(명명된 값)이 Azure Key Vault에 저장되어 안전하게 액세스하고 업데이트할 수 있는지 확인합니다."
        },
        {
            "category": "안전",
            "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
            "severity": "보통",
            "subcategory": "아이덴티티",
            "text": "가능한 경우 관리 ID를 사용하여 다른 Azure 리소스에 인증"
        },
        {
            "category": "안전",
            "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
            "severity": "높다",
            "subcategory": "네트워크",
            "text": "APIM 앞에 응용 프로그램 게이트웨이를 배포하여 WAF(웹 응용 프로그램 방화벽) 사용"
        }
    ],
    "metadata": {
        "name": "Azure API Management Review"
    },
    "severities": [
        {
            "name": "높다"
        },
        {
            "name": "보통"
        },
        {
            "name": "낮다"
        }
    ],
    "status": [
        {
            "description": "이 검사는 아직 검토되지 않았습니다.",
            "name": "확인되지 않음"
        },
        {
            "description": "이 검사와 연결된 작업 항목이 있습니다.",
            "name": "열다"
        },
        {
            "description": "이 검사가 확인되었으며 연결된 추가 작업 항목이 없습니다.",
            "name": "성취"
        },
        {
            "description": "권장 사항을 이해했지만 현재 요구 사항에서 필요하지 않음",
            "name": "필요하지 않음"
        },
        {
            "description": "현재 디자인에는 적용되지 않음",
            "name": "해당 없음"
        }
    ]
}
checklists/apim_checklist.ja.json METASEP
{
    "$schema": "checklist.schema.json",
    "categories": [
        {
            "name": "ID およびアクセス管理"
        },
        {
            "name": "ネットワーク トポロジと接続性"
        },
        {
            "name": "安全"
        },
        {
            "name": "管理"
        },
        {
            "name": "統治"
        },
        {
            "name": "プラットフォームの自動化とDevOps"
        }
    ],
    "items": [
        {
            "category": "管理",
            "guid": "06862505-2d9a-4874-9491-2837b00a3475",
            "link": "https://learn.microsoft.com/azure/api-management/backends",
            "severity": "中程度",
            "subcategory": "おすすめの方法",
            "text": "バックエンド機能を使用して冗長なAPIバックエンド構成を排除"
        },
        {
            "category": "管理",
            "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
            "severity": "中程度",
            "subcategory": "おすすめの方法",
            "text": "名前付き値を使用して、ポリシーで使用できる共通の値を格納する"
        },
        {
            "category": "管理",
            "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
            "severity": "中程度",
            "subcategory": "ビジネス継続性と災害復旧",
            "text": "複数の Azure リージョンにデプロイする"
        },
        {
            "category": "管理",
            "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
            "link": "https://learn.microsoft.com/azure/api-management/high-availability",
            "severity": "中程度",
            "subcategory": "ビジネス継続性と災害復旧",
            "text": "リージョンごとに 2 つの可用性ゾーンに分散した少なくとも 2 つのスケール ユニットをデプロイして、最高の可用性とパフォーマンスを実現する"
        },
        {
            "category": "管理",
            "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
            "severity": "高い",
            "subcategory": "ビジネス継続性と災害復旧",
            "text": "自動バックアップルーチンがあることを確認する"
        },
        {
            "category": "管理",
            "guid": "f96ddac5-77ec-4fa9-8833-4327f052059e",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-cache-external",
            "severity": "中程度",
            "subcategory": "パフォーマンスとスケーラビリティ",
            "text": "キャッシュの恩恵を受けることができる API に外部キャッシュ ポリシーを使用することを検討する",
            "training": "https://learn.microsoft.com/training/modules/improve-api-performance-with-apim-caching-policy/"
        },
        {
            "category": "管理",
            "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
            "severity": "低い",
            "subcategory": "パフォーマンスとスケーラビリティ",
            "text": "高いパフォーマンス レベルでログを記録する必要がある場合は、Event Hubs ポリシーを検討してください。"
        },
        {
            "category": "管理",
            "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
            "severity": "中程度",
            "subcategory": "パフォーマンスとスケーラビリティ",
            "text": "調整ポリシーを適用して 1 秒あたりの要求数を制御する",
            "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/"
        },
        {
            "category": "管理",
            "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
            "severity": "中程度",
            "subcategory": "パフォーマンスとスケーラビリティ",
            "text": "負荷が増加したときにインスタンス数をスケールアウトするように自動スケールを構成する"
        },
        {
            "category": "管理",
            "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
            "severity": "中程度",
            "subcategory": "パフォーマンスとスケーラビリティ",
            "text": "Azure にバックエンド API に近いリージョンがないセルフホステッド ゲートウェイをデプロイします。"
        },
        {
            "category": "統治",
            "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
            "severity": "中程度",
            "subcategory": "開発のベストプラクティス",
            "text": "グローバルレベルでのエラー処理ポリシーの実装"
        },
        {
            "category": "統治",
            "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
            "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
            "severity": "中程度",
            "subcategory": "開発のベストプラクティス",
            "text": "すべての API ポリシーに<base/>要素が含まれていることを確認します。"
        },
        {
            "category": "統治",
            "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
            "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
            "severity": "中程度",
            "subcategory": "開発のベストプラクティス",
            "text": "ポリシーフラグメントを使用して、複数のAPI間で同じポリシー定義を繰り返さないようにする"
        },
        {
            "category": "統治",
            "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
            "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
            "severity": "中程度",
            "subcategory": "収益",
            "text": "APIの収益化を計画している場合は、「収益化サポート」の記事でベストプラクティスを確認してください。"
        },
        {
            "category": "統治",
            "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
            "severity": "高い",
            "subcategory": "モニタリング",
            "text": "診断設定を有効にしてログを Azure モニターにエクスポートする"
        },
        {
            "category": "統治",
            "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "より詳細なテレメトリのためのアプリケーション分析情報を有効にする"
        },
        {
            "category": "統治",
            "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
            "severity": "高い",
            "subcategory": "モニタリング",
            "text": "最も重要なメトリックに関するアラートを構成する"
        },
        {
            "category": "ID およびアクセス管理",
            "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
            "severity": "高い",
            "subcategory": "データ保護",
            "text": "カスタム SSL 証明書が Azure Key Vault に格納されていることを確認して、安全にアクセスして更新できるようにする"
        },
        {
            "category": "ID およびアクセス管理",
            "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
            "severity": "高い",
            "subcategory": "同一性",
            "text": "Azure AD を使用して API (データ プレーン) への受信要求を保護する"
        },
        {
            "category": "ID およびアクセス管理",
            "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
            "severity": "中程度",
            "subcategory": "同一性",
            "text": "Azure AD を使用して開発者ポータルでユーザーを認証する"
        },
        {
            "category": "ID およびアクセス管理",
            "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
            "severity": "中程度",
            "subcategory": "特権アクセス",
            "text": "適切なグループを作成して、製品の可視性を制御します"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
            "severity": "中程度",
            "subcategory": "安全",
            "text": "仮想ネットワーク (VNET) 内にサービスをデプロイする"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
            "severity": "中程度",
            "subcategory": "安全",
            "text": "ネットワーク セキュリティ グループ (NSG) をサブネットにデプロイしてトラフィックを制限または監視する"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
            "severity": "中程度",
            "subcategory": "安全",
            "text": "プライベート エンドポイントをデプロイして、VNET が使用されていない場合に受信トラフィックをフィルター処理する"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
            "severity": "高い",
            "subcategory": "安全",
            "text": "パブリックネットワークアクセスを無効にする"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "7519e385-a88b-4d34-966b-6269d686e890",
            "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
            "severity": "中程度",
            "subcategory": "接続",
            "text": "複数リージョンのデプロイに Azure フロント ドアを使用する"
        },
        {
            "category": "プラットフォームの自動化とDevOps",
            "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
            "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
            "severity": "中程度",
            "subcategory": "オートメーション",
            "text": "PowerShell 自動化スクリプトによる管理の簡素化"
        },
        {
            "category": "プラットフォームの自動化とDevOps",
            "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
            "severity": "中程度",
            "subcategory": "おすすめの方法",
            "text": "クラウド適応フレームワーク APIM ランディング ゾーン アクセラレータからの DevOps のベスト プラクティスを確認する"
        },
        {
            "category": "プラットフォームの自動化とDevOps",
            "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
            "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
            "severity": "中程度",
            "subcategory": "おすすめの方法",
            "text": "迅速な API 開発のために Visual Studio Code APIM 拡張機能の使用を促進する"
        },
        {
            "category": "プラットフォームの自動化とDevOps",
            "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
            "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
            "severity": "中程度",
            "subcategory": "開発",
            "text": "ワークフローに DevOps と CI/CD を実装する"
        },
        {
            "category": "安全",
            "guid": "b6439493-426a-45f3-9697-cf65baee208d",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
            "severity": "中程度",
            "subcategory": "原薬",
            "text": "クライアント証明書認証を使用したセキュアな API"
        },
        {
            "category": "安全",
            "guid": "2a67d143-1033-4c0a-8732-680896478f08",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
            "severity": "中程度",
            "subcategory": "原薬",
            "text": "クライアント証明書認証を使用したバックエンド サービスのセキュリティ保護"
        },
        {
            "category": "安全",
            "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
            "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
            "severity": "中程度",
            "subcategory": "原薬",
            "text": "「OWASP APIセキュリティの上位10の脅威を軽減するための推奨事項」の記事を確認し、APIに適用できるものを確認してください"
        },
        {
            "category": "安全",
            "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
            "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
            "severity": "中程度",
            "subcategory": "原薬",
            "text": "承認機能を使用して、バックエンド API の OAuth 2.0 トークンの管理を簡素化する"
        },
        {
            "category": "安全",
            "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
            "severity": "高い",
            "subcategory": "暗号",
            "text": "転送中の情報を暗号化する場合は、最新の TLS バージョンを使用します。可能な場合は、古くて不要なプロトコルと暗号を無効にします。"
        },
        {
            "category": "安全",
            "guid": "f8af3d94-1d2b-4070-846f-849197524258",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
            "severity": "高い",
            "subcategory": "データ保護",
            "text": "シークレット (名前付き値) が Azure Key Vault に格納されていることを確認して、安全にアクセスして更新できるようにします。"
        },
        {
            "category": "安全",
            "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
            "severity": "中程度",
            "subcategory": "アイデンティティ",
            "text": "可能な限り、マネージド ID を使用して他の Azure リソースに対する認証を行う"
        },
        {
            "category": "安全",
            "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
            "severity": "高い",
            "subcategory": "ネットワーク",
            "text": "API の前にアプリケーション ゲートウェイをデプロイして Web アプリケーション ファイアウォール (WAF) を使用する"
        }
    ],
    "metadata": {
        "name": "Azure API Management Review"
    },
    "severities": [
        {
            "name": "高い"
        },
        {
            "name": "中程度"
        },
        {
            "name": "低い"
        }
    ],
    "status": [
        {
            "description": "このチェックはまだ確認されていません",
            "name": "未確認"
        },
        {
            "description": "このチェックに関連付けられているアクションアイテムがあります",
            "name": "開ける"
        },
        {
            "description": "このチェックは検証済みであり、それ以上のアクションアイテムは関連付けられていません",
            "name": "達成"
        },
        {
            "description": "推奨事項は理解されていますが、現在の要件では必要ありません",
            "name": "必須ではありません"
        },
        {
            "description": "現在のデザインには適用できません",
            "name": "該当なし"
        }
    ]
}
checklists/apim_checklist.es.json METASEP
{
    "$schema": "checklist.schema.json",
    "categories": [
        {
            "name": "Gestión de identidades y accesos"
        },
        {
            "name": "Topología y conectividad de red"
        },
        {
            "name": "Seguridad"
        },
        {
            "name": "Administración"
        },
        {
            "name": "Gobernanza"
        },
        {
            "name": "Automatización de plataformas y DevOps"
        }
    ],
    "items": [
        {
            "category": "Administración",
            "guid": "06862505-2d9a-4874-9491-2837b00a3475",
            "link": "https://learn.microsoft.com/azure/api-management/backends",
            "severity": "Medio",
            "subcategory": "Prácticas recomendadas",
            "text": "Utilice la función Backends para eliminar las configuraciones redundantes de backend de API"
        },
        {
            "category": "Administración",
            "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
            "severity": "Medio",
            "subcategory": "Prácticas recomendadas",
            "text": "Usar valores con nombre para almacenar valores comunes que se pueden usar en directivas"
        },
        {
            "category": "Administración",
            "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
            "severity": "Medio",
            "subcategory": "Continuidad del negocio y recuperación ante desastres",
            "text": "Implementación en varias regiones de Azure"
        },
        {
            "category": "Administración",
            "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
            "link": "https://learn.microsoft.com/azure/api-management/high-availability",
            "severity": "Medio",
            "subcategory": "Continuidad del negocio y recuperación ante desastres",
            "text": "Implemente al menos dos unidades de escala distribuidas en dos zonas de disponibilidad por región para obtener la mejor disponibilidad y rendimiento"
        },
        {
            "category": "Administración",
            "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
            "severity": "Alto",
            "subcategory": "Continuidad del negocio y recuperación ante desastres",
            "text": "Asegúrese de que haya una rutina de copia de seguridad automatizada"
        },
        {
            "category": "Administración",
            "guid": "f96ddac5-77ec-4fa9-8833-4327f052059e",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-cache-external",
            "severity": "Medio",
            "subcategory": "Rendimiento y escalabilidad",
            "text": "Considere la posibilidad de usar una directiva de caché externa para las API que pueden beneficiarse del almacenamiento en caché",
            "training": "https://learn.microsoft.com/training/modules/improve-api-performance-with-apim-caching-policy/"
        },
        {
            "category": "Administración",
            "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
            "severity": "Bajo",
            "subcategory": "Rendimiento y escalabilidad",
            "text": "Si necesita iniciar sesión con niveles de alto rendimiento, tenga en cuenta la directiva de Centros de eventos"
        },
        {
            "category": "Administración",
            "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
            "severity": "Medio",
            "subcategory": "Rendimiento y escalabilidad",
            "text": "Aplicar directivas de limitación para controlar el número de solicitudes por segundo",
            "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/"
        },
        {
            "category": "Administración",
            "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
            "severity": "Medio",
            "subcategory": "Rendimiento y escalabilidad",
            "text": "Configurar el escalado automático para escalar horizontalmente el número de instancias cuando aumenta la carga"
        },
        {
            "category": "Administración",
            "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
            "severity": "Medio",
            "subcategory": "Rendimiento y escalabilidad",
            "text": "Implemente puertas de enlace autohospedadas donde Azure no tenga una región cercana a las API back-end."
        },
        {
            "category": "Gobernanza",
            "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
            "severity": "Medio",
            "subcategory": "Prácticas recomendadas de desarrollo",
            "text": "Implementar una directiva de control de errores a nivel global"
        },
        {
            "category": "Gobernanza",
            "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
            "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
            "severity": "Medio",
            "subcategory": "Prácticas recomendadas de desarrollo",
            "text": "Asegúrese de que todas las directivas de API incluyan un <base/> elemento."
        },
        {
            "category": "Gobernanza",
            "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
            "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
            "severity": "Medio",
            "subcategory": "Prácticas recomendadas de desarrollo",
            "text": "Usar fragmentos de directivas para evitar repetir las mismas definiciones de directivas en varias API"
        },
        {
            "category": "Gobernanza",
            "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
            "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
            "severity": "Medio",
            "subcategory": "Monetización",
            "text": "Si planeas monetizar tus API, revisa el artículo \"Soporte de monetización\" para conocer las prácticas recomendadas."
        },
        {
            "category": "Gobernanza",
            "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
            "severity": "Alto",
            "subcategory": "Monitorización",
            "text": "Habilitación de la configuración de diagnóstico para exportar registros a Azure Monitor"
        },
        {
            "category": "Gobernanza",
            "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Habilitar Application Insights para una telemetría más detallada"
        },
        {
            "category": "Gobernanza",
            "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
            "severity": "Alto",
            "subcategory": "Monitorización",
            "text": "Configurar alertas sobre las métricas más críticas"
        },
        {
            "category": "Gestión de identidades y accesos",
            "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
            "severity": "Alto",
            "subcategory": "Protección de datos",
            "text": "Asegúrese de que los certificados SSL personalizados se almacenan en Azure Key Vault para que se pueda acceder a ellos y actualizarlos de forma segura"
        },
        {
            "category": "Gestión de identidades y accesos",
            "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
            "severity": "Alto",
            "subcategory": "Identidad",
            "text": "Protección de las solicitudes entrantes a las API (plano de datos) con Azure AD"
        },
        {
            "category": "Gestión de identidades y accesos",
            "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
            "severity": "Medio",
            "subcategory": "Identidad",
            "text": "Uso de Azure AD para autenticar usuarios en el Portal para desarrolladores"
        },
        {
            "category": "Gestión de identidades y accesos",
            "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
            "severity": "Medio",
            "subcategory": "Acceso privilegiado",
            "text": "Crear grupos adecuados para controlar la visibilidad de los productos"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
            "severity": "Medio",
            "subcategory": "Seguridad",
            "text": "Implementar el servicio dentro de una red virtual (VNET)"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
            "severity": "Medio",
            "subcategory": "Seguridad",
            "text": "Implementar grupos de seguridad de red (NSG) en las subredes para restringir o supervisar el tráfico"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
            "severity": "Medio",
            "subcategory": "Seguridad",
            "text": "Implementar extremos privados para filtrar el tráfico entrante cuando no se usa la red virtual"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
            "severity": "Alto",
            "subcategory": "Seguridad",
            "text": "Deshabilitar el acceso a la red pública"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "7519e385-a88b-4d34-966b-6269d686e890",
            "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
            "severity": "Medio",
            "subcategory": "Conectividad",
            "text": "Uso de Azure Front Door para la implementación en varias regiones"
        },
        {
            "category": "Automatización de plataformas y DevOps",
            "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
            "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
            "severity": "Medio",
            "subcategory": "Automatización",
            "text": "Simplifique la administración con scripts de automatización de PowerShell"
        },
        {
            "category": "Automatización de plataformas y DevOps",
            "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
            "severity": "Medio",
            "subcategory": "Prácticas recomendadas",
            "text": "Revise las prácticas recomendadas de DevOps desde Cloud Adaption Framework APIM Landing Zone Accelerator"
        },
        {
            "category": "Automatización de plataformas y DevOps",
            "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
            "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
            "severity": "Medio",
            "subcategory": "Prácticas recomendadas",
            "text": "Promover el uso de la extensión APIM de Visual Studio Code para un desarrollo de API más rápido"
        },
        {
            "category": "Automatización de plataformas y DevOps",
            "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
            "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
            "severity": "Medio",
            "subcategory": "DevOps",
            "text": "Implemente DevOps y CI/CD en su flujo de trabajo"
        },
        {
            "category": "Seguridad",
            "guid": "b6439493-426a-45f3-9697-cf65baee208d",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
            "severity": "Medio",
            "subcategory": "Apis",
            "text": "API seguras mediante autenticación de certificados de cliente"
        },
        {
            "category": "Seguridad",
            "guid": "2a67d143-1033-4c0a-8732-680896478f08",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
            "severity": "Medio",
            "subcategory": "Apis",
            "text": "Servicios back-end seguros mediante la autenticación de certificados de cliente"
        },
        {
            "category": "Seguridad",
            "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
            "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
            "severity": "Medio",
            "subcategory": "Apis",
            "text": "Revise el artículo 'Recomendaciones para mitigar las 10 principales amenazas de seguridad de la API de OWASP' y verifique qué es aplicable a sus API"
        },
        {
            "category": "Seguridad",
            "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
            "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
            "severity": "Medio",
            "subcategory": "Apis",
            "text": "Use la característica Autorizaciones para simplificar la administración del token de OAuth 2.0 para sus API de back-end"
        },
        {
            "category": "Seguridad",
            "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
            "severity": "Alto",
            "subcategory": "Cifras",
            "text": "Utilice la versión más reciente de TLS al cifrar la información en tránsito. Deshabilite protocolos y cifrados obsoletos e innecesarios cuando sea posible."
        },
        {
            "category": "Seguridad",
            "guid": "f8af3d94-1d2b-4070-846f-849197524258",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
            "severity": "Alto",
            "subcategory": "Protección de datos",
            "text": "Asegúrese de que los secretos (valores con nombre) se almacenan en Azure Key Vault para que se pueda acceder a ellos y actualizarlos de forma segura"
        },
        {
            "category": "Seguridad",
            "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
            "severity": "Medio",
            "subcategory": "Identidades",
            "text": "Usar identidades administradas para autenticarse en otros recursos de Azure siempre que sea posible"
        },
        {
            "category": "Seguridad",
            "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
            "severity": "Alto",
            "subcategory": "Red",
            "text": "Usar firewall de aplicaciones web (WAF) implementando Application Gateway delante de APIM"
        }
    ],
    "metadata": {
        "name": "Azure API Management Review"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Medio"
        },
        {
            "name": "Bajo"
        }
    ],
    "status": [
        {
            "description": "Esta comprobación aún no se ha examinado",
            "name": "No verificado"
        },
        {
            "description": "Hay un elemento de acción asociado a esta comprobación",
            "name": "Abrir"
        },
        {
            "description": "Esta comprobación se ha comprobado y no hay más elementos de acción asociados a ella",
            "name": "Cumplido"
        },
        {
            "description": "Recomendación entendida, pero no necesaria por los requisitos actuales",
            "name": "No es necesario"
        },
        {
            "description": "No aplicable para el diseño actual",
            "name": "N/A"
        }
    ]
}
checklists/apim_checklist.en.json METASEP
{
    "$schema": "checklist.schema.json",
    "items": [
        {
            "category": "Management",
            "subcategory": "Best practices",
            "text": "Use Backends feature to eliminate redundant API backend configurations",
            "guid": "06862505-2d9a-4874-9491-2837b00a3475",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/backends"
        },
        {
            "category": "Management",
            "subcategory": "Best practices",
            "text": "Use Named Values to store common values that can be used in policies",
            "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal"
        },
        {
            "category": "Management",
            "subcategory": "Business continuity and disaster recovery",
            "text": "Deploy to multiple Azure regions",
            "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region"
        },
        {
            "category": "Management",
            "subcategory": "Business continuity and disaster recovery",
            "text": "Deploy at least two scale units spread over two availability zones per region for best availability and performance",
            "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/high-availability"
        },
        {
            "category": "Management",
            "subcategory": "Business continuity and disaster recovery",
            "text": "Ensure there is an automated backup routine",
            "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
            "severity": "High",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability"
        },
        {
            "category": "Management",
            "subcategory": "Performance and scalability",
            "text": "Consider using a external cache policy for APIs that can benefit from caching",
            "guid": "f96ddac5-77ec-4fa9-8833-4327f052059e",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-cache-external",
            "training": "https://learn.microsoft.com/training/modules/improve-api-performance-with-apim-caching-policy/"
        },
        {
            "category": "Management",
            "subcategory": "Performance and scalability",
            "text": "If you need to log at high performance levels, consider Event Hubs policy",
            "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs"
        },
        {
            "category": "Management",
            "subcategory": "Performance and scalability",
            "text": "Apply throttling policies to control the number of requests per second",
            "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
            "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/"
        },
        {
            "category": "Management",
            "subcategory": "Performance and scalability",
            "text": "Configure autoscaling to scale out the number of instances when the load increases",
            "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale"
        },
        {
            "category": "Management",
            "subcategory": "Performance and scalability",
            "text": "Deploy self-hosted gateways where Azure doesn't have a region close to the backend APIs.",
            "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway"
        },
        {
            "category": "Governance",
            "subcategory": "Development best practices",
            "text": "Implement an error handling policy at the global level",
            "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies"
        },
        {
            "category": "Governance",
            "subcategory": "Development best practices",
            "text": "Ensure all APIs policies include a <base/> element.",
            "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order"
        },
        {
            "category": "Governance",
            "subcategory": "Development best practices",
            "text": "Use Policy Fragments to avoid repeating same policies definitions across multiple APIs",
            "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/policy-fragments"
        },
        {
            "category": "Governance",
            "subcategory": "Monetization",
            "text": "If you are planning to monetize your APIs, review the 'monetization support' article for best practices",
            "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/monetization-support"
        },
        {
            "category": "Governance",
            "subcategory": "Monitoring",
            "text": "Enable Diagnostics Settings to export logs to Azure Monitor",
            "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs"
        },
        {
            "category": "Governance",
            "subcategory": "Monitoring",
            "text": "Enable Application Insights for more detailed telemetry",
            "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights"
        },
        {
            "category": "Governance",
            "subcategory": "Monitoring",
            "text": "Configure alerts on the most critical metrics",
            "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Data protection",
            "text": "Ensure that custom SSL certificates are stored an Azure Key Vault so they can be securely accessed and updated",
            "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
            "severity": "High",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Identity",
            "text": "Protect incoming requests to APIs (data plane) with Azure AD",
            "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
            "severity": "High",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Identity",
            "text": "Use Azure AD to authenticate users in the Developer Portal",
            "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Privileged access",
            "text": "Create appropriate groups to control the visibility of the products",
            "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Security",
            "text": "Deploy the service within a Virtual Network (VNET)",
            "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Security",
            "text": "Deploy network security groups (NSG) to your subnets to restrict or monitor traffic",
            "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Security",
            "text": "Deploy Private Endpoints to filter incoming traffic when VNET is not used",
            "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Security",
            "text": "Disable Public Network Access",
            "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
            "severity": "High",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Connectivity",
            "text": "Use Azure Front Door for multi-region deployment",
            "guid": "7519e385-a88b-4d34-966b-6269d686e890",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management"
        },
        {
            "category": "Platform automation and DevOps",
            "subcategory": "Automation",
            "text": "Simplify management with PowerShell automation scripts",
            "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management"
        },  
        {
            "category": "Platform automation and DevOps",
            "subcategory": "Best practices",
            "text": "Review DevOps best practices from the Cloud Adaption Framework APIM Landing Zone Accelerator",
            "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations"
        },
        {
            "category": "Platform automation and DevOps",
            "subcategory": "Best practices",
            "text": "Promote usage of Visual Studio Code APIM extension for faster API development",
            "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial"
        }, 
        {
            "category": "Platform automation and DevOps",
            "subcategory": "DevOps",
            "text": "Implement DevOps and CI/CD in your workflow",
            "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates"
        },
        {
            "category": "Security",
            "subcategory": "APIs",
            "text": "Secure APIs using client certificate authentication",
            "guid": "b6439493-426a-45f3-9697-cf65baee208d",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients"
        },
        {
            "category": "Security",
            "subcategory": "APIs",
            "text": "Secure backend services using client certificate authentication",
            "guid": "2a67d143-1033-4c0a-8732-680896478f08",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates"
        },
        {
            "category": "Security",
            "subcategory": "APIs",
            "text": "Review 'Recommendations to mitigate OWASP API Security Top 10 threats' article and check what is applicable to your APIs",
            "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats"
        },
        {
            "category": "Security",
            "subcategory": "APIs",
            "text": "Use Authorizations feature to simplify management of OAuth 2.0 token for your backend APIs",
            "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview"
        },
        {
            "category": "Security",
            "subcategory": "Ciphers",
            "text": "Use the latest TLS version when encrypting information in transit. Disable outdated and unnecessary protocols and ciphers when possible.",
            "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers"
        },
        {
            "category": "Security",
            "subcategory": "Data protection",
            "text": "Ensure that secrets (Named values) are stored an Azure Key Vault so they can be securely accessed and updated",
            "guid": "f8af3d94-1d2b-4070-846f-849197524258",
            "severity": "High",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets"
        },
        {
            "category": "Security",
            "subcategory": "Identities",
            "text": "Use managed identities to authenticate to other Azure resources whenever possible",
            "guid": "791abd8b-7706-4e31-9569-afefde724be3",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities"
        },
        {
            "category": "Security",
            "subcategory": "Network",
            "text": "Use web application firewall (WAF) by deploying Application Gateway in front of APIM",
            "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
            "severity": "High",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall"
        }
    ],
    "categories": [
        {
            "name": "Identity and Access Management"
        },
        {
            "name": "Network Topology and Connectivity"
        },
        {
            "name": "Security"
        },
        {
            "name": "Management"
        },
        {
            "name": "Governance"
        },
        {
            "name": "Platform automation and DevOps"
        }
    ],
    "status": [
        {
            "name": "Not verified",
            "description": "This check has not been looked at yet"
        },
        {
            "name": "Open",
            "description": "There is an action item associated to this check"
        },
        {
            "name": "Fulfilled",
            "description": "This check has been verified, and there are no further action items associated to it"
        },
        {
            "name": "Not required",
            "description": "Recommendation understood, but not needed by current requirements"
        },
        {
            "name": "N/A",
            "description": "Not applicable for current design"
        }
    ],
    "severities": [
        {
            "name": "High"
        },
        {
            "name": "Medium"
        },
        {
            "name": "Low"
        }
    ],
    "metadata": {
        "name": "Azure API Management Review",
        "timestamp": "Feb 13, 2023",
        "state": "GA"

    }
}
checklists/aks_checklist.pt.json METASEP
{
    "categories": [
        {
            "name": "Gerenciamento de Identidade e Acesso"
        },
        {
            "name": "Topologia e conectividade de rede"
        },
        {
            "name": "BC e DR"
        },
        {
            "name": "Governança e Segurança"
        },
        {
            "name": "Governança de Custos"
        },
        {
            "name": "Operações"
        },
        {
            "name": "Implantação de aplicativos"
        }
    ],
    "items": [
        {
            "category": "Implantação de aplicativos",
            "cost": 1,
            "guid": "785c2fa5-5b56-4ad4-a408-fe72734c476b",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/containers/aks/secure-baseline-aks",
            "severity": "Média",
            "subcategory": "Desenvolvimento",
            "text": "Usar implantações canárias ou azuis/verdes"
        },
        {
            "category": "Implantação de aplicativos",
            "cost": 1,
            "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
            "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
            "severity": "Baixo",
            "subcategory": "Desenvolvimento",
            "text": "Se requrired para cargas de trabalho do AKS Windows contêineres HostProcess podem ser usados"
        },
        {
            "category": "Implantação de aplicativos",
            "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
            "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
            "scale": 1,
            "severity": "Baixo",
            "simple": -1,
            "subcategory": "Desenvolvimento",
            "text": "Use o KEDA se estiver executando cargas de trabalho orientadas a eventos"
        },
        {
            "category": "Implantação de aplicativos",
            "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
            "link": "https://dapr.io/",
            "severity": "Baixo",
            "simple": 1,
            "subcategory": "Desenvolvimento",
            "text": "Use o Dapr para facilitar o desenvolvimento de microsserviços"
        },
        {
            "category": "Implantação de aplicativos",
            "guid": "3acbe04b-be20-49d3-afda-47778424d116",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/developer/terraform/create-k8s-cluster-with-tf-and-aks",
            "severity": "Média",
            "simple": -1,
            "subcategory": "Infraestrutura como código",
            "text": "Usar a automação por meio do ARM/TF para criar seus recursos do Azure"
        },
        {
            "category": "BC e DR",
            "guid": "36cb45e5-7960-4332-9bdf-8cc23318da61",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery",
            "severity": "Alto",
            "subcategory": "Recuperação de desastres",
            "text": "Agende e realize testes de DR regularmente"
        },
        {
            "category": "BC e DR",
            "guid": "170265f4-bb46-4a39-9af7-f317284797b1",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
            "severity": "Média",
            "subcategory": "Alta disponibilidade",
            "text": "Usar o Gerenciador de Tráfego do Azure ou o Azure Front Door como um balanceador de carga global para failover de região"
        },
        {
            "category": "BC e DR",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant= isnotnull(zones) | distinct id,compliant",
            "guid": "578a219a-46be-4b54-9350-24922634292b",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/availability-zones",
            "severity": "Média",
            "subcategory": "Alta disponibilidade",
            "text": "Usar Zonas de Disponibilidade se elas tiverem suporte em sua região do Azure"
        },
        {
            "category": "BC e DR",
            "cost": -2,
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
            "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
            "ha": 2,
            "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
            "severity": "Alto",
            "subcategory": "Alta disponibilidade",
            "text": "Use a oferta AKS apoiada por SLA"
        },
        {
            "category": "BC e DR",
            "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
            "severity": "Baixo",
            "simple": -1,
            "subcategory": "Alta disponibilidade",
            "text": "Usar orçamentos de interrupção em seu pod e definições de implantação"
        },
        {
            "category": "BC e DR",
            "cost": -1,
            "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
            "severity": "Alto",
            "subcategory": "Alta disponibilidade",
            "text": "Se estiver usando um registro privado, configure a replicação de região para armazenar imagens em várias regiões"
        },
        {
            "category": "BC e DR",
            "guid": "bc14aea6-e65d-48d9-a3ad-c218e6436b06",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery",
            "severity": "Alto",
            "subcategory": "Requisitos",
            "text": "Definir requisitos não funcionais, como SLAs, RTO (Recovery Time Objective) e RPO (Recovery Point Objective)."
        },
        {
            "category": "Governança de Custos",
            "cost": 1,
            "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
            "severity": "Baixo",
            "subcategory": "Custar",
            "text": "Use um aplicativo externo, como o kubecost, para alocar custos para diferentes usuários"
        },
        {
            "category": "Governança de Custos",
            "cost": 1,
            "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
            "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
            "severity": "Baixo",
            "subcategory": "Custar",
            "text": "Se necessário, dimensione instantâneos do NodePool"
        },
        {
            "category": "Governança de Custos",
            "cost": 1,
            "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
            "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
            "severity": "Baixo",
            "subcategory": "Custar",
            "text": "Usar o modo de redução para excluir/desalocar nós"
        },
        {
            "category": "Governança de Custos",
            "cost": 1,
            "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
            "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
            "severity": "Média",
            "subcategory": "Custar",
            "text": "Quando necessário, use GPU de partioning de várias instâncias em clusters AKS"
        },
        {
            "category": "Governança de Custos",
            "cost": 1,
            "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
            "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
            "severity": "Baixo",
            "subcategory": "Custar",
            "text": "Se estiver executando um cluster de Desenvolvimento/Teste, use Iniciar/Parar do NodePool"
        },
        {
            "category": "Governança e Segurança",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
            "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
            "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
            "security": 1,
            "severity": "Média",
            "simple": -1,
            "subcategory": "Conformidade",
            "text": "Usar a Política do Azure para Kubernetes para garantir a conformidade do cluster"
        },
        {
            "category": "Governança e Segurança",
            "cost": -1,
            "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
            "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
            "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
            "security": 1,
            "severity": "Média",
            "simple": -1,
            "subcategory": "Conformidade",
            "text": "Separe os aplicativos do plano de controle com os nodepools do usuário/sistema"
        },
        {
            "category": "Governança e Segurança",
            "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
            "severity": "Baixo",
            "simple": -1,
            "subcategory": "Conformidade",
            "text": "Adicione taint ao nodepool do seu sistema para torná-lo dedicado"
        },
        {
            "category": "Governança e Segurança",
            "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
            "link": "https://learn.microsoft.com/azure/container-registry/",
            "security": 1,
            "severity": "Média",
            "simple": -1,
            "subcategory": "Conformidade",
            "text": "Usar um registro privado para suas imagens, como ACR"
        },
        {
            "category": "Governança e Segurança",
            "cost": -1,
            "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
            "link": "https://learn.microsoft.com/azure/security-center/container-security",
            "security": 1,
            "severity": "Média",
            "subcategory": "Conformidade",
            "text": "Verificar suas imagens em busca de vulnerabilidades"
        },
        {
            "category": null,
            "cost": -1,
            "guid": "cc639637-a652-42ac-89e8-06965388e9de",
            "link": "https://learn.microsoft.com/azure/security-center/container-security",
            "security": 1,
            "severity": "Média",
            "subcategory": "Conformidade",
            "text": "Usar a Central de Segurança do Azure para detectar vulnerabilidades de postura de segurança"
        },
        {
            "category": "Governança e Segurança",
            "cost": -1,
            "guid": "42d4aefe-2383-470e-b019-c30df24996b2",
            "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-fips-enabled-node-pool",
            "security": 1,
            "severity": "Baixo",
            "subcategory": "Conformidade",
            "text": "Se necessário, configure o FIPS"
        },
        {
            "category": "Governança e Segurança",
            "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
            "security": 1,
            "severity": "Alto",
            "subcategory": "Conformidade",
            "text": "Definir requisitos de separação de aplicativos (namespace/nodepool/cluster)"
        },
        {
            "category": "Governança e Segurança",
            "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
            "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
            "security": 1,
            "severity": "Média",
            "simple": -1,
            "subcategory": "Segredos",
            "text": "Armazenar seus segredos no Cofre da Chave do Azure com o driver do CSI Secrets Store"
        },
        {
            "category": "Governança e Segurança",
            "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
            "link": "https://learn.microsoft.com/azure/aks/update-credentials",
            "security": 1,
            "severity": "Alto",
            "subcategory": "Segredos",
            "text": "Se estiver usando Entidades de Serviço para o cluster, atualize as credenciais periodicamente (como trimestralmente)"
        },
        {
            "category": "Governança e Segurança",
            "cost": -1,
            "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
            "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
            "security": 1,
            "severity": "Média",
            "subcategory": "Segredos",
            "text": "Se necessário, adicione criptografia etcd do Serviço de Gerenciamento de Chaves"
        },
        {
            "category": "Governança e Segurança",
            "cost": -1,
            "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
            "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
            "security": 1,
            "severity": "Baixo",
            "subcategory": "Segredos",
            "text": "Se necessário, considere o uso de Computação Confidencial para AKS"
        },
        {
            "category": "Governança e Segurança",
            "cost": -1,
            "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
            "security": 1,
            "severity": "Média",
            "subcategory": "Segredos",
            "text": "Considere o uso do Defender for Containers"
        },
        {
            "category": "Gerenciamento de Identidade e Acesso",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
            "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
            "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
            "severity": "Alto",
            "simple": 1,
            "subcategory": "Identidade",
            "text": "Usar identidades gerenciadas em vez de Entidades de Serviço"
        },
        {
            "category": "Gerenciamento de Identidade e Acesso",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
            "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad",
            "severity": "Média",
            "simple": 1,
            "subcategory": "Identidade",
            "text": "Integrar a autenticação com o AAD (usando a integração gerenciada)"
        },
        {
            "category": "Gerenciamento de Identidade e Acesso",
            "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
            "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
            "security": 1,
            "severity": "Média",
            "simple": -1,
            "subcategory": "Identidade",
            "text": "Limitar o acesso ao admin kubeconfig (get-credentials --admin)"
        },
        {
            "category": "Gerenciamento de Identidade e Acesso",
            "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
            "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
            "security": 1,
            "severity": "Média",
            "simple": -1,
            "subcategory": "Identidade",
            "text": "Integrar autorização com o AAD RBAC"
        },
        {
            "category": "Gerenciamento de Identidade e Acesso",
            "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
            "security": 1,
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Identidade",
            "text": "Usar namespaces para restringir o privilégio RBAC no Kubernetes"
        },
        {
            "category": "Gerenciamento de Identidade e Acesso",
            "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
            "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
            "security": 1,
            "severity": "Média",
            "simple": -1,
            "subcategory": "Identidade",
            "text": "Para o Gerenciamento de Acesso de Identidade POD, use a Identidade da Carga de Trabalho do Azure AD (visualização)"
        },
        {
            "category": "Gerenciamento de Identidade e Acesso",
            "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
            "security": 1,
            "severity": "Média",
            "simple": -1,
            "subcategory": "Identidade",
            "text": "Para logins não interativos do AKS, use kubelogin (visualização)"
        },
        {
            "category": "Gerenciamento de Identidade e Acesso",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
            "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
            "security": 1,
            "severity": "Média",
            "simple": -1,
            "subcategory": "Identidade",
            "text": "Desativar contas locais do AKS"
        },
        {
            "category": "Gerenciamento de Identidade e Acesso",
            "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
            "security": 1,
            "severity": "Baixo",
            "simple": -1,
            "subcategory": "Identidade",
            "text": "Configurar, se necessário, acesso ao cluster Just-in-time"
        },
        {
            "category": "Gerenciamento de Identidade e Acesso",
            "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
            "security": 1,
            "severity": "Baixo",
            "simple": -1,
            "subcategory": "Identidade",
            "text": "Configurar, se necessário, o acesso condicional do AAD para AKS"
        },
        {
            "category": "Gerenciamento de Identidade e Acesso",
            "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
            "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
            "security": 1,
            "severity": "Baixo",
            "simple": -1,
            "subcategory": "Identidade",
            "text": "Se necessário para cargas de trabalho do Windows AKS, configure o gMSA "
        },
        {
            "category": "Gerenciamento de Identidade e Acesso",
            "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
            "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
            "security": 1,
            "severity": "Média",
            "simple": -1,
            "subcategory": "Identidade",
            "text": "Para um controle mais preciso, considere o uso de uma identidade Kubelet gerenciada"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
            "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
            "security": 1,
            "severity": "Média",
            "simple": -1,
            "subcategory": "Práticas recomendadas",
            "text": "Se estiver usando AGIC, não compartilhe um AppGW entre clusters"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
            "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
            "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
            "scale": 1,
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Práticas recomendadas",
            "text": "Não use o AKS Application Routing Add-On"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
            "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
            "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
            "scale": 1,
            "severity": "Média",
            "simple": -1,
            "subcategory": "Práticas recomendadas",
            "text": "Para cargas de trabalho do Windows, use a Rede Acelerada"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
            "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
            "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
            "scale": 1,
            "severity": "Alto",
            "subcategory": "Práticas recomendadas",
            "text": "Use o ALB padrão (em oposição ao básico)"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
            "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
            "security": 1,
            "severity": "Média",
            "simple": -2,
            "subcategory": "Práticas recomendadas",
            "text": "Se estiver usando a CNI do Azure, considere o uso de sub-redes diferentes para NodePools"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
            "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
            "security": 1,
            "severity": "Média",
            "simple": -1,
            "subcategory": "Custar",
            "text": "Usar Pontos de Extremidade Privados (preferencialmente) ou Pontos de Extremidade de Serviço de Rede Virtual para acessar serviços de PaaS a partir do cluster"
        },
        {
            "category": "Topologia e conectividade de rede",
            "cost": -1,
            "guid": "e8a03f97-8794-468d-96a7-86d60f96c97b",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
            "severity": "Média",
            "subcategory": "HA",
            "text": "Se a conectividade híbrida for necessária, use 2xER ou ER+VPN para melhor disponibilidade"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
            "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
            "severity": "Alto",
            "simple": 1,
            "subcategory": "IPAM",
            "text": "Escolha o melhor plug-in de rede CNI para suas necessidades (CNI do Azure recomendado)"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
            "scale": 1,
            "severity": "Alto",
            "subcategory": "IPAM",
            "text": "Se estiver usando a CNI do Azure, dimensione sua sub-rede de acordo, considerando o número máximo de pods por nó"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
            "scale": 1,
            "severity": "Alto",
            "simple": -1,
            "subcategory": "IPAM",
            "text": "Se estiver usando a CNI do Azure, verifique o máximo de pods/nós (padrão 30)"
        },
        {
            "category": "Topologia e conectividade de rede",
            "description": "Para aplicativos internos, as organizações geralmente abrem toda a sub-rede AKS em seus firewalls. Isso também abre o acesso de rede aos nós e, potencialmente, aos pods também (se estiver usando a CNI do Azure). Se os IPs do LoadBalancer estiverem em uma sub-rede diferente, somente este precisará estar disponível para os clientes do aplicativo. Outra razão é que, se os endereços IP na sub-rede AKS forem um recurso escasso, consumir seus endereços IP para serviços reduzirá a escalabilidade máxima do cluster.",
            "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
            "link": "https://learn.microsoft.com/azure/aks/internal-lb",
            "security": 1,
            "severity": "Baixo",
            "simple": -1,
            "subcategory": "IPAM",
            "text": "Se estiver usando serviços LoadBalancer de IP privado, use uma sub-rede dedicada (não a sub-rede AKS)"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
            "scale": 1,
            "severity": "Alto",
            "subcategory": "IPAM",
            "text": "Dimensione o intervalo de endereços IP do serviço de acordo (ele limitará a escalabilidade do cluster)"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
            "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
            "security": 1,
            "severity": "Baixo",
            "simple": -2,
            "subcategory": "Operações",
            "text": "Se necessário, adicione seu próprio plug-in CNI"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
            "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
            "security": 1,
            "severity": "Baixo",
            "simple": -2,
            "subcategory": "Operações",
            "text": "Se necessário, configure o IP público por nó no AKS"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
            "link": "https://learn.microsoft.com/azure/aks/concepts-network",
            "scale": 1,
            "severity": "Média",
            "simple": -1,
            "subcategory": "Escalabilidade",
            "text": "Use um controlador de entrada para expor aplicativos baseados na Web em vez de expô-los com serviços do tipo LoadBalancer"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
            "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
            "scale": 1,
            "severity": "Baixo",
            "simple": -1,
            "subcategory": "Escalabilidade",
            "text": "Usar o Azue NAT Gateway como outboundType para dimensionar o tráfego de saída"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
            "scale": 1,
            "severity": "Média",
            "simple": -1,
            "subcategory": "Escalabilidade",
            "text": "Usar alocações dinâmicas de IPs para evitar o esgotamento do IP da CNI do Azure"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
            "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
            "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
            "security": 2,
            "severity": "Alto",
            "simple": -2,
            "subcategory": "Segurança",
            "text": "Filtre o tráfego de saída com o AzFW/NVA se os requisitos de segurança o exigirem"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
            "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
            "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
            "security": 1,
            "severity": "Média",
            "simple": -1,
            "subcategory": "Segurança",
            "text": "Se estiver usando um ponto de extremidade de API pública, restrinja os endereços IP que podem acessá-lo"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
            "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
            "link": "https://learn.microsoft.com/azure/aks/private-clusters",
            "security": 1,
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Segurança",
            "text": "Usar clusters privados se suas necessidades exigirem"
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
            "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
            "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
            "security": 1,
            "severity": "Média",
            "simple": -1,
            "subcategory": "Segurança",
            "text": "Para nós AKS do Windows 2019 e 2022, as políticas de rede Calico podem ser usadas "
        },
        {
            "category": "Topologia e conectividade de rede",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
            "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
            "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
            "security": 1,
            "severity": "Alto",
            "subcategory": "Segurança",
            "text": "Habilitar uma opção de Política de Rede do Kubernetes (Calico/Azure)"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
            "security": 1,
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Segurança",
            "text": "Use as diretivas de rede do Kubernetes para aumentar a segurança intracluster"
        },
        {
            "category": "Topologia e conectividade de rede",
            "cost": -1,
            "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
            "security": 2,
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Segurança",
            "text": "Usar um WAF para cargas de trabalho da Web (interfaces de usuário ou APIs)"
        },
        {
            "category": "Topologia e conectividade de rede",
            "cost": -2,
            "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
            "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
            "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
            "security": 2,
            "severity": "Média",
            "subcategory": "Segurança",
            "text": "Usar DDoS Standard na Rede Virtual AKS"
        },
        {
            "category": "Topologia e conectividade de rede",
            "cost": -2,
            "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
            "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
            "link": "https://learn.microsoft.com/azure/aks/http-proxy",
            "security": 2,
            "severity": "Baixo",
            "subcategory": "Segurança",
            "text": "Se necessário, adicione o Proxy HTTP da empresa"
        },
        {
            "category": "Topologia e conectividade de rede",
            "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
            "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
            "security": 1,
            "severity": "Média",
            "simple": -2,
            "subcategory": "Segurança",
            "text": "Considere o uso de uma malha de serviço para gerenciamento avançado de comunicação de microsserviços"
        },
        {
            "category": "Operações",
            "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Alertando",
            "text": "Configurar alertas sobre as métricas mais críticas (consulte Container Insights para obter recomendações)"
        },
        {
            "category": "Operações",
            "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
            "severity": "Baixo",
            "simple": -1,
            "subcategory": "Conformidade",
            "text": "Verifique regularmente o Azure Advisor para obter recomendações sobre seu cluster"
        },
        {
            "category": "Operações",
            "guid": "5388e9de-d167-4dd1-a2b0-ac241b999a64",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
            "severity": "Baixo",
            "simple": 1,
            "subcategory": "Conformidade",
            "text": "Desenvolva seus manifestos YAML com editores de texto inteligentes, como vscode+kubeadvisor"
        },
        {
            "category": "Operações",
            "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
            "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
            "severity": "Baixo",
            "simple": 1,
            "subcategory": "Conformidade",
            "text": "Ativar a rotação automática de certificados do AKS"
        },
        {
            "category": "Operações",
            "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
            "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
            "security": 1,
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Conformidade",
            "text": "Tenha um processo regular para atualizar sua versão do kubernetes periodicamente (trimestralmente, por exemplo) ou use o recurso de atualização automática do AKS"
        },
        {
            "category": "Operações",
            "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
            "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Conformidade",
            "text": "Use kured para atualizações de nó Linux caso você não esteja usando a atualização de imagem de nó"
        },
        {
            "category": "Operações",
            "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
            "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
            "security": 1,
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Conformidade",
            "text": "Tenha um processo regular para atualizar as imagens do nó do cluster periodicamente (semanalmente, por exemplo)"
        },
        {
            "category": "Operações",
            "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
            "severity": "Baixo",
            "subcategory": "Conformidade",
            "text": "Considere gitops para implantar aplicativos ou configuração de cluster em vários clusters"
        },
        {
            "category": "Operações",
            "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
            "link": "https://learn.microsoft.com/azure/aks/command-invoke",
            "severity": "Baixo",
            "subcategory": "Conformidade",
            "text": "Considere o uso de invocar o comando AKS em clusters privados"
        },
        {
            "category": "Operações",
            "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
            "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
            "security": 1,
            "severity": "Baixo",
            "subcategory": "Conformidade",
            "text": "Para eventos planejados, considere o uso do Nó Auto Drain"
        },
        {
            "category": "Operações",
            "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
            "link": "https://learn.microsoft.com/azure/aks/faq",
            "security": 1,
            "severity": "Alto",
            "subcategory": "Conformidade",
            "text": "Desenvolver práticas de governança próprias para garantir que nenhuma alteração seja executada pelos operadores no nó RG (também conhecido como 'infra RG')"
        },
        {
            "category": "Operações",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
            "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
            "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
            "severity": "Baixo",
            "simple": 1,
            "subcategory": "Conformidade",
            "text": "Use o nome personalizado do nó RG (também conhecido como 'Infra RG')"
        },
        {
            "category": "Operações",
            "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
            "ha": 1,
            "link": "https://kubernetes.io/docs/setup/release/notes/",
            "severity": "Média",
            "simple": -1,
            "subcategory": "Conformidade",
            "text": "Não use APIs do Kubernetes preteridas em seus manifestos YAML"
        },
        {
            "category": "Operações",
            "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
            "severity": "Baixo",
            "simple": -1,
            "subcategory": "Conformidade",
            "text": "Taint nós do Windows"
        },
        {
            "category": "Operações",
            "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
            "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
            "severity": "Baixo",
            "subcategory": "Conformidade",
            "text": "Mantenha o nível de patch dos contêineres do Windows em sincronia com o nível de patch do host"
        },
        {
            "category": "Operações",
            "cost": -1,
            "description": "Por meio das Configurações de Diagnóstico no nível do cluster",
            "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
            "severity": "Baixo",
            "subcategory": "Conformidade",
            "text": "Enviar logs mestres (também conhecidos como logs de API) para o Azure Monitor ou sua solução de gerenciamento de logs preferida"
        },
        {
            "category": "Operações",
            "cost": 1,
            "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
            "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
            "severity": "Baixo",
            "simple": -1,
            "subcategory": "Custar",
            "text": "Considere pools de nós spot para cargas de trabalho não sensíveis ao tempo"
        },
        {
            "category": "Operações",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
            "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
            "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
            "scale": 1,
            "severity": "Baixo",
            "simple": -1,
            "subcategory": "Custar",
            "text": "Considere o nó virtual AKS para intermitência rápida"
        },
        {
            "category": "Operações",
            "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Monitorização",
            "text": "Monitore suas métricas de cluster com o Container Insights (ou outras ferramentas, como o Prometheus)"
        },
        {
            "category": "Operações",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
            "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Monitorização",
            "text": "Armazene e analise seus logs de cluster com o Container Insights (ou outras ferramentas, como Telegraf/ElasticSearch)"
        },
        {
            "category": "Operações",
            "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
            "severity": "Média",
            "simple": -1,
            "subcategory": "Monitorização",
            "text": "Monitorar a utilização da CPU e da memória dos nós"
        },
        {
            "category": "Operações",
            "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
            "severity": "Média",
            "simple": -1,
            "subcategory": "Monitorização",
            "text": "Se estiver usando a CNI do Azure, monitore % de IPs de pod consumidos por nó"
        },
        {
            "category": "Operações",
            "description": "A E/S no disco do sistema operacional é um recurso crítico. Se o sistema operacional nos nós for limitado na E/S, isso pode levar a um comportamento imprevisível, normalmente terminando no nó sendo declarado NotReady",
            "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
            "severity": "Média",
            "simple": -1,
            "subcategory": "Monitorização",
            "text": "Monitorar a profundidade da fila de disco do sistema operacional nos nós"
        },
        {
            "category": "Operações",
            "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
            "severity": "Média",
            "simple": -1,
            "subcategory": "Monitorização",
            "text": "Se não estiver usando a filtragem de saída com AzFW/NVA, monitore as portas SNAT ALB alocadas padrão"
        },
        {
            "category": "Operações",
            "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
            "severity": "Média",
            "subcategory": "Monitorização",
            "text": "Inscrever-se em notificações de integridade de recursos para seu cluster AKS"
        },
        {
            "category": "Operações",
            "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Recursos",
            "text": "Configurar solicitações e limites em suas especificações de pod"
        },
        {
            "category": "Operações",
            "guid": "769ef669-1a48-435a-a942-223ece80b123",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
            "severity": "Média",
            "simple": -1,
            "subcategory": "Recursos",
            "text": "Impor cotas de recursos para namespaces"
        },
        {
            "category": "Operações",
            "cost": 1,
            "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
            "severity": "Alto",
            "subcategory": "Recursos",
            "text": "Verifique se sua assinatura tem cota suficiente para expandir seus nodepools"
        },
        {
            "category": "Operações",
            "cost": -1,
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
            "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
            "severity": "Média",
            "subcategory": "Escalabilidade",
            "text": "Usar o Cluster Autoscaler"
        },
        {
            "category": "Operações",
            "cost": -1,
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
            "guid": "831c2872-c693-4b39-a887-a561bada49bc",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
            "severity": "Baixo",
            "subcategory": "Escalabilidade",
            "text": "Personalizar a configuração do nó para pools de nós AKS"
        },
        {
            "category": "Operações",
            "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
            "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
            "scale": 1,
            "severity": "Média",
            "simple": -1,
            "subcategory": "Escalabilidade",
            "text": "Use o Horizontal Pod Autoscaler quando necessário"
        },
        {
            "category": "Operações",
            "cost": 1,
            "description": "Nós maiores trarão maior desempenho e recursos, como discos efêmeros e rede acelerada, mas aumentarão o raio de explosão e diminuirão a granularidade de dimensionamento",
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
            "severity": "Alto",
            "subcategory": "Escalabilidade",
            "text": "Considere um tamanho de nó apropriado, não muito grande ou muito pequeno"
        },
        {
            "category": "Operações",
            "cost": 1,
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
            "severity": "Baixo",
            "subcategory": "Escalabilidade",
            "text": "Se necessário para escalabilidade, considere adicionar mais de 5000 nós"
        },
        {
            "category": "Operações",
            "cost": 1,
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
            "severity": "Baixo",
            "subcategory": "Escalabilidade",
            "text": "Considere assinar o EventGrid Events para automação AKS"
        },
        {
            "category": "Operações",
            "cost": 1,
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
            "severity": "Baixo",
            "subcategory": "Escalabilidade",
            "text": "Para uma operação de longa duração em um cluster AKS, considere o encerramento do evento"
        },
        {
            "category": "Operações",
            "cost": 1,
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
            "severity": "Baixo",
            "subcategory": "Escalabilidade",
            "text": "Se necessário, considere o uso de Hosts Dedicados do Azure para nós AKS"
        },
        {
            "category": "Operações",
            "cost": -1,
            "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
            "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
            "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
            "scale": 1,
            "severity": "Alto",
            "subcategory": "Armazenamento",
            "text": "Usar discos efêmeros do sistema operacional"
        },
        {
            "category": "Operações",
            "cost": -1,
            "guid": "fc4972cc-3cd2-45bf-a707-6e9eab4bed32",
            "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
            "scale": 1,
            "severity": "Alto",
            "subcategory": "Armazenamento",
            "text": "Para discos não efêmeros, use IOPS altas e discos de sistema operacional maiores para os nós ao executar muitos pods/nós, pois requer alto desempenho para executar vários pods e gerará logs enormes com limites de rotação de log AKS padrão"
        },
        {
            "category": "Operações",
            "cost": -1,
            "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
            "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
            "scale": 1,
            "severity": "Baixo",
            "subcategory": "Armazenamento",
            "text": "Para a opção de armazenamento de hiperdesempenho, use Ultra Disks no AKS"
        },
        {
            "category": "Operações",
            "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
            "severity": "Média",
            "simple": -1,
            "subcategory": "Armazenamento",
            "text": "Evite manter o estado no cluster e armazene dados fora (AzStorage, AzSQL, Cosmos, etc.)"
        },
        {
            "category": "Operações",
            "cost": -1,
            "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
            "scale": 1,
            "severity": "Média",
            "subcategory": "Armazenamento",
            "text": "Se estiver usando o AzFiles Standard, considere o AzFiles Premium e/ou ANF por motivos de desempenho"
        },
        {
            "category": "Operações",
            "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
            "severity": "Média",
            "simple": -1,
            "subcategory": "Armazenamento",
            "text": "Se estiver usando Discos e AZs do Azure, considere ter pools de nós dentro de uma zona para disco LRS com VolumeBindingMode:WaitForFirstConsumer para provisionar armazenamento na zona direita ou use o disco ZRS para pools de nós que abrangem várias zonas"
        }
    ],
    "metadata": {
        "name": "Azure AKS Review"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Média"
        },
        {
            "name": "Baixo"
        }
    ],
    "status": [
        {
            "description": "Esta verificação ainda não foi analisada",
            "name": "Não verificado"
        },
        {
            "description": "Há um item de ação associado a essa verificação",
            "name": "Abrir"
        },
        {
            "description": "Essa verificação foi verificada e não há mais itens de ação associados a ela",
            "name": "Cumprido"
        },
        {
            "description": "Recomendação entendida, mas não necessária pelos requisitos atuais",
            "name": "Não é necessário"
        },
        {
            "description": "Não aplicável ao projeto atual",
            "name": "N/A"
        }
    ]
}
checklists/aks_checklist.ko.json METASEP
{
    "categories": [
        {
            "name": "ID 및 액세스 관리"
        },
        {
            "name": "네트워크 토폴로지 및 연결"
        },
        {
            "name": "BC 및 DR"
        },
        {
            "name": "거버넌스 및 보안"
        },
        {
            "name": "비용 거버넌스"
        },
        {
            "name": "작업"
        },
        {
            "name": "응용 프로그램 배포"
        }
    ],
    "items": [
        {
            "category": "응용 프로그램 배포",
            "cost": 1,
            "guid": "785c2fa5-5b56-4ad4-a408-fe72734c476b",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/containers/aks/secure-baseline-aks",
            "severity": "보통",
            "subcategory": "발달",
            "text": "카나리아 또는 블루/그린 배포 사용"
        },
        {
            "category": "응용 프로그램 배포",
            "cost": 1,
            "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
            "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
            "severity": "낮다",
            "subcategory": "발달",
            "text": "AKS Windows 워크로드에 필요한 경우 호스트 프로세스 컨테이너를 사용할 수 있습니다."
        },
        {
            "category": "응용 프로그램 배포",
            "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
            "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
            "scale": 1,
            "severity": "낮다",
            "simple": -1,
            "subcategory": "발달",
            "text": "이벤트 기반 워크로드를 실행하는 경우 KEDA 사용"
        },
        {
            "category": "응용 프로그램 배포",
            "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
            "link": "https://dapr.io/",
            "severity": "낮다",
            "simple": 1,
            "subcategory": "발달",
            "text": "Dapr을 사용하여 마이크로 서비스 개발 용이"
        },
        {
            "category": "응용 프로그램 배포",
            "guid": "3acbe04b-be20-49d3-afda-47778424d116",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/developer/terraform/create-k8s-cluster-with-tf-and-aks",
            "severity": "보통",
            "simple": -1,
            "subcategory": "코드형 인프라",
            "text": "ARM/TF를 통한 자동화를 사용하여 Azure 리소스 만들기"
        },
        {
            "category": "BC 및 DR",
            "guid": "36cb45e5-7960-4332-9bdf-8cc23318da61",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery",
            "severity": "높다",
            "subcategory": "재해 복구",
            "text": "정기적으로 DR 테스트 예약 및 수행"
        },
        {
            "category": "BC 및 DR",
            "guid": "170265f4-bb46-4a39-9af7-f317284797b1",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
            "severity": "보통",
            "subcategory": "고가용성",
            "text": "Azure 트래픽 관리자 또는 Azure Front Door를 지역 장애 조치(failover)를 위한 전역 부하 분산 장치로 사용"
        },
        {
            "category": "BC 및 DR",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant= isnotnull(zones) | distinct id,compliant",
            "guid": "578a219a-46be-4b54-9350-24922634292b",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/availability-zones",
            "severity": "보통",
            "subcategory": "고가용성",
            "text": "Azure 지역에서 지원되는 경우 가용성 영역 사용"
        },
        {
            "category": "BC 및 DR",
            "cost": -2,
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
            "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
            "ha": 2,
            "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
            "severity": "높다",
            "subcategory": "고가용성",
            "text": "SLA 지원 AKS 제품 사용"
        },
        {
            "category": "BC 및 DR",
            "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
            "severity": "낮다",
            "simple": -1,
            "subcategory": "고가용성",
            "text": "포드 및 배포 정의에서 중단 예산 사용"
        },
        {
            "category": "BC 및 DR",
            "cost": -1,
            "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
            "severity": "높다",
            "subcategory": "고가용성",
            "text": "개인 레지스트리를 사용하는 경우 여러 지역에 이미지를 저장하도록 지역 복제를 구성합니다."
        },
        {
            "category": "BC 및 DR",
            "guid": "bc14aea6-e65d-48d9-a3ad-c218e6436b06",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery",
            "severity": "높다",
            "subcategory": "요구 사항",
            "text": "SLA, RTO(복구 시간 목표) 및 RPO(복구 지점 목표)와 같은 비기능적 요구 사항을 정의합니다."
        },
        {
            "category": "비용 거버넌스",
            "cost": 1,
            "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
            "severity": "낮다",
            "subcategory": "비용",
            "text": "kubecost와 같은 외부 애플리케이션을 사용하여 다른 사용자에게 비용을 할당합니다."
        },
        {
            "category": "비용 거버넌스",
            "cost": 1,
            "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
            "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
            "severity": "낮다",
            "subcategory": "비용",
            "text": "필요한 경우 노드 풀 스냅샷 크기 조정"
        },
        {
            "category": "비용 거버넌스",
            "cost": 1,
            "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
            "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
            "severity": "낮다",
            "subcategory": "비용",
            "text": "축소 모드를 사용하여 노드 삭제/할당 취소"
        },
        {
            "category": "비용 거버넌스",
            "cost": 1,
            "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
            "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
            "severity": "보통",
            "subcategory": "비용",
            "text": "필요한 경우 AKS 클러스터에서 다중 인스턴스 분할 GPU 사용"
        },
        {
            "category": "비용 거버넌스",
            "cost": 1,
            "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
            "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
            "severity": "낮다",
            "subcategory": "비용",
            "text": "개발/테스트 클러스터를 실행하는 경우 노드 풀 시작/중지 사용"
        },
        {
            "category": "거버넌스 및 보안",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
            "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
            "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
            "security": 1,
            "severity": "보통",
            "simple": -1,
            "subcategory": "컴플라이언스",
            "text": "쿠버네티스용 Azure 정책을 사용하여 클러스터 규정 준수 보장"
        },
        {
            "category": "거버넌스 및 보안",
            "cost": -1,
            "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
            "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
            "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
            "security": 1,
            "severity": "보통",
            "simple": -1,
            "subcategory": "컴플라이언스",
            "text": "사용자/시스템 노드 풀이 있는 컨트롤 플레인에서 응용 프로그램 분리"
        },
        {
            "category": "거버넌스 및 보안",
            "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
            "severity": "낮다",
            "simple": -1,
            "subcategory": "컴플라이언스",
            "text": "시스템 노드 풀에 taint를 추가하여 전용으로 만들기"
        },
        {
            "category": "거버넌스 및 보안",
            "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
            "link": "https://learn.microsoft.com/azure/container-registry/",
            "security": 1,
            "severity": "보통",
            "simple": -1,
            "subcategory": "컴플라이언스",
            "text": "이미지에 ACR과 같은 개인 레지스트리 사용"
        },
        {
            "category": "거버넌스 및 보안",
            "cost": -1,
            "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
            "link": "https://learn.microsoft.com/azure/security-center/container-security",
            "security": 1,
            "severity": "보통",
            "subcategory": "컴플라이언스",
            "text": "이미지에서 취약성 검사"
        },
        {
            "category": "거버넌스 및 보안",
            "cost": -1,
            "guid": "cc639637-a652-42ac-89e8-06965388e9de",
            "link": "https://learn.microsoft.com/azure/security-center/container-security",
            "security": 1,
            "severity": "보통",
            "subcategory": "컴플라이언스",
            "text": "Azure 보안 센터를 사용하여 보안 상태 취약성 검색"
        },
        {
            "category": "거버넌스 및 보안",
            "cost": -1,
            "guid": "42d4aefe-2383-470e-b019-c30df24996b2",
            "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-fips-enabled-node-pool",
            "security": 1,
            "severity": "낮다",
            "subcategory": "컴플라이언스",
            "text": "필요한 경우 FIPS 구성"
        },
        {
            "category": "거버넌스 및 보안",
            "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
            "security": 1,
            "severity": "높다",
            "subcategory": "컴플라이언스",
            "text": "앱 분리 요구 사항 정의(네임스페이스/노드 풀/클러스터)"
        },
        {
            "category": "거버넌스 및 보안",
            "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
            "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
            "security": 1,
            "severity": "보통",
            "simple": -1,
            "subcategory": "비밀",
            "text": "CSI 비밀 저장소 드라이버를 사용하여 Azure 키 자격 증명 모음에 비밀 저장"
        },
        {
            "category": "거버넌스 및 보안",
            "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
            "link": "https://learn.microsoft.com/azure/aks/update-credentials",
            "security": 1,
            "severity": "높다",
            "subcategory": "비밀",
            "text": "클러스터에 서비스 주체를 사용하는 경우 자격 증명을 주기적으로(예: 분기별) 새로 고칩니다."
        },
        {
            "category": "거버넌스 및 보안",
            "cost": -1,
            "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
            "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
            "security": 1,
            "severity": "보통",
            "subcategory": "비밀",
            "text": "필요한 경우 키 관리 서비스 etcd 암호화 추가"
        },
        {
            "category": "거버넌스 및 보안",
            "cost": -1,
            "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
            "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
            "security": 1,
            "severity": "낮다",
            "subcategory": "비밀",
            "text": "필요한 경우 AKS에 기밀 컴퓨팅을 사용하는 것이 좋습니다."
        },
        {
            "category": "거버넌스 및 보안",
            "cost": -1,
            "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
            "security": 1,
            "severity": "보통",
            "subcategory": "비밀",
            "text": "컨테이너용 Defender 사용 고려"
        },
        {
            "category": "ID 및 액세스 관리",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
            "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
            "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
            "severity": "높다",
            "simple": 1,
            "subcategory": "신원",
            "text": "서비스 주체 대신 관리 ID 사용"
        },
        {
            "category": "ID 및 액세스 관리",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
            "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad",
            "severity": "보통",
            "simple": 1,
            "subcategory": "신원",
            "text": "AAD와 인증 통합(관리되는 통합 사용)"
        },
        {
            "category": "ID 및 액세스 관리",
            "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
            "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
            "security": 1,
            "severity": "보통",
            "simple": -1,
            "subcategory": "신원",
            "text": "관리자 kubeconfig에 대한 액세스 제한 (자격 증명 가져 오기 --admin)"
        },
        {
            "category": "ID 및 액세스 관리",
            "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
            "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
            "security": 1,
            "severity": "보통",
            "simple": -1,
            "subcategory": "신원",
            "text": "AAD RBAC와 권한 부여 통합"
        },
        {
            "category": "ID 및 액세스 관리",
            "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
            "security": 1,
            "severity": "높다",
            "simple": -1,
            "subcategory": "신원",
            "text": "네임스페이스를 사용하여 쿠버네티스에서 RBAC 권한 제한"
        },
        {
            "category": "ID 및 액세스 관리",
            "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
            "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
            "security": 1,
            "severity": "보통",
            "simple": -1,
            "subcategory": "신원",
            "text": "POD ID 액세스 관리의 경우 Azure AD 워크로드 ID(미리 보기)를 사용합니다."
        },
        {
            "category": "ID 및 액세스 관리",
            "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
            "security": 1,
            "severity": "보통",
            "simple": -1,
            "subcategory": "신원",
            "text": "AKS 비대화형 로그인의 경우 kubelogin(미리 보기)을 사용합니다."
        },
        {
            "category": "ID 및 액세스 관리",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
            "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
            "security": 1,
            "severity": "보통",
            "simple": -1,
            "subcategory": "신원",
            "text": "AKS 로컬 계정 사용 안 함"
        },
        {
            "category": "ID 및 액세스 관리",
            "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
            "security": 1,
            "severity": "낮다",
            "simple": -1,
            "subcategory": "신원",
            "text": "필요한 경우 Just-In-Time 클러스터 액세스 구성"
        },
        {
            "category": "ID 및 액세스 관리",
            "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
            "security": 1,
            "severity": "낮다",
            "simple": -1,
            "subcategory": "신원",
            "text": "AKS에 대한 AAD 조건부 액세스가 필요한 경우 구성"
        },
        {
            "category": "ID 및 액세스 관리",
            "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
            "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
            "security": 1,
            "severity": "낮다",
            "simple": -1,
            "subcategory": "신원",
            "text": "윈도우 AKS 워크로드에 필요한 경우 gMSA를 구성합니다. "
        },
        {
            "category": "ID 및 액세스 관리",
            "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
            "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
            "security": 1,
            "severity": "보통",
            "simple": -1,
            "subcategory": "신원",
            "text": "더 세밀하게 제어하려면 관리되는 Kubelet ID를 사용하는 것이 좋습니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
            "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
            "security": 1,
            "severity": "보통",
            "simple": -1,
            "subcategory": "권장사항",
            "text": "AGIC를 사용하는 경우 클러스터 간에 AppGW를 공유하지 마세요."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
            "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
            "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
            "scale": 1,
            "severity": "높다",
            "simple": -1,
            "subcategory": "권장사항",
            "text": "AKS 애플리케이션 라우팅 추가 기능을 사용하지 마세요."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
            "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
            "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
            "scale": 1,
            "severity": "보통",
            "simple": -1,
            "subcategory": "권장사항",
            "text": "Windows 워크로드의 경우 가속화된 네트워킹 사용"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
            "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
            "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
            "scale": 1,
            "severity": "높다",
            "subcategory": "권장사항",
            "text": "표준 ALB 사용(기본 ALB와 반대)"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
            "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
            "security": 1,
            "severity": "보통",
            "simple": -2,
            "subcategory": "권장사항",
            "text": "Azure CNI를 사용하는 경우 노드 풀에 대해 다른 서브넷을 사용하는 것이 좋습니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
            "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
            "security": 1,
            "severity": "보통",
            "simple": -1,
            "subcategory": "비용",
            "text": "프라이빗 엔드포인트(기본 설정) 또는 가상 네트워크 서비스 엔드포인트를 사용하여 클러스터에서 PaaS 서비스에 액세스"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "cost": -1,
            "guid": "e8a03f97-8794-468d-96a7-86d60f96c97b",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
            "severity": "보통",
            "subcategory": "하",
            "text": "하이브리드 연결이 필요한 경우 가용성 향상을 위해 2xER 또는 ER+VPN을 사용합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
            "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
            "severity": "높다",
            "simple": 1,
            "subcategory": "아이팜",
            "text": "요구 사항에 가장 적합한 CNI 네트워크 플러그 인을 선택합니다(Azure CNI 권장)."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
            "scale": 1,
            "severity": "높다",
            "subcategory": "아이팜",
            "text": "Azure CNI를 사용하는 경우 노드당 최대 Pod 수를 고려하여 서브넷 크기를 적절하게 조정합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
            "scale": 1,
            "severity": "높다",
            "simple": -1,
            "subcategory": "아이팜",
            "text": "Azure CNI를 사용하는 경우 최대 Pod/노드(기본값 30)를 확인합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "description": "내부 앱의 경우 조직은 방화벽에서 전체 AKS 서브넷을 여는 경우가 많습니다. 이렇게 하면 노드에 대한 네트워크 액세스도 열리고 잠재적으로 Pod에 대한 네트워크 액세스도 열립니다(Azure CNI를 사용하는 경우). LoadBalancer IP가 다른 서브넷에 있는 경우 앱 클라이언트에서 이 IP만 사용할 수 있어야 합니다. 또 다른 이유는 AKS 서브넷의 IP 주소가 부족한 리소스인 경우 서비스에 해당 IP 주소를 사용하면 클러스터의 최대 확장성이 감소하기 때문입니다.",
            "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
            "link": "https://learn.microsoft.com/azure/aks/internal-lb",
            "security": 1,
            "severity": "낮다",
            "simple": -1,
            "subcategory": "아이팜",
            "text": "개인 IP 부하 분산 장치 서비스를 사용하는 경우 전용 서브넷(AKS 서브넷 아님)을 사용합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
            "scale": 1,
            "severity": "높다",
            "subcategory": "아이팜",
            "text": "그에 따라 서비스 IP 주소 범위의 크기를 조정합니다(클러스터 확장성 제한)."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
            "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
            "security": 1,
            "severity": "낮다",
            "simple": -2,
            "subcategory": "작업",
            "text": "필요한 경우 자신의 CNI 플러그인을 추가하십시오."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
            "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
            "security": 1,
            "severity": "낮다",
            "simple": -2,
            "subcategory": "작업",
            "text": "필요한 경우 AKS에서 노드당 공용 IP 구성"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
            "link": "https://learn.microsoft.com/azure/aks/concepts-network",
            "scale": 1,
            "severity": "보통",
            "simple": -1,
            "subcategory": "확장성",
            "text": "수신 컨트롤러를 사용하여 LoadBalancer 유형 서비스로 노출하는 대신 웹 기반 앱을 노출합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
            "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
            "scale": 1,
            "severity": "낮다",
            "simple": -1,
            "subcategory": "확장성",
            "text": "Azue NAT 게이트웨이를 아웃바운드 유형으로 사용하여 송신 트래픽 크기 조정"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
            "scale": 1,
            "severity": "보통",
            "simple": -1,
            "subcategory": "확장성",
            "text": "Azure CNI IP 소모를 방지하기 위해 IP의 동적 할당 사용"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
            "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
            "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
            "security": 2,
            "severity": "높다",
            "simple": -2,
            "subcategory": "안전",
            "text": "보안 요구 사항에 따라 필요한 경우 AzFW/NVA를 사용하여 송신 트래픽 필터링"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
            "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
            "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
            "security": 1,
            "severity": "보통",
            "simple": -1,
            "subcategory": "안전",
            "text": "퍼블릭 API 엔드포인트를 사용하는 경우 액세스할 수 있는 IP 주소를 제한합니다."
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
            "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
            "link": "https://learn.microsoft.com/azure/aks/private-clusters",
            "security": 1,
            "severity": "높다",
            "simple": -1,
            "subcategory": "안전",
            "text": "요구 사항에서 요구하는 경우 프라이빗 클러스터 사용"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
            "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
            "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
            "security": 1,
            "severity": "보통",
            "simple": -1,
            "subcategory": "안전",
            "text": "Windows 2019 및 2022 AKS 노드의 경우 옥양목 네트워크 정책을 사용할 수 있습니다. "
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
            "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
            "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
            "security": 1,
            "severity": "높다",
            "subcategory": "안전",
            "text": "쿠버네티스 네트워크 정책 옵션 사용(Calico/Azure)"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
            "security": 1,
            "severity": "높다",
            "simple": -1,
            "subcategory": "안전",
            "text": "쿠버네티스 네트워크 정책을 사용하여 클러스터 내 보안 강화"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "cost": -1,
            "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
            "security": 2,
            "severity": "높다",
            "simple": -1,
            "subcategory": "안전",
            "text": "웹 워크로드(UI 또는 API)에 WAF 사용"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "cost": -2,
            "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
            "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
            "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
            "security": 2,
            "severity": "보통",
            "subcategory": "안전",
            "text": "AKS 가상 네트워크에서 DDoS 표준 사용"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "cost": -2,
            "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
            "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
            "link": "https://learn.microsoft.com/azure/aks/http-proxy",
            "security": 2,
            "severity": "낮다",
            "subcategory": "안전",
            "text": "필요한 경우 회사 HTTP 프록시 추가"
        },
        {
            "category": "네트워크 토폴로지 및 연결",
            "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
            "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
            "security": 1,
            "severity": "보통",
            "simple": -2,
            "subcategory": "안전",
            "text": "고급 마이크로 서비스 통신 관리를 위해 서비스 메시 사용 고려"
        },
        {
            "category": "작업",
            "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
            "severity": "높다",
            "simple": -1,
            "subcategory": "경고",
            "text": "가장 중요한 메트릭에 대한 경고 구성(권장 사항은 컨테이너 인사이트 참조)"
        },
        {
            "category": "작업",
            "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
            "severity": "낮다",
            "simple": -1,
            "subcategory": "컴플라이언스",
            "text": "Azure 어드바이저에서 클러스터에 대한 권장 사항을 정기적으로 확인하세요."
        },
        {
            "category": "작업",
            "guid": "5388e9de-d167-4dd1-a2b0-ac241b999a64",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
            "severity": "낮다",
            "simple": 1,
            "subcategory": "컴플라이언스",
            "text": "vscode+kubeadvisor와 같은 지능형 텍스트 편집기로 YAML 매니페스트를 개발하세요."
        },
        {
            "category": "작업",
            "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
            "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
            "severity": "낮다",
            "simple": 1,
            "subcategory": "컴플라이언스",
            "text": "AKS 자동 인증서 회전 사용"
        },
        {
            "category": "작업",
            "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
            "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
            "security": 1,
            "severity": "높다",
            "simple": -1,
            "subcategory": "컴플라이언스",
            "text": "kubernetes 버전을 주기적으로(예: 분기별로) 업그레이드하거나 AKS 자동 업그레이드 기능을 사용하는 정기적인 프로세스가 있습니다."
        },
        {
            "category": "작업",
            "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
            "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
            "severity": "높다",
            "simple": -1,
            "subcategory": "컴플라이언스",
            "text": "노드 이미지 업그레이드를 사용하지 않는 경우 Linux 노드 업그레이드에 kured 사용"
        },
        {
            "category": "작업",
            "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
            "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
            "security": 1,
            "severity": "높다",
            "simple": -1,
            "subcategory": "컴플라이언스",
            "text": "클러스터 노드 이미지를 정기적으로(예: 매주) 업그레이드하는 정기적인 프로세스가 있어야 합니다."
        },
        {
            "category": "작업",
            "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
            "severity": "낮다",
            "subcategory": "컴플라이언스",
            "text": "응용 프로그램 또는 클러스터 구성을 여러 클러스터에 배포하기 위해 gitops 고려"
        },
        {
            "category": "작업",
            "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
            "link": "https://learn.microsoft.com/azure/aks/command-invoke",
            "severity": "낮다",
            "subcategory": "컴플라이언스",
            "text": "프라이빗 클러스터에서 AKS 명령 호출 사용을 고려하세요."
        },
        {
            "category": "작업",
            "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
            "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
            "security": 1,
            "severity": "낮다",
            "subcategory": "컴플라이언스",
            "text": "계획된 이벤트의 경우 노드 자동 드레이닝 사용을 고려하십시오."
        },
        {
            "category": "작업",
            "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
            "link": "https://learn.microsoft.com/azure/aks/faq",
            "security": 1,
            "severity": "높다",
            "subcategory": "컴플라이언스",
            "text": "노드 RG(일명 '인프라 RG')의 운영자가 변경하지 않도록 자체 관리 관행을 개발합니다."
        },
        {
            "category": "작업",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
            "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
            "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
            "severity": "낮다",
            "simple": 1,
            "subcategory": "컴플라이언스",
            "text": "사용자 지정 노드 RG(일명 '인프라 RG') 이름 사용"
        },
        {
            "category": "작업",
            "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
            "ha": 1,
            "link": "https://kubernetes.io/docs/setup/release/notes/",
            "severity": "보통",
            "simple": -1,
            "subcategory": "컴플라이언스",
            "text": "YAML 매니페스트에서 더 이상 사용되지 않는 쿠버네티스 API를 사용하지 마세요."
        },
        {
            "category": "작업",
            "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
            "severity": "낮다",
            "simple": -1,
            "subcategory": "컴플라이언스",
            "text": "윈도우 노드 오염"
        },
        {
            "category": "작업",
            "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
            "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
            "severity": "낮다",
            "subcategory": "컴플라이언스",
            "text": "Windows 컨테이너 패치 수준을 호스트 패치 수준과 동기화된 상태로 유지"
        },
        {
            "category": "작업",
            "cost": -1,
            "description": "클러스터 수준에서 진단 설정을 통해",
            "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
            "severity": "낮다",
            "subcategory": "컴플라이언스",
            "text": "마스터 로그(API 로그라고도 함)를 Azure 모니터 또는 기본 설정 로그 관리 솔루션으로 보냅니다."
        },
        {
            "category": "작업",
            "cost": 1,
            "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
            "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
            "severity": "낮다",
            "simple": -1,
            "subcategory": "비용",
            "text": "시간에 민감하지 않은 워크로드에 대한 스폿 노드 풀 고려"
        },
        {
            "category": "작업",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
            "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
            "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
            "scale": 1,
            "severity": "낮다",
            "simple": -1,
            "subcategory": "비용",
            "text": "빠른 버스팅을 위해 AKS 가상 노드 고려"
        },
        {
            "category": "작업",
            "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
            "severity": "높다",
            "simple": -1,
            "subcategory": "모니터링",
            "text": "컨테이너 인사이트(또는 Prometheus와 같은 다른 도구)를 사용하여 클러스터 메트릭 모니터링"
        },
        {
            "category": "작업",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
            "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
            "severity": "높다",
            "simple": -1,
            "subcategory": "모니터링",
            "text": "컨테이너 인사이트(또는 Telegraf/ElasticSearch와 같은 다른 도구)를 사용하여 클러스터 로그를 저장하고 분석합니다."
        },
        {
            "category": "작업",
            "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
            "severity": "보통",
            "simple": -1,
            "subcategory": "모니터링",
            "text": "노드의 CPU 및 메모리 사용률 모니터링"
        },
        {
            "category": "작업",
            "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
            "severity": "보통",
            "simple": -1,
            "subcategory": "모니터링",
            "text": "Azure CNI를 사용하는 경우 노드당 사용된 Pod IP의 %를 모니터링합니다."
        },
        {
            "category": "작업",
            "description": "OS 디스크의 I/O는 중요한 리소스입니다. 노드의 OS가 I/O에서 제한되면 예기치 않은 동작이 발생할 수 있으며 일반적으로 노드가 NotReady로 선언됩니다.",
            "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
            "severity": "보통",
            "simple": -1,
            "subcategory": "모니터링",
            "text": "노드의 OS 디스크 큐 깊이 모니터링"
        },
        {
            "category": "작업",
            "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
            "severity": "보통",
            "simple": -1,
            "subcategory": "모니터링",
            "text": "AzFW/NVA에서 송신 필터링을 사용하지 않는 경우 표준 ALB 할당 SNAT 포트를 모니터링합니다."
        },
        {
            "category": "작업",
            "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
            "severity": "보통",
            "subcategory": "모니터링",
            "text": "AKS 클러스터에 대한 리소스 상태 알림 구독"
        },
        {
            "category": "작업",
            "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
            "severity": "높다",
            "simple": -1,
            "subcategory": "리소스",
            "text": "포드 사양에서 요청 및 제한 구성"
        },
        {
            "category": "작업",
            "guid": "769ef669-1a48-435a-a942-223ece80b123",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
            "severity": "보통",
            "simple": -1,
            "subcategory": "리소스",
            "text": "네임스페이스에 대한 리소스 할당량 적용"
        },
        {
            "category": "작업",
            "cost": 1,
            "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
            "severity": "높다",
            "subcategory": "리소스",
            "text": "구독에 노드 풀을 확장하기에 충분한 할당량이 있는지 확인"
        },
        {
            "category": "작업",
            "cost": -1,
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
            "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
            "severity": "보통",
            "subcategory": "확장성",
            "text": "클러스터 자동 크기 조정기 사용"
        },
        {
            "category": "작업",
            "cost": -1,
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
            "guid": "831c2872-c693-4b39-a887-a561bada49bc",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
            "severity": "낮다",
            "subcategory": "확장성",
            "text": "AKS 노드 풀에 대한 노드 구성 사용자 지정"
        },
        {
            "category": "작업",
            "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
            "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
            "scale": 1,
            "severity": "보통",
            "simple": -1,
            "subcategory": "확장성",
            "text": "필요한 경우 수평 포드 자동 크기 조정기 사용"
        },
        {
            "category": "작업",
            "cost": 1,
            "description": "노드가 클수록 휘발성 디스크 및 가속화된 네트워킹과 같은 더 높은 성능과 기능을 제공하지만 폭발 반경이 증가하고 크기 조정 세분성이 감소합니다.",
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
            "severity": "높다",
            "subcategory": "확장성",
            "text": "너무 크거나 작지 않은 적절한 노드 크기를 고려하십시오."
        },
        {
            "category": "작업",
            "cost": 1,
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
            "severity": "낮다",
            "subcategory": "확장성",
            "text": "확장성에 필요한 경우 5000개 이상의 노드를 추가하는 것이 좋습니다."
        },
        {
            "category": "작업",
            "cost": 1,
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
            "severity": "낮다",
            "subcategory": "확장성",
            "text": "AKS 자동화를 위한 이벤트 그리드 이벤트를 구독하는 것이 좋습니다."
        },
        {
            "category": "작업",
            "cost": 1,
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
            "severity": "낮다",
            "subcategory": "확장성",
            "text": "AKS 클러스터에서 장기 실행 작업의 경우 이벤트 종료를 고려합니다."
        },
        {
            "category": "작업",
            "cost": 1,
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
            "severity": "낮다",
            "subcategory": "확장성",
            "text": "필요한 경우 AKS 노드에 대한 Azure 전용 호스트를 사용하는 것이 좋습니다."
        },
        {
            "category": "작업",
            "cost": -1,
            "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
            "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
            "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
            "scale": 1,
            "severity": "높다",
            "subcategory": "보관",
            "text": "임시 OS 디스크 사용"
        },
        {
            "category": "작업",
            "cost": -1,
            "guid": "fc4972cc-3cd2-45bf-a707-6e9eab4bed32",
            "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
            "scale": 1,
            "severity": "높다",
            "subcategory": "보관",
            "text": "임시 디스크가 아닌 디스크의 경우 여러 Pod를 실행하는 데 고성능이 필요하고 기본 AKS 로그 회전 임계값을 사용하여 엄청난 로그를 생성하므로 많은 Pod/노드를 실행할 때 노드에 대해 높은 IOPS 및 더 큰 OS 디스크를 사용합니다."
        },
        {
            "category": "작업",
            "cost": -1,
            "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
            "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
            "scale": 1,
            "severity": "낮다",
            "subcategory": "보관",
            "text": "고성능 스토리지 옵션의 경우 AKS에서 울트라 디스크 사용"
        },
        {
            "category": "작업",
            "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
            "severity": "보통",
            "simple": -1,
            "subcategory": "보관",
            "text": "클러스터에 상태를 유지하지 말고 외부에 데이터를 저장합니다 (AzStorage, AzSQL, Cosmos 등)."
        },
        {
            "category": "작업",
            "cost": -1,
            "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
            "scale": 1,
            "severity": "보통",
            "subcategory": "보관",
            "text": "AzFiles 표준을 사용하는 경우 성능상의 이유로 AzFiles Premium 및/또는 ANF를 고려하십시오."
        },
        {
            "category": "작업",
            "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
            "severity": "보통",
            "simple": -1,
            "subcategory": "보관",
            "text": "Azure 디스크 및 AZ를 사용하는 경우 올바른 영역에 스토리지를 프로비전하기 위해 볼륨 바인딩 모드:WaitForFirstConsumer를 사용하여 LRS 디스크의 영역 내에 노드 풀을 사용하거나 여러 영역에 걸쳐 있는 노드 풀에 ZRS 디스크를 사용하는 것이 좋습니다."
        }
    ],
    "metadata": {
        "name": "Azure AKS Review"
    },
    "severities": [
        {
            "name": "높다"
        },
        {
            "name": "보통"
        },
        {
            "name": "낮다"
        }
    ],
    "status": [
        {
            "description": "이 검사는 아직 검토되지 않았습니다.",
            "name": "확인되지 않음"
        },
        {
            "description": "이 검사와 연결된 작업 항목이 있습니다.",
            "name": "열다"
        },
        {
            "description": "이 검사가 확인되었으며 연결된 추가 작업 항목이 없습니다.",
            "name": "성취"
        },
        {
            "description": "권장 사항을 이해했지만 현재 요구 사항에서 필요하지 않음",
            "name": "필요하지 않음"
        },
        {
            "description": "현재 디자인에는 적용되지 않음",
            "name": "해당 없음"
        }
    ]
}
checklists/aks_checklist.ja.json METASEP
{
    "categories": [
        {
            "name": "ID およびアクセス管理"
        },
        {
            "name": "ネットワーク トポロジと接続性"
        },
        {
            "name": "BC および DR"
        },
        {
            "name": "ガバナンスとセキュリティ"
        },
        {
            "name": "コストガバナンス"
        },
        {
            "name": "オペレーションズ"
        },
        {
            "name": "アプリケーションの展開"
        }
    ],
    "items": [
        {
            "category": "アプリケーションの展開",
            "cost": 1,
            "guid": "785c2fa5-5b56-4ad4-a408-fe72734c476b",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/containers/aks/secure-baseline-aks",
            "severity": "中程度",
            "subcategory": "発達",
            "text": "カナリアまたはブルー/グリーンのデプロイを使用する"
        },
        {
            "category": "アプリケーションの展開",
            "cost": 1,
            "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
            "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
            "severity": "低い",
            "subcategory": "発達",
            "text": "AKS Windows ワークロードに必要な場合は、ホスト プロセス コンテナーを使用できます。"
        },
        {
            "category": "アプリケーションの展開",
            "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
            "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
            "scale": 1,
            "severity": "低い",
            "simple": -1,
            "subcategory": "発達",
            "text": "イベント駆動型ワークロードを実行している場合は KEDA を使用する"
        },
        {
            "category": "アプリケーションの展開",
            "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
            "link": "https://dapr.io/",
            "severity": "低い",
            "simple": 1,
            "subcategory": "発達",
            "text": "Dapr を使用してマイクロサービス開発を容易にする"
        },
        {
            "category": "アプリケーションの展開",
            "guid": "3acbe04b-be20-49d3-afda-47778424d116",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/developer/terraform/create-k8s-cluster-with-tf-and-aks",
            "severity": "中程度",
            "simple": -1,
            "subcategory": "コードとしてのインフラストラクチャ",
            "text": "ARM/TF による自動化を使用して Azure リソースを作成する"
        },
        {
            "category": "BC および DR",
            "guid": "36cb45e5-7960-4332-9bdf-8cc23318da61",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery",
            "severity": "高い",
            "subcategory": "災害復旧",
            "text": "DRテストを定期的にスケジュールして実行する"
        },
        {
            "category": "BC および DR",
            "guid": "170265f4-bb46-4a39-9af7-f317284797b1",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
            "severity": "中程度",
            "subcategory": "高可用性",
            "text": "Azure Traffic Manager または Azure Front Door をリージョン フェールオーバーのグローバル ロード バランサーとして使用する"
        },
        {
            "category": "BC および DR",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant= isnotnull(zones) | distinct id,compliant",
            "guid": "578a219a-46be-4b54-9350-24922634292b",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/availability-zones",
            "severity": "中程度",
            "subcategory": "高可用性",
            "text": "可用性ゾーンが Azure リージョンでサポートされている場合は、その可用性ゾーンを使用する"
        },
        {
            "category": "BC および DR",
            "cost": -2,
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
            "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
            "ha": 2,
            "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
            "severity": "高い",
            "subcategory": "高可用性",
            "text": "SLA でサポートされる AKS オファリングを使用する"
        },
        {
            "category": "BC および DR",
            "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
            "severity": "低い",
            "simple": -1,
            "subcategory": "高可用性",
            "text": "ポッドとデプロイ定義で中断バジェットを使用する"
        },
        {
            "category": "BC および DR",
            "cost": -1,
            "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
            "severity": "高い",
            "subcategory": "高可用性",
            "text": "プライベートレジストリを使用する場合は、複数のリージョンにイメージを格納するようにリージョンレプリケーションを構成します"
        },
        {
            "category": "BC および DR",
            "guid": "bc14aea6-e65d-48d9-a3ad-c218e6436b06",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery",
            "severity": "高い",
            "subcategory": "必要条件",
            "text": "SLA、RTO(目標復旧時間)、RPO(目標復旧時点)などの非機能要件を定義します。"
        },
        {
            "category": "コストガバナンス",
            "cost": 1,
            "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
            "severity": "低い",
            "subcategory": "費用",
            "text": "kubecost などの外部アプリケーションを使用して、さまざまなユーザーにコストを割り当てる"
        },
        {
            "category": "コストガバナンス",
            "cost": 1,
            "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
            "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
            "severity": "低い",
            "subcategory": "費用",
            "text": "必要に応じて、ノードプールスナップショットをスケーリングします"
        },
        {
            "category": "コストガバナンス",
            "cost": 1,
            "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
            "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
            "severity": "低い",
            "subcategory": "費用",
            "text": "スケールダウンモードを使用してノードを削除/割り当て解除する"
        },
        {
            "category": "コストガバナンス",
            "cost": 1,
            "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
            "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
            "severity": "中程度",
            "subcategory": "費用",
            "text": "必要に応じて、AKS クラスターでマルチインスタンス分割 GPU を使用する"
        },
        {
            "category": "コストガバナンス",
            "cost": 1,
            "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
            "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
            "severity": "低い",
            "subcategory": "費用",
            "text": "開発/テスト クラスターを実行している場合は、ノードプールの開始/停止を使用します"
        },
        {
            "category": "ガバナンスとセキュリティ",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
            "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
            "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
            "security": 1,
            "severity": "中程度",
            "simple": -1,
            "subcategory": "コンプライアンス",
            "text": "Azure Policy for Kubernetes を使用してクラスターのコンプライアンスを確保する"
        },
        {
            "category": "ガバナンスとセキュリティ",
            "cost": -1,
            "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
            "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
            "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
            "security": 1,
            "severity": "中程度",
            "simple": -1,
            "subcategory": "コンプライアンス",
            "text": "ユーザー/システムノードプールによるコントロールプレーンからのアプリケーションの分離"
        },
        {
            "category": "ガバナンスとセキュリティ",
            "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
            "severity": "低い",
            "simple": -1,
            "subcategory": "コンプライアンス",
            "text": "システムノードプールにtaintを追加して専用にする"
        },
        {
            "category": "ガバナンスとセキュリティ",
            "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
            "link": "https://learn.microsoft.com/azure/container-registry/",
            "security": 1,
            "severity": "中程度",
            "simple": -1,
            "subcategory": "コンプライアンス",
            "text": "イメージにプライベート レジストリ (ACR など) を使用する"
        },
        {
            "category": "ガバナンスとセキュリティ",
            "cost": -1,
            "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
            "link": "https://learn.microsoft.com/azure/security-center/container-security",
            "security": 1,
            "severity": "中程度",
            "subcategory": "コンプライアンス",
            "text": "イメージの脆弱性をスキャンする"
        },
        {
            "category": "ガバナンスとセキュリティ",
            "cost": -1,
            "guid": "cc639637-a652-42ac-89e8-06965388e9de",
            "link": "https://learn.microsoft.com/azure/security-center/container-security",
            "security": 1,
            "severity": "中程度",
            "subcategory": "コンプライアンス",
            "text": "Azure セキュリティ センターを使用してセキュリティ体制の脆弱性を検出する"
        },
        {
            "category": "ガバナンスとセキュリティ",
            "cost": -1,
            "guid": "42d4aefe-2383-470e-b019-c30df24996b2",
            "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-fips-enabled-node-pool",
            "security": 1,
            "severity": "低い",
            "subcategory": "コンプライアンス",
            "text": "必要に応じて FIPS を設定する"
        },
        {
            "category": "ガバナンスとセキュリティ",
            "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
            "security": 1,
            "severity": "高い",
            "subcategory": "コンプライアンス",
            "text": "アプリの分離要件 (名前空間/ノードプール/クラスター) を定義する"
        },
        {
            "category": "ガバナンスとセキュリティ",
            "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
            "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
            "security": 1,
            "severity": "中程度",
            "simple": -1,
            "subcategory": "秘密",
            "text": "CSI シークレット ストア ドライバーを使用して Azure Key Vault にシークレットを格納する"
        },
        {
            "category": "ガバナンスとセキュリティ",
            "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
            "link": "https://learn.microsoft.com/azure/aks/update-credentials",
            "security": 1,
            "severity": "高い",
            "subcategory": "秘密",
            "text": "クラスターにサービス プリンシパルを使用する場合は、資格情報を定期的に更新します (四半期ごとなど)。"
        },
        {
            "category": "ガバナンスとセキュリティ",
            "cost": -1,
            "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
            "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
            "security": 1,
            "severity": "中程度",
            "subcategory": "秘密",
            "text": "必要に応じて、キー管理サービス etcd 暗号化を追加します。"
        },
        {
            "category": "ガバナンスとセキュリティ",
            "cost": -1,
            "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
            "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
            "security": 1,
            "severity": "低い",
            "subcategory": "秘密",
            "text": "必要に応じて、AKS のコンフィデンシャル コンピューティングの使用を検討する"
        },
        {
            "category": "ガバナンスとセキュリティ",
            "cost": -1,
            "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
            "security": 1,
            "severity": "中程度",
            "subcategory": "秘密",
            "text": "コンテナーに Defender を使用することを検討してください"
        },
        {
            "category": "ID およびアクセス管理",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
            "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
            "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
            "severity": "高い",
            "simple": 1,
            "subcategory": "同一性",
            "text": "サービス プリンシパルの代わりにマネージド ID を使用する"
        },
        {
            "category": "ID およびアクセス管理",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
            "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad",
            "severity": "中程度",
            "simple": 1,
            "subcategory": "同一性",
            "text": "認証を AAD と統合する (マネージド統合を使用)"
        },
        {
            "category": "ID およびアクセス管理",
            "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
            "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
            "security": 1,
            "severity": "中程度",
            "simple": -1,
            "subcategory": "同一性",
            "text": "管理者 kubeconfig (資格情報の取得 --admin) へのアクセスを制限する"
        },
        {
            "category": "ID およびアクセス管理",
            "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
            "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
            "security": 1,
            "severity": "中程度",
            "simple": -1,
            "subcategory": "同一性",
            "text": "承認を AAD RBAC と統合する"
        },
        {
            "category": "ID およびアクセス管理",
            "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
            "security": 1,
            "severity": "高い",
            "simple": -1,
            "subcategory": "同一性",
            "text": "Kubernetes で RBAC 特権を制限するために名前空間を使用する"
        },
        {
            "category": "ID およびアクセス管理",
            "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
            "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
            "security": 1,
            "severity": "中程度",
            "simple": -1,
            "subcategory": "同一性",
            "text": "POD ID アクセス管理の場合は、Azure AD ワークロード ID (プレビュー) を使用します。"
        },
        {
            "category": "ID およびアクセス管理",
            "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
            "security": 1,
            "severity": "中程度",
            "simple": -1,
            "subcategory": "同一性",
            "text": "AKS の非対話型ログインの場合は、kubelogin (プレビュー) を使用します。"
        },
        {
            "category": "ID およびアクセス管理",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
            "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
            "security": 1,
            "severity": "中程度",
            "simple": -1,
            "subcategory": "同一性",
            "text": "AKS ローカル アカウントを無効にする"
        },
        {
            "category": "ID およびアクセス管理",
            "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
            "security": 1,
            "severity": "低い",
            "simple": -1,
            "subcategory": "同一性",
            "text": "必要に応じて構成する ジャストインタイムクラスターアクセス"
        },
        {
            "category": "ID およびアクセス管理",
            "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
            "security": 1,
            "severity": "低い",
            "simple": -1,
            "subcategory": "同一性",
            "text": "必要に応じて、AKS の AAD 条件付きアクセスを構成する"
        },
        {
            "category": "ID およびアクセス管理",
            "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
            "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
            "security": 1,
            "severity": "低い",
            "simple": -1,
            "subcategory": "同一性",
            "text": "Windows AKS ワークロードに必要な場合は、gMSA を構成します。"
        },
        {
            "category": "ID およびアクセス管理",
            "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
            "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
            "security": 1,
            "severity": "中程度",
            "simple": -1,
            "subcategory": "同一性",
            "text": "より細かく制御するには、マネージドKubeletアイデンティティの使用を検討してください"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
            "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
            "security": 1,
            "severity": "中程度",
            "simple": -1,
            "subcategory": "おすすめの方法",
            "text": "AGIC を使用している場合は、クラスタ間で AppGW を共有しないでください。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
            "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
            "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
            "scale": 1,
            "severity": "高い",
            "simple": -1,
            "subcategory": "おすすめの方法",
            "text": "AKS アプリケーション ルーティング アドオンを使用しない"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
            "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
            "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
            "scale": 1,
            "severity": "中程度",
            "simple": -1,
            "subcategory": "おすすめの方法",
            "text": "Windows ワークロードの場合は、高速ネットワークを使用する"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
            "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
            "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
            "scale": 1,
            "severity": "高い",
            "subcategory": "おすすめの方法",
            "text": "標準のALBを使用します(基本的なALBとは対照的に)"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
            "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
            "security": 1,
            "severity": "中程度",
            "simple": -2,
            "subcategory": "おすすめの方法",
            "text": "Azure CNI を使用している場合は、ノードプールに異なるサブネットを使用することを検討してください"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
            "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
            "security": 1,
            "severity": "中程度",
            "simple": -1,
            "subcategory": "費用",
            "text": "プライベート エンドポイント (推奨) または仮想ネットワーク サービス エンドポイントを使用してクラスターから PaaS サービスにアクセスする"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "cost": -1,
            "guid": "e8a03f97-8794-468d-96a7-86d60f96c97b",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
            "severity": "中程度",
            "subcategory": "は",
            "text": "ハイブリッド接続が必要な場合は、2xER または ER+VPN を使用して可用性を向上させます"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
            "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
            "severity": "高い",
            "simple": 1,
            "subcategory": "ティッカー",
            "text": "要件に最適な CNI ネットワーク プラグインを選択する (Azure CNI を推奨)"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
            "scale": 1,
            "severity": "高い",
            "subcategory": "ティッカー",
            "text": "Azure CNI を使用している場合は、ノードあたりのポッドの最大数を考慮して、それに応じてサブネットのサイズを設定します"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
            "scale": 1,
            "severity": "高い",
            "simple": -1,
            "subcategory": "ティッカー",
            "text": "Azure CNI を使用している場合は、最大ポッド/ノード数 (既定値は 30) を確認します。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "description": "内部アプリの場合、組織は多くの場合、ファイアウォールで AKS サブネット全体を開きます。これにより、ノードへのネットワーク アクセスも開かれ、ポッドへのネットワーク アクセスも可能になる可能性があります (Azure CNI を使用している場合)。LoadBalancer IP が別のサブネットにある場合は、この IP のみをアプリ クライアントで使用できる必要があります。別の理由は、AKS サブネット内の IP アドレスが不足しているリソースである場合、その IP アドレスをサービスに使用すると、クラスターの最大スケーラビリティが低下することです。",
            "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
            "link": "https://learn.microsoft.com/azure/aks/internal-lb",
            "security": 1,
            "severity": "低い",
            "simple": -1,
            "subcategory": "ティッカー",
            "text": "プライベート IP ロードバランサー サービスを使用する場合は、(AKS サブネットではなく) 専用サブネットを使用します。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
            "scale": 1,
            "severity": "高い",
            "subcategory": "ティッカー",
            "text": "それに応じてサービスのIPアドレス範囲のサイズを設定します(クラスターのスケーラビリティが制限されます)"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
            "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
            "security": 1,
            "severity": "低い",
            "simple": -2,
            "subcategory": "オペレーションズ",
            "text": "必要に応じて、独自のCNIプラグインを追加します"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
            "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
            "security": 1,
            "severity": "低い",
            "simple": -2,
            "subcategory": "オペレーションズ",
            "text": "必要に応じて、AKS でノードごとにパブリック IP を構成します"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
            "link": "https://learn.microsoft.com/azure/aks/concepts-network",
            "scale": 1,
            "severity": "中程度",
            "simple": -1,
            "subcategory": "拡張性",
            "text": "イングレス コントローラーを使用して、LoadBalancer タイプのサービスで公開する代わりに Web ベースのアプリを公開する"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
            "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
            "scale": 1,
            "severity": "低い",
            "simple": -1,
            "subcategory": "拡張性",
            "text": "Azue NAT ゲートウェイをアウトバウンドタイプとして使用して、エグレス トラフィックをスケーリングする"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
            "scale": 1,
            "severity": "中程度",
            "simple": -1,
            "subcategory": "拡張性",
            "text": "Azure CNI IP の枯渇を回避するために IP の動的割り当てを使用する"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
            "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
            "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
            "security": 2,
            "severity": "高い",
            "simple": -2,
            "subcategory": "安全",
            "text": "AzFW/NVA を使用してエグレス トラフィックをフィルター処理します (セキュリティ要件で義務付けられている場合)"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
            "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
            "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
            "security": 1,
            "severity": "中程度",
            "simple": -1,
            "subcategory": "安全",
            "text": "パブリック API エンドポイントを使用している場合は、アクセスできる IP アドレスを制限する"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
            "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
            "link": "https://learn.microsoft.com/azure/aks/private-clusters",
            "security": 1,
            "severity": "高い",
            "simple": -1,
            "subcategory": "安全",
            "text": "要件で義務付けられている場合は、プライベートクラスターを使用する"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
            "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
            "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
            "security": 1,
            "severity": "中程度",
            "simple": -1,
            "subcategory": "安全",
            "text": "Windows 2019 および 2022 AKS ノードの場合、Calico ネットワーク ポリシーを使用できます"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
            "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
            "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
            "security": 1,
            "severity": "高い",
            "subcategory": "安全",
            "text": "Kubernetes ネットワーク ポリシー オプションを有効にする (Calico/Azure)"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
            "security": 1,
            "severity": "高い",
            "simple": -1,
            "subcategory": "安全",
            "text": "Kubernetes ネットワーク ポリシーを使用してクラスター内のセキュリティを強化する"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "cost": -1,
            "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
            "security": 2,
            "severity": "高い",
            "simple": -1,
            "subcategory": "安全",
            "text": "Web ワークロード (UI または API) に WAF を使用する"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "cost": -2,
            "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
            "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
            "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
            "security": 2,
            "severity": "中程度",
            "subcategory": "安全",
            "text": "AKS 仮想ネットワークで DDoS 標準を使用する"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "cost": -2,
            "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
            "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
            "link": "https://learn.microsoft.com/azure/aks/http-proxy",
            "security": 2,
            "severity": "低い",
            "subcategory": "安全",
            "text": "必要に応じて、会社の HTTP プロキシを追加します。"
        },
        {
            "category": "ネットワーク トポロジと接続性",
            "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
            "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
            "security": 1,
            "severity": "中程度",
            "simple": -2,
            "subcategory": "安全",
            "text": "高度なマイクロサービス通信管理にサービスメッシュを使用することを検討する"
        },
        {
            "category": "オペレーションズ",
            "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
            "severity": "高い",
            "simple": -1,
            "subcategory": "警告",
            "text": "最も重要なメトリックに関するアラートを構成します (推奨事項については、「コンテナーの分析情報」を参照してください)"
        },
        {
            "category": "オペレーションズ",
            "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
            "severity": "低い",
            "simple": -1,
            "subcategory": "コンプライアンス",
            "text": "Azure アドバイザーでクラスターに関する推奨事項を定期的に確認する"
        },
        {
            "category": "オペレーションズ",
            "guid": "5388e9de-d167-4dd1-a2b0-ac241b999a64",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
            "severity": "低い",
            "simple": 1,
            "subcategory": "コンプライアンス",
            "text": "VSCODE + kubeadvisorなどのインテリジェントなテキストエディタを使用してYAMLマニフェストを開発します"
        },
        {
            "category": "オペレーションズ",
            "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
            "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
            "severity": "低い",
            "simple": 1,
            "subcategory": "コンプライアンス",
            "text": "AKS の自動証明書のローテーションを有効にする"
        },
        {
            "category": "オペレーションズ",
            "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
            "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
            "security": 1,
            "severity": "高い",
            "simple": -1,
            "subcategory": "コンプライアンス",
            "text": "Kubernetes バージョンを定期的に (四半期ごとなど) アップグレードするか、AKS 自動アップグレード機能を使用する定期的なプロセスを用意する"
        },
        {
            "category": "オペレーションズ",
            "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
            "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
            "severity": "高い",
            "simple": -1,
            "subcategory": "コンプライアンス",
            "text": "ノード イメージのアップグレードを使用していない場合は、Linux ノードのアップグレードに kured を使用します。"
        },
        {
            "category": "オペレーションズ",
            "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
            "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
            "security": 1,
            "severity": "高い",
            "simple": -1,
            "subcategory": "コンプライアンス",
            "text": "クラスタノードイメージを定期的に(毎週など)アップグレードする定期的なプロセスを用意する"
        },
        {
            "category": "オペレーションズ",
            "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
            "severity": "低い",
            "subcategory": "コンプライアンス",
            "text": "アプリケーションまたはクラスター構成を複数のクラスターにデプロイするための gitops を検討する"
        },
        {
            "category": "オペレーションズ",
            "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
            "link": "https://learn.microsoft.com/azure/aks/command-invoke",
            "severity": "低い",
            "subcategory": "コンプライアンス",
            "text": "プライベート クラスターでの AKS コマンド呼び出しの使用を検討する"
        },
        {
            "category": "オペレーションズ",
            "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
            "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
            "security": 1,
            "severity": "低い",
            "subcategory": "コンプライアンス",
            "text": "計画されたイベントの場合は、ノード自動ドレインの使用を検討してください"
        },
        {
            "category": "オペレーションズ",
            "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
            "link": "https://learn.microsoft.com/azure/aks/faq",
            "security": 1,
            "severity": "高い",
            "subcategory": "コンプライアンス",
            "text": "独自のガバナンスプラクティスを開発して、ノードRG(別名「インフラRG」)のオペレーターによって変更が実行されないようにします。"
        },
        {
            "category": "オペレーションズ",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
            "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
            "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
            "severity": "低い",
            "simple": 1,
            "subcategory": "コンプライアンス",
            "text": "カスタムノードRG(別名「インフラRG」)名を使用する"
        },
        {
            "category": "オペレーションズ",
            "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
            "ha": 1,
            "link": "https://kubernetes.io/docs/setup/release/notes/",
            "severity": "中程度",
            "simple": -1,
            "subcategory": "コンプライアンス",
            "text": "非推奨の Kubernetes API を YAML マニフェストで使用しないでください"
        },
        {
            "category": "オペレーションズ",
            "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
            "severity": "低い",
            "simple": -1,
            "subcategory": "コンプライアンス",
            "text": "ウィンドウ ノードを汚染する"
        },
        {
            "category": "オペレーションズ",
            "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
            "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
            "severity": "低い",
            "subcategory": "コンプライアンス",
            "text": "Windowsコンテナのパッチレベルをホストパッチレベルと同期させる"
        },
        {
            "category": "オペレーションズ",
            "cost": -1,
            "description": "クラスター レベルでの診断設定経由",
            "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
            "severity": "低い",
            "subcategory": "コンプライアンス",
            "text": "マスター ログ (API ログ) を Azure Monitor または任意のログ管理ソリューションに送信する"
        },
        {
            "category": "オペレーションズ",
            "cost": 1,
            "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
            "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
            "severity": "低い",
            "simple": -1,
            "subcategory": "費用",
            "text": "時間的制約のないワークロードのスポットノードプールを検討する"
        },
        {
            "category": "オペレーションズ",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
            "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
            "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
            "scale": 1,
            "severity": "低い",
            "simple": -1,
            "subcategory": "費用",
            "text": "迅速なバーストのために AKS 仮想ノードを検討する"
        },
        {
            "category": "オペレーションズ",
            "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
            "severity": "高い",
            "simple": -1,
            "subcategory": "モニタリング",
            "text": "コンテナインサイト(またはPrometheusなどの他のツール)を使用してクラスターメトリクスを監視する"
        },
        {
            "category": "オペレーションズ",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
            "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
            "severity": "高い",
            "simple": -1,
            "subcategory": "モニタリング",
            "text": "Container Insights (または Telegraf/ElasticSearch などの他のツール) を使用してクラスター ログを保存および分析します。"
        },
        {
            "category": "オペレーションズ",
            "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
            "severity": "中程度",
            "simple": -1,
            "subcategory": "モニタリング",
            "text": "ノードの CPU とメモリの使用率を監視する"
        },
        {
            "category": "オペレーションズ",
            "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
            "severity": "中程度",
            "simple": -1,
            "subcategory": "モニタリング",
            "text": "Azure CNI を使用している場合は、ノードごとに消費されるポッド IP の割合を監視する"
        },
        {
            "category": "オペレーションズ",
            "description": "OS ディスク内の I/O は重要なリソースです。ノード内の OS が I/O で調整されると、予期しない動作が発生する可能性があり、通常はノードが NotReady と宣言されることになります。",
            "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
            "severity": "中程度",
            "simple": -1,
            "subcategory": "モニタリング",
            "text": "ノード内の OS ディスク キューの深さを監視する"
        },
        {
            "category": "オペレーションズ",
            "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
            "severity": "中程度",
            "simple": -1,
            "subcategory": "モニタリング",
            "text": "AzFW/NVA でエグレス フィルタリングを使用していない場合は、標準の ALB 割り当て SNAT ポートを監視します。"
        },
        {
            "category": "オペレーションズ",
            "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
            "severity": "中程度",
            "subcategory": "モニタリング",
            "text": "AKS クラスターのリソース正常性通知をサブスクライブする"
        },
        {
            "category": "オペレーションズ",
            "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
            "severity": "高い",
            "simple": -1,
            "subcategory": "リソース",
            "text": "ポッド仕様で要求と制限を構成する"
        },
        {
            "category": "オペレーションズ",
            "guid": "769ef669-1a48-435a-a942-223ece80b123",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
            "severity": "中程度",
            "simple": -1,
            "subcategory": "リソース",
            "text": "名前空間のリソース クォータを適用する"
        },
        {
            "category": "オペレーションズ",
            "cost": 1,
            "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
            "severity": "高い",
            "subcategory": "リソース",
            "text": "サブスクリプションにノードプールをスケールアウトするのに十分なクォータがあることを確認する"
        },
        {
            "category": "オペレーションズ",
            "cost": -1,
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
            "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
            "severity": "中程度",
            "subcategory": "拡張性",
            "text": "クラスター オートスケーラーを使用する"
        },
        {
            "category": "オペレーションズ",
            "cost": -1,
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
            "guid": "831c2872-c693-4b39-a887-a561bada49bc",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
            "severity": "低い",
            "subcategory": "拡張性",
            "text": "AKS ノード プールのノード構成をカスタマイズする"
        },
        {
            "category": "オペレーションズ",
            "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
            "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
            "scale": 1,
            "severity": "中程度",
            "simple": -1,
            "subcategory": "拡張性",
            "text": "必要に応じてポッド水平オートスケーラーを使用する"
        },
        {
            "category": "オペレーションズ",
            "cost": 1,
            "description": "ノードが大きいほど、エフェメラルディスクや高速ネットワークなどのパフォーマンスと機能が向上しますが、爆発半径が大きくなり、スケーリングの粒度が低下します。",
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
            "severity": "高い",
            "subcategory": "拡張性",
            "text": "大きすぎたり小さすぎたりしない適切なノードサイズを検討する"
        },
        {
            "category": "オペレーションズ",
            "cost": 1,
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
            "severity": "低い",
            "subcategory": "拡張性",
            "text": "スケーラビリティが必要な場合は、5000 を超えるノードを追加することを検討してください"
        },
        {
            "category": "オペレーションズ",
            "cost": 1,
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
            "severity": "低い",
            "subcategory": "拡張性",
            "text": "AKS オートメーションのためにイベント グリッド イベントをサブスクライブすることを検討する"
        },
        {
            "category": "オペレーションズ",
            "cost": 1,
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
            "severity": "低い",
            "subcategory": "拡張性",
            "text": "AKS クラスターで長時間実行される操作の場合は、イベントの終了を検討する"
        },
        {
            "category": "オペレーションズ",
            "cost": 1,
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
            "severity": "低い",
            "subcategory": "拡張性",
            "text": "必要に応じて、AKS ノードに Azure 専用ホストの使用を検討する"
        },
        {
            "category": "オペレーションズ",
            "cost": -1,
            "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
            "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
            "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
            "scale": 1,
            "severity": "高い",
            "subcategory": "貯蔵",
            "text": "エフェメラル OS ディスクを使用する"
        },
        {
            "category": "オペレーションズ",
            "cost": -1,
            "guid": "fc4972cc-3cd2-45bf-a707-6e9eab4bed32",
            "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
            "scale": 1,
            "severity": "高い",
            "subcategory": "貯蔵",
            "text": "非エフェメラル ディスクの場合、複数のポッドを実行するために高いパフォーマンスが必要であり、既定の AKS ログ ローテーションしきい値で巨大なログが生成されるため、多くのポッド/ノードを実行する場合は、ノードに高い IOPS とより大きな OS ディスクを使用します。"
        },
        {
            "category": "オペレーションズ",
            "cost": -1,
            "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
            "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
            "scale": 1,
            "severity": "低い",
            "subcategory": "貯蔵",
            "text": "ハイパー パフォーマンス ストレージ オプションの場合は、AKS で Ultra ディスクを使用します"
        },
        {
            "category": "オペレーションズ",
            "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
            "severity": "中程度",
            "simple": -1,
            "subcategory": "貯蔵",
            "text": "クラスターに状態を保持することは避け、データを外部 (AzStorage、AzSQL、Cosmos など) に格納します。"
        },
        {
            "category": "オペレーションズ",
            "cost": -1,
            "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
            "scale": 1,
            "severity": "中程度",
            "subcategory": "貯蔵",
            "text": "AzFiles Standard を使用する場合は、パフォーマンス上の理由から AzFiles Premium や ANF を検討してください。"
        },
        {
            "category": "オペレーションズ",
            "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
            "severity": "中程度",
            "simple": -1,
            "subcategory": "貯蔵",
            "text": "Azure ディスクと AZ を使用する場合は、適切なゾーンにストレージをプロビジョニングするために VolumeBindingMode:WaitForFirstConsumer を使用して LRS ディスクのゾーン内にノードプールを配置するか、複数のゾーンにまたがるノードプールに ZRS ディスクを使用することを検討してください。"
        }
    ],
    "metadata": {
        "name": "Azure AKS Review"
    },
    "severities": [
        {
            "name": "高い"
        },
        {
            "name": "中程度"
        },
        {
            "name": "低い"
        }
    ],
    "status": [
        {
            "description": "このチェックはまだ確認されていません",
            "name": "未確認"
        },
        {
            "description": "このチェックに関連付けられているアクションアイテムがあります",
            "name": "開ける"
        },
        {
            "description": "このチェックは検証済みであり、それ以上のアクションアイテムは関連付けられていません",
            "name": "達成"
        },
        {
            "description": "推奨事項は理解されていますが、現在の要件では必要ありません",
            "name": "必須ではありません"
        },
        {
            "description": "現在のデザインには適用できません",
            "name": "該当なし"
        }
    ]
}
checklists/aks_checklist.es.json METASEP
{
    "categories": [
        {
            "name": "Gestión de identidades y accesos"
        },
        {
            "name": "Topología y conectividad de red"
        },
        {
            "name": "BC y DR"
        },
        {
            "name": "Gobernanza y seguridad"
        },
        {
            "name": "Gobernanza de costos"
        },
        {
            "name": "Operaciones"
        },
        {
            "name": "Implementación de aplicaciones"
        }
    ],
    "items": [
        {
            "category": "Implementación de aplicaciones",
            "cost": 1,
            "guid": "785c2fa5-5b56-4ad4-a408-fe72734c476b",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/containers/aks/secure-baseline-aks",
            "severity": "Medio",
            "subcategory": "Desarrollo",
            "text": "Usar implementaciones canarias o azules/verdes"
        },
        {
            "category": "Implementación de aplicaciones",
            "cost": 1,
            "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
            "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc",
            "severity": "Bajo",
            "subcategory": "Desarrollo",
            "text": "Si se requiere para cargas de trabajo de Windows de AKS, se pueden usar contenedores de HostProcess"
        },
        {
            "category": "Implementación de aplicaciones",
            "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
            "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda",
            "scale": 1,
            "severity": "Bajo",
            "simple": -1,
            "subcategory": "Desarrollo",
            "text": "Usar KEDA si ejecuta cargas de trabajo controladas por eventos"
        },
        {
            "category": "Implementación de aplicaciones",
            "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
            "link": "https://dapr.io/",
            "severity": "Bajo",
            "simple": 1,
            "subcategory": "Desarrollo",
            "text": "Usar Dapr para facilitar el desarrollo de microservicios"
        },
        {
            "category": "Implementación de aplicaciones",
            "guid": "3acbe04b-be20-49d3-afda-47778424d116",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/developer/terraform/create-k8s-cluster-with-tf-and-aks",
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Infraestructura como código",
            "text": "Uso de la automatización a través de ARM/TF para crear los recursos de Azure"
        },
        {
            "category": "BC y DR",
            "guid": "36cb45e5-7960-4332-9bdf-8cc23318da61",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery",
            "severity": "Alto",
            "subcategory": "Recuperación ante desastres",
            "text": "Programe y realice pruebas de DR regularmente"
        },
        {
            "category": "BC y DR",
            "guid": "170265f4-bb46-4a39-9af7-f317284797b1",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
            "severity": "Medio",
            "subcategory": "Alta disponibilidad",
            "text": "Usar Azure Traffic Manager o Azure Front Door como equilibrador de carga global para la conmutación por error de región"
        },
        {
            "category": "BC y DR",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant= isnotnull(zones) | distinct id,compliant",
            "guid": "578a219a-46be-4b54-9350-24922634292b",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/availability-zones",
            "severity": "Medio",
            "subcategory": "Alta disponibilidad",
            "text": "Use zonas de disponibilidad si son compatibles en su región de Azure"
        },
        {
            "category": "BC y DR",
            "cost": -2,
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
            "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
            "ha": 2,
            "link": "https://learn.microsoft.com/azure/aks/uptime-sla",
            "severity": "Alto",
            "subcategory": "Alta disponibilidad",
            "text": "Usar la oferta de AKS respaldada por SLA"
        },
        {
            "category": "BC y DR",
            "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
            "severity": "Bajo",
            "simple": -1,
            "subcategory": "Alta disponibilidad",
            "text": "Usar presupuestos de interrupción en el pod y las definiciones de implementación"
        },
        {
            "category": "BC y DR",
            "cost": -1,
            "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication",
            "severity": "Alto",
            "subcategory": "Alta disponibilidad",
            "text": "Si utiliza un registro privado, configure la replicación de regiones para almacenar imágenes en varias regiones"
        },
        {
            "category": "BC y DR",
            "guid": "bc14aea6-e65d-48d9-a3ad-c218e6436b06",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery",
            "severity": "Alto",
            "subcategory": "Requisitos",
            "text": "Defina requisitos no funcionales como SLAs, RTO (Recovery Time Objective) y RPO (Recovery Point Objective)."
        },
        {
            "category": "Gobernanza de costos",
            "cost": 1,
            "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost",
            "severity": "Bajo",
            "subcategory": "Costar",
            "text": "Usar una aplicación externa como kubecost para asignar costos a diferentes usuarios"
        },
        {
            "category": "Gobernanza de costos",
            "cost": 1,
            "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
            "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot",
            "severity": "Bajo",
            "subcategory": "Costar",
            "text": "Si es necesario, escale las instantáneas de NodePool"
        },
        {
            "category": "Gobernanza de costos",
            "cost": 1,
            "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
            "link": "https://learn.microsoft.com/azure/aks/scale-down-mode",
            "severity": "Bajo",
            "subcategory": "Costar",
            "text": "Usar el modo de reducción vertical para eliminar/eliminar nodos"
        },
        {
            "category": "Gobernanza de costos",
            "cost": 1,
            "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
            "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance",
            "severity": "Medio",
            "subcategory": "Costar",
            "text": "Cuando sea necesario, use la GPU de partioning de varias instancias en clústeres de AKS"
        },
        {
            "category": "Gobernanza de costos",
            "cost": 1,
            "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
            "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools",
            "severity": "Bajo",
            "subcategory": "Costar",
            "text": "Si ejecuta un clúster de desarrollo y pruebas, utilice NodePool Start/Stop"
        },
        {
            "category": "Gobernanza y seguridad",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
            "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
            "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes",
            "security": 1,
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Conformidad",
            "text": "Uso de Azure Policy for Kubernetes para garantizar el cumplimiento del clúster"
        },
        {
            "category": "Gobernanza y seguridad",
            "cost": -1,
            "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
            "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
            "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
            "security": 1,
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Conformidad",
            "text": "Separar las aplicaciones del plano de control con grupos de nodos de usuario/sistema"
        },
        {
            "category": "Gobernanza y seguridad",
            "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/use-system-pools",
            "severity": "Bajo",
            "simple": -1,
            "subcategory": "Conformidad",
            "text": "Agregue mancha a su nodepool del sistema para que sea dedicado"
        },
        {
            "category": "Gobernanza y seguridad",
            "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
            "link": "https://learn.microsoft.com/azure/container-registry/",
            "security": 1,
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Conformidad",
            "text": "Usar un registro privado para las imágenes, como ACR"
        },
        {
            "category": "Gobernanza y seguridad",
            "cost": -1,
            "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
            "link": "https://learn.microsoft.com/azure/security-center/container-security",
            "security": 1,
            "severity": "Medio",
            "subcategory": "Conformidad",
            "text": "Escanea tus imágenes en busca de vulnerabilidades"
        },
        {
            "category": "Gobernanza y seguridad",
            "cost": -1,
            "guid": "cc639637-a652-42ac-89e8-06965388e9de",
            "link": "https://learn.microsoft.com/azure/security-center/container-security",
            "security": 1,
            "severity": "Medio",
            "subcategory": "Conformidad",
            "text": "Uso de Azure Security Center para detectar vulnerabilidades de postura de seguridad"
        },
        {
            "category": "Gobernanza y seguridad",
            "cost": -1,
            "guid": "42d4aefe-2383-470e-b019-c30df24996b2",
            "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-fips-enabled-node-pool",
            "security": 1,
            "severity": "Bajo",
            "subcategory": "Conformidad",
            "text": "Si es necesario, configure FIPS"
        },
        {
            "category": "Gobernanza y seguridad",
            "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation",
            "security": 1,
            "severity": "Alto",
            "subcategory": "Conformidad",
            "text": "Definir los requisitos de separación de aplicaciones (espacio de nombres/grupo de nodos/clúster)"
        },
        {
            "category": "Gobernanza y seguridad",
            "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
            "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure",
            "security": 1,
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Secretos",
            "text": "Almacene sus secretos en Azure Key Vault con el controlador CSI Secrets Store"
        },
        {
            "category": "Gobernanza y seguridad",
            "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
            "link": "https://learn.microsoft.com/azure/aks/update-credentials",
            "security": 1,
            "severity": "Alto",
            "subcategory": "Secretos",
            "text": "Si usa entidades de servicio para el clúster, actualice las credenciales periódicamente (como trimestralmente)"
        },
        {
            "category": "Gobernanza y seguridad",
            "cost": -1,
            "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
            "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption",
            "security": 1,
            "severity": "Medio",
            "subcategory": "Secretos",
            "text": "Si es necesario, agregue el cifrado etcd del Servicio de administración de claves"
        },
        {
            "category": "Gobernanza y seguridad",
            "cost": -1,
            "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
            "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview",
            "security": 1,
            "severity": "Bajo",
            "subcategory": "Secretos",
            "text": "Si es necesario, considere la posibilidad de usar Proceso confidencial para AKS"
        },
        {
            "category": "Gobernanza y seguridad",
            "cost": -1,
            "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable",
            "security": 1,
            "severity": "Medio",
            "subcategory": "Secretos",
            "text": "Considere la posibilidad de usar Defender para contenedores"
        },
        {
            "category": "Gestión de identidades y accesos",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
            "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
            "link": "https://learn.microsoft.com/azure/aks/use-managed-identity",
            "severity": "Alto",
            "simple": 1,
            "subcategory": "Identidad",
            "text": "Usar identidades administradas en lugar de entidades de servicio"
        },
        {
            "category": "Gestión de identidades y accesos",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
            "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad",
            "severity": "Medio",
            "simple": 1,
            "subcategory": "Identidad",
            "text": "Integrar la autenticación con AAD (mediante la integración administrada)"
        },
        {
            "category": "Gestión de identidades y accesos",
            "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
            "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access",
            "security": 1,
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Identidad",
            "text": "Limitar el acceso a admin kubeconfig (get-credentials --admin)"
        },
        {
            "category": "Gestión de identidades y accesos",
            "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
            "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac",
            "security": 1,
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Identidad",
            "text": "Integrar la autorización con AAD RBAC"
        },
        {
            "category": "Gestión de identidades y accesos",
            "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity",
            "security": 1,
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Identidad",
            "text": "Usar espacios de nombres para restringir los privilegios RBAC en Kubernetes"
        },
        {
            "category": "Gestión de identidades y accesos",
            "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
            "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar",
            "security": 1,
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Identidad",
            "text": "Para la administración de acceso de identidad POD, use Azure AD Workload Identity (versión preliminar)"
        },
        {
            "category": "Gestión de identidades y accesos",
            "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin",
            "security": 1,
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Identidad",
            "text": "Para inicios de sesión no interactivos de AKS, use kubelogin (vista previa)"
        },
        {
            "category": "Gestión de identidades y accesos",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
            "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts",
            "security": 1,
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Identidad",
            "text": "Deshabilitar cuentas locales de AKS"
        },
        {
            "category": "Gestión de identidades y accesos",
            "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks",
            "security": 1,
            "severity": "Bajo",
            "simple": -1,
            "subcategory": "Identidad",
            "text": "Configurar si es necesario Acceso al clúster Just-in-time"
        },
        {
            "category": "Gestión de identidades y accesos",
            "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks",
            "security": 1,
            "severity": "Bajo",
            "simple": -1,
            "subcategory": "Identidad",
            "text": "Configurar, si es necesario, el acceso condicional de AAD para AKS"
        },
        {
            "category": "Gestión de identidades y accesos",
            "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
            "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts",
            "security": 1,
            "severity": "Bajo",
            "simple": -1,
            "subcategory": "Identidad",
            "text": "Si es necesario para cargas de trabajo de Windows AKS, configure gMSA "
        },
        {
            "category": "Gestión de identidades y accesos",
            "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
            "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity",
            "security": 1,
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Identidad",
            "text": "Para un control más preciso, considere usar una identidad Kubelet administrada"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
            "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/",
            "security": 1,
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Prácticas recomendadas",
            "text": "Si usa AGIC, no comparta un AppGW entre clústeres"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
            "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
            "link": "https://learn.microsoft.com/azure/aks/http-application-routing",
            "scale": 1,
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Prácticas recomendadas",
            "text": "No utilice el complemento de enrutamiento de aplicaciones de AKS"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
            "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
            "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview",
            "scale": 1,
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Prácticas recomendadas",
            "text": "Para cargas de trabajo de Windows, use Redes aceleradas"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
            "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
            "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
            "scale": 1,
            "severity": "Alto",
            "subcategory": "Prácticas recomendadas",
            "text": "Utilice el ALB estándar (en lugar del básico)"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
            "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet",
            "security": 1,
            "severity": "Medio",
            "simple": -2,
            "subcategory": "Prácticas recomendadas",
            "text": "Si usa CNI de Azure, considere la posibilidad de usar diferentes subredes para NodePools"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
            "link": "https://learn.microsoft.com/azure/private-link/private-link-overview",
            "security": 1,
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Costar",
            "text": "Usar extremos privados (preferidos) o extremos de servicio de red virtual para acceder a los servicios PaaS desde el clúster"
        },
        {
            "category": "Topología y conectividad de red",
            "cost": -1,
            "guid": "e8a03f97-8794-468d-96a7-86d60f96c97b",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering",
            "severity": "Medio",
            "subcategory": "JA",
            "text": "Si se requiere conectividad híbrida, use 2xER o ER+VPN para una mejor disponibilidad"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
            "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
            "severity": "Alto",
            "simple": 1,
            "subcategory": "IPAM (en inglés)",
            "text": "Elija el mejor complemento de red CNI para sus necesidades (se recomienda Azure CNI)"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
            "scale": 1,
            "severity": "Alto",
            "subcategory": "IPAM (en inglés)",
            "text": "Si usa Azure CNI, ajuste el tamaño de la subred en consecuencia teniendo en cuenta el número máximo de pods por nodo"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
            "scale": 1,
            "severity": "Alto",
            "simple": -1,
            "subcategory": "IPAM (en inglés)",
            "text": "Si usa Azure CNI, compruebe el número máximo de pods/nodo (predeterminado 30)"
        },
        {
            "category": "Topología y conectividad de red",
            "description": "Para las aplicaciones internas, las organizaciones suelen abrir toda la subred de AKS en sus firewalls. Esto abre el acceso de red también a los nodos y, potencialmente, también a los pods (si usa Azure CNI). Si las direcciones IP de LoadBalancer están en una subred diferente, solo esta debe estar disponible para los clientes de la aplicación. Otra razón es que si las direcciones IP de la subred AKS son un recurso escaso, consumir sus direcciones IP para servicios reducirá la escalabilidad máxima del clúster.",
            "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
            "link": "https://learn.microsoft.com/azure/aks/internal-lb",
            "security": 1,
            "severity": "Bajo",
            "simple": -1,
            "subcategory": "IPAM (en inglés)",
            "text": "Si utiliza servicios de equilibrador de carga de IP privada, use una subred dedicada (no la subred AKS)"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
            "scale": 1,
            "severity": "Alto",
            "subcategory": "IPAM (en inglés)",
            "text": "Dimensione el intervalo de direcciones IP de servicio en consecuencia (limitará la escalabilidad del clúster)"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
            "link": "https://learn.microsoft.com/azure/aks/use-byo-cni",
            "security": 1,
            "severity": "Bajo",
            "simple": -2,
            "subcategory": "Operaciones",
            "text": "Si es necesario, agregue su propio complemento CNI"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
            "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools",
            "security": 1,
            "severity": "Bajo",
            "simple": -2,
            "subcategory": "Operaciones",
            "text": "Si es necesario, configure IP pública por nodo en AKS"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
            "link": "https://learn.microsoft.com/azure/aks/concepts-network",
            "scale": 1,
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Escalabilidad",
            "text": "Usar un controlador de entrada para exponer aplicaciones basadas en web en lugar de exponerlas con servicios de tipo LoadBalancer"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
            "link": "https://learn.microsoft.com/azure/aks/nat-gateway",
            "scale": 1,
            "severity": "Bajo",
            "simple": -1,
            "subcategory": "Escalabilidad",
            "text": "Usar Azue NAT Gateway como outboundType para escalar el tráfico de salida"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support",
            "scale": 1,
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Escalabilidad",
            "text": "Uso de asignaciones dinámicas de direcciones IP para evitar el agotamiento de IP de CNI de Azure"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
            "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
            "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic",
            "security": 2,
            "severity": "Alto",
            "simple": -2,
            "subcategory": "Seguridad",
            "text": "Filtre el tráfico de salida con AzFW/NVA si sus requisitos de seguridad lo exigen"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
            "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
            "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges",
            "security": 1,
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Seguridad",
            "text": "Si utiliza un punto de enlace de API público, restrinja las direcciones IP que pueden acceder a él"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
            "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
            "link": "https://learn.microsoft.com/azure/aks/private-clusters",
            "security": 1,
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Seguridad",
            "text": "Utilice clústeres privados si sus requisitos lo exigen"
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
            "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
            "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
            "security": 1,
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Seguridad",
            "text": "Para los nodos AKS de Windows 2019 y 2022, se pueden usar las directivas de red de Calico "
        },
        {
            "category": "Topología y conectividad de red",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
            "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
            "link": "https://learn.microsoft.com/azure/aks/use-network-policies",
            "security": 1,
            "severity": "Alto",
            "subcategory": "Seguridad",
            "text": "Habilitar una opción de directiva de red de Kubernetes (Calico/Azure)"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
            "security": 1,
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Seguridad",
            "text": "Usar políticas de red de Kubernetes para aumentar la seguridad dentro del clúster"
        },
        {
            "category": "Topología y conectividad de red",
            "cost": -1,
            "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network",
            "security": 2,
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Seguridad",
            "text": "Usar un WAF para cargas de trabajo web (interfaces de usuario o API)"
        },
        {
            "category": "Topología y conectividad de red",
            "cost": -2,
            "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
            "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
            "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview",
            "security": 2,
            "severity": "Medio",
            "subcategory": "Seguridad",
            "text": "Usar DDoS Standard en la red virtual de AKS"
        },
        {
            "category": "Topología y conectividad de red",
            "cost": -2,
            "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
            "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
            "link": "https://learn.microsoft.com/azure/aks/http-proxy",
            "security": 2,
            "severity": "Bajo",
            "subcategory": "Seguridad",
            "text": "Si es necesario, agregue el proxy HTTP de la empresa"
        },
        {
            "category": "Topología y conectividad de red",
            "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
            "link": "https://learn.microsoft.com/azure/aks/servicemesh-about",
            "security": 1,
            "severity": "Medio",
            "simple": -2,
            "subcategory": "Seguridad",
            "text": "Considere la posibilidad de usar una malla de servicios para la administración avanzada de comunicaciones de microservicios"
        },
        {
            "category": "Operaciones",
            "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts",
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Alertas",
            "text": "Configurar alertas sobre las métricas más críticas (consulte Container Insights para obtener recomendaciones)"
        },
        {
            "category": "Operaciones",
            "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started",
            "severity": "Bajo",
            "simple": -1,
            "subcategory": "Conformidad",
            "text": "Consulte periódicamente Azure Advisor para obtener recomendaciones sobre el clúster"
        },
        {
            "category": "Operaciones",
            "guid": "5388e9de-d167-4dd1-a2b0-ac241b999a64",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
            "severity": "Bajo",
            "simple": 1,
            "subcategory": "Conformidad",
            "text": "Desarrolle sus manifiestos YAML con editores de texto inteligentes como vscode+kubeadvisor"
        },
        {
            "category": "Operaciones",
            "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
            "link": "https://learn.microsoft.com/azure/aks/certificate-rotation",
            "severity": "Bajo",
            "simple": 1,
            "subcategory": "Conformidad",
            "text": "Habilitar la rotación automática de certificados de AKS"
        },
        {
            "category": "Operaciones",
            "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
            "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions",
            "security": 1,
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Conformidad",
            "text": "Tenga un proceso regular para actualizar su versión de kubernetes periódicamente (trimestralmente, por ejemplo) o use la función de actualización automática de AKS"
        },
        {
            "category": "Operaciones",
            "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
            "link": "https://learn.microsoft.com/azure/aks/node-updates-kured",
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Conformidad",
            "text": "Utilice kured para actualizaciones de nodos de Linux en caso de que no esté utilizando la actualización de imagen de nodo"
        },
        {
            "category": "Operaciones",
            "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
            "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade",
            "security": 1,
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Conformidad",
            "text": "Tener un proceso regular para actualizar las imágenes del nodo del clúster periódicamente (semanalmente, por ejemplo)"
        },
        {
            "category": "Operaciones",
            "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments",
            "severity": "Bajo",
            "subcategory": "Conformidad",
            "text": "Considere gitops para implementar aplicaciones o configuración de clústeres en varios clústeres"
        },
        {
            "category": "Operaciones",
            "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
            "link": "https://learn.microsoft.com/azure/aks/command-invoke",
            "severity": "Bajo",
            "subcategory": "Conformidad",
            "text": "Considere la posibilidad de usar la invocación del comando AKS en clústeres privados"
        },
        {
            "category": "Operaciones",
            "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
            "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain",
            "security": 1,
            "severity": "Bajo",
            "subcategory": "Conformidad",
            "text": "Para eventos planificados, considere la posibilidad de utilizar Node Auto Drain"
        },
        {
            "category": "Operaciones",
            "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
            "link": "https://learn.microsoft.com/azure/aks/faq",
            "security": 1,
            "severity": "Alto",
            "subcategory": "Conformidad",
            "text": "Desarrollar prácticas gubernamentales propias para asegurarse de que los operadores no realicen cambios en el nodo RG (también conocido como 'infra RG')"
        },
        {
            "category": "Operaciones",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
            "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
            "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
            "severity": "Bajo",
            "simple": 1,
            "subcategory": "Conformidad",
            "text": "Usar el nombre RG de nodo personalizado (también conocido como 'Infra RG')"
        },
        {
            "category": "Operaciones",
            "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
            "ha": 1,
            "link": "https://kubernetes.io/docs/setup/release/notes/",
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Conformidad",
            "text": "No use API de Kubernetes obsoletas en sus manifiestos YAML"
        },
        {
            "category": "Operaciones",
            "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters",
            "severity": "Bajo",
            "simple": -1,
            "subcategory": "Conformidad",
            "text": "Nodos de Windows"
        },
        {
            "category": "Operaciones",
            "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
            "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2",
            "severity": "Bajo",
            "subcategory": "Conformidad",
            "text": "Mantenga el nivel de revisión de los contenedores de Windows sincronizado con el nivel de revisión del host"
        },
        {
            "category": "Operaciones",
            "cost": -1,
            "description": "Mediante la configuración de diagnóstico en el nivel de clúster",
            "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/monitor-aks",
            "severity": "Bajo",
            "subcategory": "Conformidad",
            "text": "Enviar registros maestros (también conocidos como registros de API) a Azure Monitor o a su solución de administración de registros preferida"
        },
        {
            "category": "Operaciones",
            "cost": 1,
            "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
            "link": "https://learn.microsoft.com/azure/aks/spot-node-pool",
            "severity": "Bajo",
            "simple": -1,
            "subcategory": "Costar",
            "text": "Considere la posibilidad de agrupar de nodos puntuales para cargas de trabajo que no sean urgentes"
        },
        {
            "category": "Operaciones",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
            "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
            "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
            "scale": 1,
            "severity": "Bajo",
            "simple": -1,
            "subcategory": "Costar",
            "text": "Considere el nodo virtual AKS para una ráfaga rápida"
        },
        {
            "category": "Operaciones",
            "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Monitorización",
            "text": "Supervise las métricas de su clúster con Container Insights (u otras herramientas como Prometheus)"
        },
        {
            "category": "Operaciones",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
            "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview",
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Monitorización",
            "text": "Almacene y analice sus registros de clúster con Container Insights (u otras herramientas como Telegraf/ElasticSearch)"
        },
        {
            "category": "Operaciones",
            "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze",
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Monitorización",
            "text": "Supervisar la utilización de CPU y memoria de los nodos"
        },
        {
            "category": "Operaciones",
            "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni",
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Monitorización",
            "text": "Si usa CNI de Azure, supervise el % de direcciones IP de pod consumidas por nodo"
        },
        {
            "category": "Operaciones",
            "description": "La E/S en el disco del sistema operativo es un recurso crítico. Si el sistema operativo en los nodos se limita en E/S, esto podría conducir a un comportamiento impredecible, que normalmente termina en un nodo que se declara NotReady",
            "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance",
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Monitorización",
            "text": "Supervisar la profundidad de la cola de disco del sistema operativo en los nodos"
        },
        {
            "category": "Operaciones",
            "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard",
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Monitorización",
            "text": "Si no utiliza el filtrado de salida con AzFW/NVA, supervise los puertos SNAT asignados ALB estándar"
        },
        {
            "category": "Operaciones",
            "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/aks-resource-health",
            "severity": "Medio",
            "subcategory": "Monitorización",
            "text": "Suscribirse a las notificaciones de estado de recursos para el clúster de AKS"
        },
        {
            "category": "Operaciones",
            "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
            "severity": "Alto",
            "simple": -1,
            "subcategory": "Recursos",
            "text": "Configurar solicitudes y límites en las especificaciones de tu pod"
        },
        {
            "category": "Operaciones",
            "guid": "769ef669-1a48-435a-a942-223ece80b123",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler",
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Recursos",
            "text": "Aplicar cuotas de recursos para espacios de nombres"
        },
        {
            "category": "Operaciones",
            "cost": 1,
            "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits",
            "severity": "Alto",
            "subcategory": "Recursos",
            "text": "Asegúrese de que su suscripción tenga suficiente cuota para escalar horizontalmente sus grupos de nodos"
        },
        {
            "category": "Operaciones",
            "cost": -1,
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
            "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
            "severity": "Medio",
            "subcategory": "Escalabilidad",
            "text": "Usar el escalador automático de clúster"
        },
        {
            "category": "Operaciones",
            "cost": -1,
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
            "guid": "831c2872-c693-4b39-a887-a561bada49bc",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration",
            "severity": "Bajo",
            "subcategory": "Escalabilidad",
            "text": "Personalizar la configuración de nodos para grupos de nodos AKS"
        },
        {
            "category": "Operaciones",
            "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
            "link": "https://learn.microsoft.com/azure/aks/concepts-scale",
            "scale": 1,
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Escalabilidad",
            "text": "Utilice el escalador automático de pod horizontal cuando sea necesario"
        },
        {
            "category": "Operaciones",
            "cost": 1,
            "description": "Los nodos más grandes traerán un mayor rendimiento y características como discos efímeros y redes aceleradas, pero aumentarán el radio de explosión y disminuirán la granularidad de escalado.",
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/",
            "severity": "Alto",
            "subcategory": "Escalabilidad",
            "text": "Considere un tamaño de nodo apropiado, ni demasiado grande ni demasiado pequeño"
        },
        {
            "category": "Operaciones",
            "cost": 1,
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits",
            "severity": "Bajo",
            "subcategory": "Escalabilidad",
            "text": "Si es necesario para la escalabilidad, considere agregar más de 5000 nodos"
        },
        {
            "category": "Operaciones",
            "cost": 1,
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks",
            "severity": "Bajo",
            "subcategory": "Escalabilidad",
            "text": "Considere la posibilidad de suscribirse a EventGrid Events para la automatización de AKS"
        },
        {
            "category": "Operaciones",
            "cost": 1,
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations",
            "severity": "Bajo",
            "subcategory": "Escalabilidad",
            "text": "Para una operación de ejecución prolongada en un clúster de AKS, considere la finalización de eventos"
        },
        {
            "category": "Operaciones",
            "cost": 1,
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts",
            "severity": "Bajo",
            "subcategory": "Escalabilidad",
            "text": "Si es necesario, considere la posibilidad de usar Azure Dedicated Hosts para nodos AKS"
        },
        {
            "category": "Operaciones",
            "cost": -1,
            "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
            "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
            "link": "https://learn.microsoft.com/azure/aks/cluster-configuration",
            "scale": 1,
            "severity": "Alto",
            "subcategory": "Almacenamiento",
            "text": "Usar discos de SO efímeros"
        },
        {
            "category": "Operaciones",
            "cost": -1,
            "guid": "fc4972cc-3cd2-45bf-a707-6e9eab4bed32",
            "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types",
            "scale": 1,
            "severity": "Alto",
            "subcategory": "Almacenamiento",
            "text": "Para discos no efímeros, use IOPS altas y discos de sistema operativo más grandes para los nodos cuando ejecute muchos pods / nodo, ya que requiere un alto rendimiento para ejecutar varios pods y generará registros enormes con umbrales de rotación de registros de AKS predeterminados"
        },
        {
            "category": "Operaciones",
            "cost": -1,
            "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
            "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks",
            "scale": 1,
            "severity": "Bajo",
            "subcategory": "Almacenamiento",
            "text": "Para la opción de almacenamiento de hiperrendimiento, use Ultra Disks en AKS"
        },
        {
            "category": "Operaciones",
            "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region",
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Almacenamiento",
            "text": "Evite mantener el estado en el clúster y almacene datos fuera (AzStorage, AzSQL, Cosmos, etc.)"
        },
        {
            "category": "Operaciones",
            "cost": -1,
            "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage",
            "scale": 1,
            "severity": "Medio",
            "subcategory": "Almacenamiento",
            "text": "Si utiliza AzFiles Standard, considere AzFiles Premium y/o ANF por razones de rendimiento"
        },
        {
            "category": "Operaciones",
            "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
            "ha": 1,
            "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support",
            "severity": "Medio",
            "simple": -1,
            "subcategory": "Almacenamiento",
            "text": "Si usa discos y zonas de disponibilidad de Azure, considere la posibilidad de tener grupos de nodos dentro de una zona para el disco LRS con VolumeBindingMode:WaitForFirstConsumer para aprovisionar almacenamiento en la zona correcta o use el disco ZRS para grupos de nodos que abarcan varias zonas"
        }
    ],
    "metadata": {
        "name": "Azure AKS Review"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Medio"
        },
        {
            "name": "Bajo"
        }
    ],
    "status": [
        {
            "description": "Esta comprobación aún no se ha examinado",
            "name": "No verificado"
        },
        {
            "description": "Hay un elemento de acción asociado a esta comprobación",
            "name": "Abrir"
        },
        {
            "description": "Esta comprobación se ha comprobado y no hay más elementos de acción asociados a ella",
            "name": "Cumplido"
        },
        {
            "description": "Recomendación entendida, pero no necesaria por los requisitos actuales",
            "name": "No es necesario"
        },
        {
            "description": "No aplicable para el diseño actual",
            "name": "N/A"
        }
    ]
}
checklists/aks_checklist.en.json METASEP
{
    "items": [
        {
            "category": "Application Deployment",
            "subcategory": "Development",
            "text": "Use canary or blue/green deployments",
            "guid": "785c2fa5-5b56-4ad4-a408-fe72734c476b",
            "cost": 1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/containers/aks/secure-baseline-aks"
        },
        {
            "category": "Application Deployment",
            "subcategory": "Development",
            "text": "If required for AKS Windows workloads HostProcess containers can be used",
            "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a",
            "cost": 1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc"
        },
        {
            "category": "Application Deployment",
            "subcategory": "Development",
            "text": "Use KEDA if running event-driven workloads",
            "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926",
            "scale": 1,
            "simple": -1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda"
        },
        {
            "category": "Application Deployment",
            "subcategory": "Development",
            "text": "Use Dapr to ease microservice development",
            "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58",
            "simple": 1,
            "severity": "Low",
            "link": "https://dapr.io/"
        },
        {
            "category": "Application Deployment",
            "subcategory": "Infrastructure as Code",
            "text": "Use automation through ARM/TF to create your Azure resources",
            "guid": "3acbe04b-be20-49d3-afda-47778424d116",
            "simple": -1,
            "ha": 1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/developer/terraform/create-k8s-cluster-with-tf-and-aks"
        },
        {
            "category": "BC and DR",
            "subcategory": "Disaster Recovery",
            "text": "Schedule and perform DR tests regularly",
            "guid": "36cb45e5-7960-4332-9bdf-8cc23318da61",
            "ha": 1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery"
        },
        {
            "category": "BC and DR",
            "subcategory": "High Availability",
            "text": "Use Azure Traffic Manager or Azure Front Door as a global load balancer for region failover",
            "guid": "170265f4-bb46-4a39-9af7-f317284797b1",
            "ha": 1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region"
        },
        {
            "category": "BC and DR",
            "subcategory": "High Availability",
            "text": "Use Availability Zones if they are supported in your Azure region",
            "guid": "578a219a-46be-4b54-9350-24922634292b",
            "ha": 1,
            "severity": "Medium",
            "graph": "resources | where type=='microsoft.containerservice/managedclusters' | extend compliant= isnotnull(properties.agentPoolProfiles[0].availabilityZones) | distinct id,compliant",
            "link": "https://learn.microsoft.com/azure/aks/availability-zones"
        },
        {
            "category": "BC and DR",
            "subcategory": "High Availability",
            "text": "Use the SLA-backed AKS offering",
            "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
            "cost": -2,
            "ha": 2,
            "severity": "High",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant",
            "link": "https://learn.microsoft.com/azure/aks/uptime-sla"
        },
        {
            "category": "BC and DR",
            "subcategory": "High Availability",
            "text": "Use Disruption Budgets in your pod and deployment definitions",
            "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a",
            "simple": -1,
            "ha": 1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler"
        },
        {
            "category": "BC and DR",
            "subcategory": "High Availability",
            "text": "If using a private registry, configure region replication to store images in multiple regions",
            "guid": "3c763963-7a55-42d5-a15e-401955387e5c",
            "cost": -1,
            "ha": 1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication"
        },
        {
            "category": "BC and DR",
            "subcategory": "Requirements",
            "text": "Define non-functional requirements such as SLAs, RTO (Recovery Time Objective) and RPO (Recovery Point Objective).",
            "guid": "bc14aea6-e65d-48d9-a3ad-c218e6436b06",
            "ha": 1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery"
        },
        {
            "category": "Cost Governance",
            "subcategory": "Cost",
            "text": "Use an external application such as kubecost to allocate costs to different users",
            "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a",
            "cost": 1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost"
        },
        {
            "category": "Cost Governance",
            "subcategory": "Cost",
            "text": "If required scale NodePool snapshots",
            "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21",
            "cost": 1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot"
        },
        {
            "category": "Cost Governance",
            "subcategory": "Cost",
            "text": "Use scale down mode to delete/delallocate nodes",
            "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c",
            "cost": 1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/scale-down-mode"
        },
        {
            "category": "Cost Governance",
            "subcategory": "Cost",
            "text": "When required use multi-instance partioning GPU on AKS Clusters",
            "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc",
            "cost": 1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance"
        },
        {
            "category": "Cost Governance",
            "subcategory": "Cost",
            "text": "If running a Dev/Test cluster use NodePool Start/Stop",
            "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8",
            "cost": 1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools"
        },
        {
            "category": "Governance and Security",
            "subcategory": "Compliance",
            "text": "Use Azure Policy for Kubernetes to ensure cluster compliance",
            "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
            "security": 1,
            "simple": -1,
            "severity": "Medium",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant",
            "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes"
        },
        {
            "category": "Governance and Security",
            "subcategory": "Compliance",
            "text": "Separate applications from the control plane with user/system nodepools",
            "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
            "security": 1,
            "cost": -1,
            "simple": -1,
            "severity": "Medium",
            "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)",
            "link": "https://learn.microsoft.com/azure/aks/use-system-pools"
        },
        {
            "category": "Governance and Security",
            "subcategory": "Compliance",
            "text": "Add taint to your system nodepool to make it dedicated",
            "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea",
            "simple": -1,
            "ha": 1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/use-system-pools"
        },
        {
            "category": "Governance and Security",
            "subcategory": "Compliance",
            "text": "Use a private registry for your images, such as ACR",
            "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf",
            "security": 1,
            "simple": -1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/container-registry/"
        },
        {
            "category": "Governance and Security",
            "subcategory": "Compliance",
            "text": "Scan your images for vulnerabilities",
            "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6",
            "security": 1,
            "cost": -1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/security-center/container-security"
        },
        {
            "category": "Governance and Security",
            "subcategory": "Compliance",
            "text": "Use Azure Security Center to detect security posture vulnerabilities",
            "guid": "cc639637-a652-42ac-89e8-06965388e9de",
            "security": 1,
            "cost": -1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/security-center/container-security"
        },
        {
            "category": "Governance and Security",
            "subcategory": "Compliance",
            "text": "If required configure FIPS",
            "guid": "42d4aefe-2383-470e-b019-c30df24996b2",
            "security": 1,
            "cost": -1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-fips-enabled-node-pool"
        },
        {
            "category": "Governance and Security",
            "subcategory": "Compliance",
            "text": "Define app separation requirements (namespace/nodepool/cluster)",
            "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7",
            "security": 1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation"
        },
        {
            "category": "Governance and Security",
            "subcategory": "Secrets",
            "text": "Store your secrets in Azure Key Vault with the CSI Secrets Store driver",
            "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e",
            "security": 1,
            "simple": -1,
            "severity": "Medium",
            "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure"
        },
        {
            "category": "Governance and Security",
            "subcategory": "Secrets",
            "text": "If using Service Principals for the cluster, refresh credentials periodically (like quarterly)",
            "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66",
            "security": 1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/aks/update-credentials"
        },
        {
            "category": "Governance and Security",
            "subcategory": "Secrets",
            "text": "If required add Key Management Service etcd encryption",
            "guid": "e7ba73a3-0508-4f80-806f-527db30cee96",
            "security": 1,
            "cost": -1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption"
        },
        {
            "category": "Governance and Security",
            "subcategory": "Secrets",
            "text": "If required consider using Confidential Compute for AKS",
            "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31",
            "security": 1,
            "cost": -1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview"
        },
        {
            "category": "Governance and Security",
            "subcategory": "Secrets",
            "text": "Consider using Defender for Containers",
            "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21",
            "security": 1,
            "cost": -1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Identity",
            "text": "Use managed identities instead of Service Principals",
            "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
            "simple": 1,
            "severity": "High",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant",
            "link": "https://learn.microsoft.com/azure/aks/use-managed-identity"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Identity",
            "text": "Integrate authentication with AAD (using the managed integration)",
            "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
            "simple": 1,
            "severity": "Medium",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Identity",
            "text": "Limit access to admin kubeconfig (get-credentials --admin)",
            "guid": "a2fe27b2-e287-401a-8352-beedf79b488d",
            "security": 1,
            "simple": -1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Identity",
            "text": "Integrate authorization with AAD RBAC",
            "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3",
            "security": 1,
            "simple": -1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Identity",
            "text": "Use namespaces for restricting RBAC privilege in Kubernetes",
            "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d",
            "security": 1,
            "simple": -1,
            "ha": 1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Identity",
            "text": "For POD Identity Access Management use Azure AD Workload Identity (preview)",
            "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410",
            "security": 1,
            "simple": -1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Identity",
            "text": "For AKS non-interactive logins use kubelogin (preview)",
            "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3",
            "security": 1,
            "simple": -1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Identity",
            "text": "Disable AKS local accounts",
            "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec",
            "security": 1,
            "simple": -1,
            "severity": "Medium",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Identity",
            "text": "Configure if required Just-in-time cluster access",
            "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6",
            "security": 1,
            "simple": -1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Identity",
            "text": "Configure if required AAD conditional access for AKS",
            "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150",
            "security": 1,
            "simple": -1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Identity",
            "text": "If required for Windows AKS workloads configure gMSA ",
            "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3",
            "security": 1,
            "simple": -1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Identity",
            "text": "For finer control consider using a managed Kubelet Identity",
            "guid": "1f711a74-3672-470b-b8b8-a2148d640d79",
            "security": 1,
            "simple": -1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Best practices",
            "text": "If using AGIC, do not share an AppGW across clusters",
            "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248",
            "security": 1,
            "simple": -1,
            "severity": "Medium",
            "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Best practices",
            "text": "Do not use AKS Application Routing Add-On",
            "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
            "scale": 1,
            "simple": -1,
            "severity": "High",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
            "link": "https://learn.microsoft.com/azure/aks/http-application-routing"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Best practices",
            "text": "For Windows workloads use Accelerated Networking",
            "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9",
            "scale": 1,
            "simple": -1,
            "severity": "Medium",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant",
            "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Best practices",
            "text": "Use the standard ALB (as opposed to the basic one)",
            "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
            "scale": 1,
            "severity": "High",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant",
            "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Best practices",
            "text": "If using Azure CNI, consider using different Subnets for NodePools",
            "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b",
            "security": 1,
            "simple": -2,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Cost",
            "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster",
            "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584",
            "security": 1,
            "simple": -1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/private-link/private-link-overview"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "HA",
            "text": "If hybrid connectivity is required, use 2xER or ER+VPN for better availability",
            "guid": "e8a03f97-8794-468d-96a7-86d60f96c97b",
            "cost": -1,
            "ha": 1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "IPAM",
            "text": "Choose the best CNI network plugin for your requirements (Azure CNI recommended)",
            "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
            "simple": 1,
            "severity": "High",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "IPAM",
            "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node",
            "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6",
            "scale": 1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "IPAM",
            "text": "If using Azure CNI, check the maximum pods/node (default 30)",
            "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673",
            "scale": 1,
            "simple": -1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "IPAM",
            "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)",
            "description": "For internal apps organizations often open the whole AKS subnet in their firewalls. This opens network access to the nodes too, and potentially to the pods as well (if using Azure CNI). If LoadBalancer IPs are in a different subnet, only this one needs to be available to the app clients. Another reason is that if the IP addresses in the AKS subnet are a scarce resource, consuming its IP addresses for services will reduce the maximum scalability of the cluster .",
            "guid": "13c00567-4b1e-4945-a459-c373e7ed6162",
            "security": 1,
            "simple": -1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/internal-lb"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "IPAM",
            "text": "Size the service IP address range accordingly (it is going to limit the cluster scalability)",
            "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba",
            "scale": 1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Operations",
            "text": "If required add your own CNI plugin",
            "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f",
            "security": 1,
            "simple": -2,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/use-byo-cni"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Operations",
            "text": "If required configure Public IP per node in AKS",
            "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364",
            "security": 1,
            "simple": -2,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Scalability",
            "text": "Use an ingress controller to expose web-based apps instead of exposing them with LoadBalancer-type services",
            "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db",
            "scale": 1,
            "simple": -1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/concepts-network"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Scalability",
            "text": "Use Azue NAT Gateway as outboundType for scaling egress traffic",
            "guid": "ccb534e7-416e-4a1d-8e93-533b53199085",
            "scale": 1,
            "simple": -1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/nat-gateway"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Scalability",
            "text": "Use Dynamic allocations of IPs in order to avoid Azure CNI IP exhaustion",
            "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b",
            "scale": 1,
            "simple": -1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Security",
            "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it",
            "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
            "security": 2,
            "simple": -2,
            "severity": "High",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant",
            "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Security",
            "text": "If using a public API endpoint, restrict the IP addresses that can access it",
            "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
            "security": 1,
            "simple": -1,
            "severity": "Medium",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant",
            "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Security",
            "text": "Use private clusters if your requirements mandate it",
            "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d",
            "security": 1,
            "simple": -1,
            "severity": "High",
            "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
            "link": "https://learn.microsoft.com/azure/aks/private-clusters"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Security",
            "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ",
            "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665",
            "security": 1,
            "simple": -1,
            "severity": "Medium",
            "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant",
            "link": "https://learn.microsoft.com/azure/aks/use-network-policies"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Security",
            "text": "Enable a Kubernetes Network Policy option (Calico/Azure)",
            "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
            "security": 1,
            "severity": "High",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant",
            "link": "https://learn.microsoft.com/azure/aks/use-network-policies"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Security",
            "text": "Use Kubernetes network policies to increase intra-cluster security",
            "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e",
            "security": 1,
            "simple": -1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Security",
            "text": "Use a WAF for web workloads (UIs or APIs)",
            "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893",
            "security": 2,
            "cost": -1,
            "simple": -1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Security",
            "text": "Use DDoS Standard in the AKS Virtual Network",
            "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94",
            "security": 2,
            "cost": -2,
            "severity": "Medium",
            "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
            "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Security",
            "text": "If required add company HTTP Proxy",
            "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266",
            "security": 2,
            "cost": -2,
            "severity": "Low",
            "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')",
            "link": "https://learn.microsoft.com/azure/aks/http-proxy"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Security",
            "text": "Consider using a service mesh for advanced microservice communication management",
            "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b",
            "security": 1,
            "simple": -2,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/servicemesh-about"
        },
        {
            "category": "Operations",
            "subcategory": "Alerting",
            "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)",
            "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff",
            "simple": -1,
            "ha": 1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts"
        },
        {
            "category": "Operations",
            "subcategory": "Compliance",
            "text": "Check regularly Azure Advisor for recommendations on your cluster",
            "guid": "337453a3-cc63-4963-9a65-22ac19e80696",
            "simple": -1,
            "ha": 1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started"
        },
        {
            "category": "Operations",
            "subcategory": "Compliance",
            "text": "Develop your YAML manifests with intelligent text editors such as vscode+kubeadvisor",
            "guid": "5388e9de-d167-4dd1-a2b0-ac241b999a64",
            "simple": 1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler"
        },
        {
            "category": "Operations",
            "subcategory": "Compliance",
            "text": "Enable AKS auto-certificate rotation",
            "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced",
            "simple": 1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/certificate-rotation"
        },
        {
            "category": "Operations",
            "subcategory": "Compliance",
            "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature",
            "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370",
            "security": 1,
            "simple": -1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions"
        },
        {
            "category": "Operations",
            "subcategory": "Compliance",
            "text": "Use kured for Linux node upgrades in case you are not using node-image upgrade",
            "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82",
            "simple": -1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/aks/node-updates-kured"
        },
        {
            "category": "Operations",
            "subcategory": "Compliance",
            "text": "Have a regular process to upgrade the cluster node images periodically (weekly, for example)",
            "guid": "139c9580-ade3-426a-ba09-cf157d9f6477",
            "security": 1,
            "simple": -1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade"
        },
        {
            "category": "Operations",
            "subcategory": "Compliance",
            "text": "Consider gitops to deploy applications or cluster configuration to multiple clusters",
            "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments"
        },
        {
            "category": "Operations",
            "subcategory": "Compliance",
            "text": "Consider using AKS command invoke on private clusters",
            "guid": "d7672c26-7602-4482-85a4-14527fbe855c",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/command-invoke"
        },
        {
            "category": "Operations",
            "subcategory": "Compliance",
            "text": "For planned events consider using Node Auto Drain",
            "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b",
            "security": 1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain"
        },
        {
            "category": "Operations",
            "subcategory": "Compliance",
            "text": "Develop own governance practices to make sure no changes are performed by operators in the node RG (aka 'infra RG')",
            "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c",
            "security": 1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/aks/faq"
        },
        {
            "category": "Operations",
            "subcategory": "Compliance",
            "text": "Use custom Node RG (aka 'Infra RG') name",
            "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
            "simple": 1,
            "severity": "Low",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant",
            "link": "https://learn.microsoft.com/azure/aks/cluster-configuration"
        },
        {
            "category": "Operations",
            "subcategory": "Compliance",
            "text": "Do not use deprecated Kubernetes APIs in your YAML manifests",
            "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32",
            "simple": -1,
            "ha": 1,
            "severity": "Medium",
            "link": "https://kubernetes.io/docs/setup/release/notes/"
        },
        {
            "category": "Operations",
            "subcategory": "Compliance",
            "text": "Taint Windows nodes",
            "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed",
            "simple": -1,
            "ha": 1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters"
        },
        {
            "category": "Operations",
            "subcategory": "Compliance",
            "text": "Keep windows containers patch level in sync with host patch level",
            "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e",
            "severity": "Low",
            "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2"
        },
        {
            "category": "Operations",
            "subcategory": "Compliance",
            "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution",
            "description": "Via Diagnostic Settings at the cluster level",
            "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5",
            "cost": -1,
            "ha": 1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/monitor-aks"
        },
        {
            "category": "Operations",
            "subcategory": "Cost",
            "text": "Consider spot node pools for non time-sensitive workloads",
            "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0",
            "cost": 1,
            "simple": -1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/spot-node-pool"
        },
        {
            "category": "Operations",
            "subcategory": "Cost",
            "text": "Consider AKS virtual node for quick bursting",
            "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
            "scale": 1,
            "simple": -1,
            "severity": "Low",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant",
            "link": "https://learn.microsoft.com/azure/aks/concepts-scale"
        },
        {
            "category": "Operations",
            "subcategory": "Monitoring",
            "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)",
            "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956",
            "simple": -1,
            "ha": 1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview"
        },
        {
            "category": "Operations",
            "subcategory": "Monitoring",
            "text": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch)",
            "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
            "simple": -1,
            "ha": 1,
            "severity": "High",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant",
            "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview"
        },
        {
            "category": "Operations",
            "subcategory": "Monitoring",
            "text": "Monitor CPU and memory utilization of the nodes",
            "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669",
            "simple": -1,
            "ha": 1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze"
        },
        {
            "category": "Operations",
            "subcategory": "Monitoring",
            "text": "If using Azure CNI, monitor % of pod IPs consumed per node",
            "guid": "1a4835ac-9422-423e-ae80-b123081a5417",
            "simple": -1,
            "ha": 1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni"
        },
        {
            "category": "Operations",
            "subcategory": "Monitoring",
            "text": "Monitor OS disk queue depth in nodes",
            "description": "I/O in the OS disk is a critical resource. If the OS in the nodes gets throttled on I/O, this could lead to unpredictable behavior, typically ending up in node being declared NotReady",
            "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b",
            "simple": -1,
            "ha": 1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance"
        },
        {
            "category": "Operations",
            "subcategory": "Monitoring",
            "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports",
            "guid": "be209d39-fda4-4777-a424-d116785c2fa5",
            "simple": -1,
            "ha": 1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard"
        },
        {
            "category": "Operations",
            "subcategory": "Monitoring",
            "text": "Subscribe to resource health notifications for your AKS cluster",
            "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9",
            "ha": 1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/aks-resource-health"
        },
        {
            "category": "Operations",
            "subcategory": "Resources",
            "text": "Configure requests and limits in your pod specs",
            "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726",
            "simple": -1,
            "ha": 1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler"
        },
        {
            "category": "Operations",
            "subcategory": "Resources",
            "text": "Enforce resource quotas for namespaces",
            "guid": "769ef669-1a48-435a-a942-223ece80b123",
            "simple": -1,
            "ha": 1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler"
        },
        {
            "category": "Operations",
            "subcategory": "Resources",
            "text": "Ensure your subscription has enough quota to scale out your nodepools",
            "guid": "081a5417-4158-433e-a3ad-3c2de733165c",
            "cost": 1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits"
        },
        {
            "category": "Operations",
            "subcategory": "Scalability",
            "text": "Use the Cluster Autoscaler",
            "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
            "cost": -1,
            "ha": 1,
            "severity": "Medium",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant",
            "link": "https://learn.microsoft.com/azure/aks/concepts-scale"
        },
        {
            "category": "Operations",
            "subcategory": "Scalability",
            "text": "Customize node configuration for AKS node pools",
            "guid": "831c2872-c693-4b39-a887-a561bada49bc",
            "cost": -1,
            "ha": 1,
            "severity": "Low",
            "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant",
            "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration"
        },
        {
            "category": "Operations",
            "subcategory": "Scalability",
            "text": "Use the Horizontal Pod Autoscaler when required",
            "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121",
            "scale": 1,
            "simple": -1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/concepts-scale"
        },
        {
            "category": "Operations",
            "subcategory": "Scalability",
            "text": "Consider an appropriate node size, not too large or too small",
            "description": "Larger nodes will bring higher performance and features such as ephemeral disks and accelerated networking, but they will increase the blast radius and decrease the scaling granularity",
            "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3",
            "cost": 1,
            "severity": "High",
            "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/"
        },
        {
            "category": "Operations",
            "subcategory": "Scalability",
            "text": "If required for scalability consider adding more than 5000 nodes",
            "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d",
            "cost": 1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits"
        },
        {
            "category": "Operations",
            "subcategory": "Scalability",
            "text": "Consider subscribing to EventGrid Events for AKS automation",
            "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb",
            "cost": 1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks"
        },
        {
            "category": "Operations",
            "subcategory": "Scalability",
            "text": "For long running operation on an AKS cluster consider event termination",
            "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d",
            "cost": 1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations"
        },
        {
            "category": "Operations",
            "subcategory": "Scalability",
            "text": "If required consider using Azure Dedicated Hosts for AKS nodes",
            "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021",
            "cost": 1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts"
        },
        {
            "category": "Operations",
            "subcategory": "Storage",
            "text": "Use ephemeral OS disks",
            "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
            "cost": -1,
            "scale": 1,
            "severity": "High",
            "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant",
            "link": "https://learn.microsoft.com/azure/aks/cluster-configuration"
        },
        {
            "category": "Operations",
            "subcategory": "Storage",
            "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds",
            "guid": "fc4972cc-3cd2-45bf-a707-6e9eab4bed32",
            "cost": -1,
            "scale": 1,
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types"
        },
        {
            "category": "Operations",
            "subcategory": "Storage",
            "text": "For hyper performance storage option use Ultra Disks on AKS",
            "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db",
            "cost": -1,
            "scale": 1,
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks"
        },
        {
            "category": "Operations",
            "subcategory": "Storage",
            "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)",
            "guid": "9f7547c1-747d-4c56-868a-714435bd19dd",
            "simple": -1,
            "ha": 1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region"
        },
        {
            "category": "Operations",
            "subcategory": "Storage",
            "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons",
            "guid": "24429eb7-2281-4376-85cc-57b4a4b18142",
            "cost": -1,
            "scale": 1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage"
        },
        {
            "category": "Operations",
            "subcategory": "Storage",
            "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones",
            "guid": "83958a8c-2689-4b32-ab57-cfc64546135a",
            "simple": -1,
            "ha": 1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support"
        }
    ],
    "categories": [
        {
            "name": "Identity and Access Management"
        },
        {
            "name": "Network Topology and Connectivity"
        },
        {
            "name": "BC and DR"
        },
        {
            "name": "Governance and Security"
        },
        {
            "name": "Cost Governance"
        },
        {
            "name": "Operations"
        },
        {
            "name": "Application Deployment"
        }
    ],
    "status": [
        {
            "name": "Not verified",
            "description": "This check has not been looked at yet"
        },
        {
            "name": "Open",
            "description": "There is an action item associated to this check"
        },
        {
            "name": "Fulfilled",
            "description": "This check has been verified, and there are no further action items associated to it"
        },
        {
            "name": "Not required",
            "description": "Recommendation understood, but not needed by current requirements"
        },
        {
            "name": "N/A",
            "description": "Not applicable for current design"
        }
    ],
    "severities": [
        {
            "name": "High"
        },
        {
            "name": "Medium"
        },
        {
            "name": "Low"
        }
    ],
    "metadata": {
        "name": "Azure AKS Review",
        "timestamp": "Feb 24, 2023",
        "state": "GA"
    }
}

checklists/acr_security_checklist.pt.json METASEP
{
    "categories": [
        {
            "name": "Segurança"
        }
    ],
    "items": [
        {
            "category": "Segurança",
            "description": "Desative a exportação de imagens para impedir a exfiltração de dados. Observe que isso impedirá a importação de imagens para outra instância ACR.",
            "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e",
            "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention",
            "severity": "Alto",
            "subcategory": "Proteção de Dados",
            "text": "Desabilitar a exportação de imagem do Registro de Contêiner do Azure"
        },
        {
            "category": "Segurança",
            "description": "Habilite a visibilidade da conformidade de auditoria habilitando o Registro de eContainer da Política do Azure para Azur",
            "guid": "d503547c-d447-4e82-9128-a7100f1cac6d",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy",
            "severity": "Alto",
            "subcategory": "Proteção de Dados",
            "text": "Habilitar Políticas do Azure para o Registro de Contêiner do Azure"
        },
        {
            "category": "Segurança",
            "description": "O Cofre da Chave do Azure (AKV) é usado para armazenar uma chave de assinatura que pode ser utilizada por notação com o plug-in AKV de notação (azure-kv) para assinar e verificar imagens de contêiner e outros artefatos. O ACR (Registro de Contêiner) do Azure permite que você anexe essas assinaturas usando os comandos da CLI az ou oras.",
            "guid": "d345293c-7639-4637-a551-c5c04e401955",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push",
            "severity": "Alto",
            "subcategory": "Proteção de Dados",
            "text": "Assinar e verificar contêineres com notação (notário v2)"
        },
        {
            "category": "Segurança",
            "description": "O Registro de Contêiner do Azure criptografa automaticamente imagens e outros artefatos que você armazena. Por padrão, o Azure criptografa automaticamente o conteúdo do Registro em repouso usando chaves gerenciadas por serviço. Usando uma chave gerenciada pelo cliente, você pode complementar a criptografia padrão com uma camada de criptografia adicional.",
            "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49",
            "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys",
            "severity": "Média",
            "subcategory": "Proteção de Dados",
            "text": "Criptografar o registro com uma chave gerenciada pelo cliente"
        },
        {
            "category": "Segurança",
            "description": "Usar identidades gerenciadas para proteger o acesso RBAC ACRPull/Push de aplicativos cliente",
            "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
            "severity": "Alto",
            "subcategory": "Controle de Identidade e Acesso",
            "text": "Usar identidades gerenciadas para se conectar em vez de entidades de serviço"
        },
        {
            "category": "Segurança",
            "description": "A conta de Administrador local está desabilitada por padrão e não deve ser habilitada. Em vez disso, use métodos de acesso baseados em Token ou RBAC",
            "guid": "be0e38ce-e297-411b-b363-caaab79b198d",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
            "severity": "Alto",
            "subcategory": "Controle de Identidade e Acesso",
            "text": "Desabilitar a autenticação local para acesso ao plano de gerenciamento"
        },
        {
            "category": "Segurança",
            "description": "Desabilitar a conta de Administrador e atribuir funções RBAC a entidades de segurança para operações de Pull/Push do ACR",
            "guid": "387e5ced-126c-4d13-8af5-b20c6998a646",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli",
            "severity": "Alto",
            "subcategory": "Controle de Identidade e Acesso",
            "text": "Atribuir funções AcrPull e AcrPush RBAC em vez de conceder acesso administrativo a entidades de identidade"
        },
        {
            "category": "Segurança",
            "description": "Desativar o acesso anônimo pull/push",
            "guid": "e338997e-41c7-47d7-acf6-a62a1194956d",
            "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access",
            "severity": "Média",
            "subcategory": "Controle de Identidade e Acesso",
            "text": "Desabilitar o acesso pull anônimo"
        },
        {
            "category": "Segurança",
            "description": "A autenticação de token não oferece suporte à atribuição a uma entidade de segurança do AAD. Quaisquer tokens fornecidos podem ser usados por qualquer pessoa que possa acessar o token",
            "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli",
            "severity": "Alto",
            "subcategory": "Controle de Identidade e Acesso",
            "text": "Desabilitar tokens de acesso com escopo de repositório"
        },
        {
            "category": "Segurança",
            "description": "Implantar imagens de contêiner em um ACR atrás de um ponto de extremidade privado em uma rede confiável",
            "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee",
            "severity": "Alto",
            "subcategory": "Controle de Identidade e Acesso",
            "text": "Implantar imagens de um ambiente confiável"
        },
        {
            "category": "Segurança",
            "description": "Somente tokens com uma audiência ACR podem ser usados para autenticação. Usado ao analisar políticas de acesso condicional para ACR",
            "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy",
            "severity": "Média",
            "subcategory": "Controle de Identidade e Acesso",
            "text": "Desabilitar tokens de audiência do ARM do Azure para autenticação"
        },
        {
            "category": "Segurança",
            "description": "Configure uma configuração de diagnóstico para enviar 'repositoryEvents' e 'LoginEvents' para o Log Analytics como o destino central para registro em log e monitoramento. Isso permite que você monitore a atividade do plano de controle no próprio recurso ACR.",
            "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6",
            "link": "https://learn.microsoft.com/azure/container-registry/monitor-service",
            "severity": "Média",
            "subcategory": "Registro em log e monitoramento",
            "text": "Habilitar o log de diagnóstico"
        },
        {
            "category": "Segurança",
            "description": "O serviço dá suporte à desabilitação do acesso à rede pública usando a regra de filtragem de ACL IP de nível de serviço (não NSG ou Firewall do Azure) ou usando um botão de alternância 'Desabilitar Acesso à Rede Pública'",
            "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
            "severity": "Média",
            "subcategory": "Segurança de rede",
            "text": "Controle o acesso à rede de entrada com o Private Link"
        },
        {
            "category": "Segurança",
            "description": "Desabilitar o acesso à rede pública se o acesso à rede de entrada estiver protegido usando o Link Privado",
            "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access",
            "severity": "Média",
            "subcategory": "Segurança de rede",
            "text": "Desabilitar o acesso à Rede Pública"
        },
        {
            "category": "Segurança",
            "description": "Apenas o ACR Premium SKU suporta acesso a Link Privado",
            "guid": "fc833934-8b26-42d6-ac5f-512925498f6d",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus",
            "severity": "Média",
            "subcategory": "Segurança de rede",
            "text": "Usar uma SKU do Registro de Contêiner do Azure que dá suporte ao Private Link (SKU Premium)"
        },
        {
            "category": "Segurança",
            "description": "O Azure Defender para contêineres ou serviço equivalente deve ser usado para verificar imagens de contêiner em busca de vulnerabilidades",
            "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction",
            "severity": "Baixo",
            "subcategory": "Segurança de rede",
            "text": "Habilitar o Defender for Containers para verificar o Registro de Contêiner do Azure em busca de vulnerabilidades"
        },
        {
            "category": "Segurança",
            "description": "Implante código confiável que foi validado e verificado em busca de vulnerabilidades de acordo com as práticas de DevSecOps.",
            "guid": "4451e1a2-d345-4293-a763-9637a551c5c0",
            "severity": "Média",
            "subcategory": "Gerenciamento de vulnerabilidades",
            "text": "Implantar imagens de contêiner validadas"
        },
        {
            "category": "Segurança",
            "description": "Use as versões mais recentes de plataformas, linguagens de programação, protocolos e estruturas suportados.",
            "guid": "4e401955-387e-45ce-b126-cd132af5b20c",
            "severity": "Alto",
            "subcategory": "Gerenciamento de vulnerabilidades",
            "text": "Use plataformas, linguagens, protocolos e frameworks atualizados"
        }
    ],
    "metadata": {
        "name": "Azure Container Registry Security Review"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Média"
        },
        {
            "name": "Baixo"
        }
    ],
    "status": [
        {
            "description": "Esta verificação ainda não foi analisada",
            "name": "Não verificado"
        },
        {
            "description": "Há um item de ação associado a essa verificação",
            "name": "Abrir"
        },
        {
            "description": "Essa verificação foi verificada e não há mais itens de ação associados a ela",
            "name": "Cumprido"
        },
        {
            "description": "Não aplicável ao projeto atual",
            "name": "N/A"
        },
        {
            "description": "Não é necessário",
            "name": "Não é necessário"
        }
    ]
}
checklists/acr_security_checklist.ko.json METASEP
{
    "categories": [
        {
            "name": "안전"
        }
    ],
    "items": [
        {
            "category": "안전",
            "description": "데이터 반출을 방지하기 위해 이미지 내보내기를 비활성화합니다. 이렇게 하면 이미지를 다른 ACR 인스턴스로 가져올 수 없습니다.",
            "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e",
            "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention",
            "severity": "높다",
            "subcategory": "데이터 보호",
            "text": "Azure 컨테이너 레지스트리 이미지 내보내기 사용 안 함"
        },
        {
            "category": "안전",
            "description": "Azure용 Azure Policy를 사용하도록 설정하여 감사 규정 준수 가시성 사용",
            "guid": "d503547c-d447-4e82-9128-a7100f1cac6d",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy",
            "severity": "높다",
            "subcategory": "데이터 보호",
            "text": "Azure 컨테이너 레지스트리에 대한 Azure 정책 사용"
        },
        {
            "category": "안전",
            "description": "AKV(Azure 키 자격 증명 모음)는 컨테이너 이미지 및 기타 아티팩트에 서명하고 확인하기 위해 AKV 플러그 인(azure-kv) 표기법으로 표기하여 사용할 수 있는 서명 키를 저장하는 데 사용됩니다. ACR(Azure 컨테이너 레지스트리)을 사용하면 az 또는 oras CLI 명령을 사용하여 이러한 서명을 연결할 수 있습니다.",
            "guid": "d345293c-7639-4637-a551-c5c04e401955",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push",
            "severity": "높다",
            "subcategory": "데이터 보호",
            "text": "표기법으로 컨테이너 서명 및 확인(Notary v2)"
        },
        {
            "category": "안전",
            "description": "Azure 컨테이너 레지스트리는 사용자가 저장하는 이미지 및 기타 아티팩트를 자동으로 암호화합니다. 기본적으로 Azure는 서비스 관리형 키를 사용하여 미사용 레지스트리 콘텐츠를 자동으로 암호화합니다. 고객 관리형 키를 사용하면 추가 암호화 계층으로 기본 암호화를 보완할 수 있습니다.",
            "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49",
            "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys",
            "severity": "보통",
            "subcategory": "데이터 보호",
            "text": "고객 관리형 키로 레지스트리 암호화"
        },
        {
            "category": "안전",
            "description": "관리 ID를 사용하여 클라이언트 애플리케이션에서 ACRPull/푸시 RBAC 액세스 보호",
            "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
            "severity": "높다",
            "subcategory": "ID 및 액세스 제어",
            "text": "서비스 주체 대신 관리 ID를 사용하여 연결"
        },
        {
            "category": "안전",
            "description": "로컬 관리자 계정은 기본적으로 사용하지 않도록 설정되어 있으며 사용하도록 설정해서는 안 됩니다. 대신 토큰 또는 RBAC 기반 액세스 방법을 사용하십시오.",
            "guid": "be0e38ce-e297-411b-b363-caaab79b198d",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
            "severity": "높다",
            "subcategory": "ID 및 액세스 제어",
            "text": "관리부 액세스에 대한 로컬 인증 비활성화"
        },
        {
            "category": "안전",
            "description": "관리자 계정을 사용하지 않도록 설정하고 ACR 끌어오기/밀어넣기 작업을 위해 보안 주체에 RBAC 역할 할당",
            "guid": "387e5ced-126c-4d13-8af5-b20c6998a646",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli",
            "severity": "높다",
            "subcategory": "ID 및 액세스 제어",
            "text": "ID 주체에 대한 관리 액세스 권한을 부여하는 대신 AcrPull & AcrPush RBAC 역할을 할당합니다."
        },
        {
            "category": "안전",
            "description": "익명 풀/푸시 액세스 비활성화",
            "guid": "e338997e-41c7-47d7-acf6-a62a1194956d",
            "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access",
            "severity": "보통",
            "subcategory": "ID 및 액세스 제어",
            "text": "익명 끌어오기 액세스 사용 안 함"
        },
        {
            "category": "안전",
            "description": "토큰 인증은 AAD 보안 주체에 대한 할당을 지원하지 않습니다. 제공된 모든 토큰은 토큰에 액세스할 수 있는 모든 사용자가 사용할 수 있습니다.",
            "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli",
            "severity": "높다",
            "subcategory": "ID 및 액세스 제어",
            "text": "리포지토리 범위 액세스 토큰 사용 안 함"
        },
        {
            "category": "안전",
            "description": "신뢰할 수 있는 네트워크 내의 프라이빗 엔드포인트 뒤에 있는 ACR에 컨테이너 이미지 배포",
            "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee",
            "severity": "높다",
            "subcategory": "ID 및 액세스 제어",
            "text": "신뢰할 수 있는 환경에서 이미지 배포"
        },
        {
            "category": "안전",
            "description": "ACR 대상 그룹이 있는 토큰만 인증에 사용할 수 있습니다. ACR에 대한 조건부 액세스 정책을 분석할 때 사용됩니다.",
            "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy",
            "severity": "보통",
            "subcategory": "ID 및 액세스 제어",
            "text": "인증을 위해 Azure ARM 대상 토큰을 사용하지 않도록 설정"
        },
        {
            "category": "안전",
            "description": "'repositoryEvents' 및 'LoginEvents'를 로깅 및 모니터링을 위한 중앙 대상으로 Log Analytics에 보내도록 진단 설정을 설정합니다. 이렇게 하면 ACR 리소스 자체에서 컨트롤 플레인 작업을 모니터링할 수 있습니다.",
            "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6",
            "link": "https://learn.microsoft.com/azure/container-registry/monitor-service",
            "severity": "보통",
            "subcategory": "로깅 및 모니터링",
            "text": "진단 로깅 사용"
        },
        {
            "category": "안전",
            "description": "서비스는 서비스 수준 IP ACL 필터링 규칙(NSG 또는 Azure Firewall이 아님)을 사용하거나 '공용 네트워크 액세스 사용 안 함' 토글 스위치를 사용하여 공용 네트워크 액세스를 사용하지 않도록 지원합니다.",
            "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
            "severity": "보통",
            "subcategory": "네트워크 보안",
            "text": "Private Link로 인바운드 네트워크 액세스 제어"
        },
        {
            "category": "안전",
            "description": "Private Link를 사용하여 인바운드 네트워크 액세스가 보호되는 경우 공용 네트워크 액세스 비활성화",
            "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access",
            "severity": "보통",
            "subcategory": "네트워크 보안",
            "text": "공용 네트워크 액세스 사용 안 함"
        },
        {
            "category": "안전",
            "description": "ACR 프리미엄 SKU만 프라이빗 링크 액세스를 지원합니다.",
            "guid": "fc833934-8b26-42d6-ac5f-512925498f6d",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus",
            "severity": "보통",
            "subcategory": "네트워크 보안",
            "text": "프라이빗 링크(프리미엄 SKU)를 지원하는 Azure 컨테이너 레지스트리 SKU 사용"
        },
        {
            "category": "안전",
            "description": "컨테이너용 Azure Defender 또는 동등한 서비스를 사용하여 컨테이너 이미지에서 취약성을 검사해야 합니다.",
            "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction",
            "severity": "낮다",
            "subcategory": "네트워크 보안",
            "text": "컨테이너용 Defender를 사용하도록 설정하여 Azure 컨테이너 레지스트리에서 취약성을 검사합니다."
        },
        {
            "category": "안전",
            "description": "DevSecOps 사례에 따라 취약성에 대해 유효성을 검사하고 검사한 신뢰할 수 있는 코드를 배포합니다.",
            "guid": "4451e1a2-d345-4293-a763-9637a551c5c0",
            "severity": "보통",
            "subcategory": "취약성 관리",
            "text": "검증된 컨테이너 이미지 배포"
        },
        {
            "category": "안전",
            "description": "지원되는 플랫폼, 프로그래밍 언어, 프로토콜 및 프레임워크의 최신 버전을 사용합니다.",
            "guid": "4e401955-387e-45ce-b126-cd132af5b20c",
            "severity": "높다",
            "subcategory": "취약성 관리",
            "text": "최신 플랫폼, 언어, 프로토콜 및 프레임워크 사용"
        }
    ],
    "metadata": {
        "name": "Azure Container Registry Security Review"
    },
    "severities": [
        {
            "name": "높다"
        },
        {
            "name": "보통"
        },
        {
            "name": "낮다"
        }
    ],
    "status": [
        {
            "description": "이 검사는 아직 검토되지 않았습니다.",
            "name": "확인되지 않음"
        },
        {
            "description": "이 검사와 연결된 작업 항목이 있습니다.",
            "name": "열다"
        },
        {
            "description": "이 검사가 확인되었으며 연결된 추가 작업 항목이 없습니다.",
            "name": "성취"
        },
        {
            "description": "현재 디자인에는 적용되지 않음",
            "name": "해당 없음"
        },
        {
            "description": "필요하지 않음",
            "name": "필요하지 않음"
        }
    ]
}
checklists/acr_security_checklist.ja.json METASEP
{
    "categories": [
        {
            "name": "安全"
        }
    ],
    "items": [
        {
            "category": "安全",
            "description": "データの流出を防ぐために画像のエクスポートを無効にします。これにより、別の ACR インスタンスへのイメージのインポートが防止されることに注意してください。",
            "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e",
            "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention",
            "severity": "高い",
            "subcategory": "データ保護",
            "text": "Azure コンテナー レジストリ イメージのエクスポートを無効にする"
        },
        {
            "category": "安全",
            "description": "監査コンプライアンスの可視性を有効にするには、Azur eContainer レジストリの Azure Policy を有効にします。",
            "guid": "d503547c-d447-4e82-9128-a7100f1cac6d",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy",
            "severity": "高い",
            "subcategory": "データ保護",
            "text": "Azure コンテナー レジストリの Azure ポリシーを有効にする"
        },
        {
            "category": "安全",
            "description": "Azure Key Vault (AKV) は、コンテナー イメージやその他の成果物に署名して検証するために、AKV プラグイン (azure-kv) という表記法で使用できる署名キーを格納するために使用されます。Azure コンテナー レジストリ (ACR) を使用すると、az または oras CLI コマンドを使用してこれらの署名をアタッチできます。",
            "guid": "d345293c-7639-4637-a551-c5c04e401955",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push",
            "severity": "高い",
            "subcategory": "データ保護",
            "text": "表記法を使用したコンテナーの署名と検証 (公証人 v2)"
        },
        {
            "category": "安全",
            "description": "Azure コンテナー レジストリでは、格納するイメージやその他の成果物が自動的に暗号化されます。既定では、Azure はサービス マネージド キーを使用して保存時のレジストリ コンテンツを自動的に暗号化します。カスタマー マネージド キーを使用すると、既定の暗号化を追加の暗号化レイヤーで補完できます。",
            "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49",
            "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys",
            "severity": "中程度",
            "subcategory": "データ保護",
            "text": "カスタマー マネージド キーを使用したレジストリの暗号化"
        },
        {
            "category": "安全",
            "description": "マネージド ID を使用して、クライアント アプリケーションからの ACRPull/プッシュ RBAC アクセスをセキュリティで保護する",
            "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
            "severity": "高い",
            "subcategory": "ID とアクセス制御",
            "text": "サービス プリンシパルの代わりにマネージド ID を使用して接続する"
        },
        {
            "category": "安全",
            "description": "ローカル管理者アカウントは既定で無効になっているため、有効にしないでください。代わりにトークンまたは RBAC ベースのアクセス方法を使用する",
            "guid": "be0e38ce-e297-411b-b363-caaab79b198d",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
            "severity": "高い",
            "subcategory": "ID とアクセス制御",
            "text": "管理プレーンアクセスのローカル認証を無効にする"
        },
        {
            "category": "安全",
            "description": "管理者アカウントを無効にし、ACR プル/プッシュ操作のプリンシパルに RBAC ロールを割り当てる",
            "guid": "387e5ced-126c-4d13-8af5-b20c6998a646",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli",
            "severity": "高い",
            "subcategory": "ID とアクセス制御",
            "text": "ID プリンシパルに管理アクセス権を付与するのではなく、AcrPull & AcrPush RBAC ロールを割り当てる"
        },
        {
            "category": "安全",
            "description": "匿名プル/プッシュアクセスを無効にする",
            "guid": "e338997e-41c7-47d7-acf6-a62a1194956d",
            "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access",
            "severity": "中程度",
            "subcategory": "ID とアクセス制御",
            "text": "匿名プルアクセスを無効にする"
        },
        {
            "category": "安全",
            "description": "トークン認証では、AAD プリンシパルへの割り当てはサポートされていません。提供されたトークンは、トークンにアクセスできるすべてのユーザーが使用できます",
            "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli",
            "severity": "高い",
            "subcategory": "ID とアクセス制御",
            "text": "リポジトリスコープのアクセストークンを無効にする"
        },
        {
            "category": "安全",
            "description": "信頼されたネットワーク内のプライベート エンドポイントの背後にある ACR にコンテナー イメージをデプロイする",
            "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee",
            "severity": "高い",
            "subcategory": "ID とアクセス制御",
            "text": "信頼できる環境からイメージを展開する"
        },
        {
            "category": "安全",
            "description": "ACR 対象ユーザーを持つトークンのみを認証に使用できます。ACR の条件付きアクセス ポリシーを分析するときに使用",
            "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy",
            "severity": "中程度",
            "subcategory": "ID とアクセス制御",
            "text": "認証のために Azure ARM 対象ユーザー トークンを無効にする"
        },
        {
            "category": "安全",
            "description": "ログ記録と監視の中心的な宛先として Log Analytics に \"リポジトリ イベント\" と \"ログイン イベント\" を送信するように診断設定を設定します。これにより、ACR リソース自体のコントロール プレーン アクティビティを監視できます。",
            "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6",
            "link": "https://learn.microsoft.com/azure/container-registry/monitor-service",
            "severity": "中程度",
            "subcategory": "ログ記録と監視",
            "text": "診断ログを有効にする"
        },
        {
            "category": "安全",
            "description": "サービスでは、サービス レベルの IP ACL フィルター規則 (NSG または Azure Firewall ではない) を使用するか、[パブリック ネットワーク アクセスを無効にする] トグル スイッチを使用して、パブリック ネットワーク アクセスを無効にすることができます。",
            "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
            "severity": "中程度",
            "subcategory": "ネットワークセキュリティ",
            "text": "プライベート リンクを使用した受信ネットワーク アクセスの制御"
        },
        {
            "category": "安全",
            "description": "受信ネットワーク アクセスが Private Link を使用してセキュリティで保護されている場合は、パブリック ネットワーク アクセスを無効にする",
            "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access",
            "severity": "中程度",
            "subcategory": "ネットワークセキュリティ",
            "text": "パブリックネットワークアクセスを無効にする"
        },
        {
            "category": "安全",
            "description": "ACR プレミアム SKU のみがプライベート リンク アクセスをサポートします",
            "guid": "fc833934-8b26-42d6-ac5f-512925498f6d",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus",
            "severity": "中程度",
            "subcategory": "ネットワークセキュリティ",
            "text": "プライベート リンク (Premium SKU) をサポートする Azure コンテナー レジストリ SKU を使用する"
        },
        {
            "category": "安全",
            "description": "コンテナーまたは同等のサービス用の Azure Defender を使用して、コンテナー イメージの脆弱性をスキャンする必要があります",
            "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction",
            "severity": "低い",
            "subcategory": "ネットワークセキュリティ",
            "text": "コンテナーの Defender が Azure コンテナー レジストリの脆弱性をスキャンできるようにする"
        },
        {
            "category": "安全",
            "description": "DevSecOps プラクティスに従って脆弱性が検証およびスキャンされた信頼できるコードをデプロイします。",
            "guid": "4451e1a2-d345-4293-a763-9637a551c5c0",
            "severity": "中程度",
            "subcategory": "脆弱性管理",
            "text": "検証済みのコンテナー イメージをデプロイする"
        },
        {
            "category": "安全",
            "description": "サポートされているプラットフォーム、プログラミング言語、プロトコル、およびフレームワークの最新バージョンを使用します。",
            "guid": "4e401955-387e-45ce-b126-cd132af5b20c",
            "severity": "高い",
            "subcategory": "脆弱性管理",
            "text": "最新のプラットフォーム、言語、プロトコル、フレームワークを使用する"
        }
    ],
    "metadata": {
        "name": "Azure Container Registry Security Review"
    },
    "severities": [
        {
            "name": "高い"
        },
        {
            "name": "中程度"
        },
        {
            "name": "低い"
        }
    ],
    "status": [
        {
            "description": "このチェックはまだ確認されていません",
            "name": "未確認"
        },
        {
            "description": "このチェックに関連付けられているアクションアイテムがあります",
            "name": "開ける"
        },
        {
            "description": "このチェックは検証済みであり、それ以上のアクションアイテムは関連付けられていません",
            "name": "達成"
        },
        {
            "description": "現在のデザインには適用できません",
            "name": "該当なし"
        },
        {
            "description": "必須ではありません",
            "name": "必須ではありません"
        }
    ]
}
checklists/acr_security_checklist.es.json METASEP
{
    "categories": [
        {
            "name": "Seguridad"
        }
    ],
    "items": [
        {
            "category": "Seguridad",
            "description": "Desactive la exportación de imágenes para evitar la exfiltración de datos. Tenga en cuenta que esto evitará la importación de imágenes a otra instancia de ACR.",
            "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e",
            "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention",
            "severity": "Alto",
            "subcategory": "Protección de datos",
            "text": "Deshabilitar la exportación de imágenes de Azure Container Registry"
        },
        {
            "category": "Seguridad",
            "description": "Habilitar la visibilidad del cumplimiento de auditoría habilitando Azure Policy for Azur eContainer Registry",
            "guid": "d503547c-d447-4e82-9128-a7100f1cac6d",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy",
            "severity": "Alto",
            "subcategory": "Protección de datos",
            "text": "Habilitación de directivas de Azure para Azure Container Registry"
        },
        {
            "category": "Seguridad",
            "description": "Azure Key Vault (AKV) se usa para almacenar una clave de firma que se puede utilizar mediante notación con el complemento de notación AKV (azure-kv) para firmar y comprobar imágenes de contenedor y otros artefactos. Azure Container Registry (ACR) permite adjuntar estas firmas mediante los comandos az u oras CLI.",
            "guid": "d345293c-7639-4637-a551-c5c04e401955",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push",
            "severity": "Alto",
            "subcategory": "Protección de datos",
            "text": "Firmar y verificar contenedores con notación (Notario v2)"
        },
        {
            "category": "Seguridad",
            "description": "Azure Container Registry cifra automáticamente las imágenes y otros artefactos que almacena. De forma predeterminada, Azure cifra automáticamente el contenido del Registro en reposo mediante claves administradas por el servicio. Mediante el uso de una clave administrada por el cliente, puede complementar el cifrado predeterminado con una capa de cifrado adicional.",
            "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49",
            "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys",
            "severity": "Medio",
            "subcategory": "Protección de datos",
            "text": "Cifrar el registro con una clave administrada por el cliente"
        },
        {
            "category": "Seguridad",
            "description": "Usar identidades administradas para proteger el acceso ACRPull/Push RBAC desde aplicaciones cliente",
            "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
            "severity": "Alto",
            "subcategory": "Identidad y control de acceso",
            "text": "Usar identidades administradas para conectarse en lugar de entidades de servicio"
        },
        {
            "category": "Seguridad",
            "description": "La cuenta de administrador local está deshabilitada de forma predeterminada y no debe habilitarse. En su lugar, use métodos de acceso basados en token o RBAC",
            "guid": "be0e38ce-e297-411b-b363-caaab79b198d",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity",
            "severity": "Alto",
            "subcategory": "Identidad y control de acceso",
            "text": "Deshabilitar la autenticación local para el acceso al plano de administración"
        },
        {
            "category": "Seguridad",
            "description": "Deshabilitar la cuenta de administrador y asignar roles RBAC a las entidades de seguridad para las operaciones de extracción/inserción de ACR",
            "guid": "387e5ced-126c-4d13-8af5-b20c6998a646",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli",
            "severity": "Alto",
            "subcategory": "Identidad y control de acceso",
            "text": "Asigne roles RBAC de AcrPull y AcrPush en lugar de otorgar acceso administrativo a las entidades de identidad"
        },
        {
            "category": "Seguridad",
            "description": "Deshabilitar el acceso anónimo de extracción/inserción",
            "guid": "e338997e-41c7-47d7-acf6-a62a1194956d",
            "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access",
            "severity": "Medio",
            "subcategory": "Identidad y control de acceso",
            "text": "Deshabilitar el acceso de extracción anónimo"
        },
        {
            "category": "Seguridad",
            "description": "La autenticación de token no admite la asignación a una entidad de seguridad de AAD. Cualquier token proporcionado puede ser utilizado por cualquier persona que pueda acceder al token.",
            "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli",
            "severity": "Alto",
            "subcategory": "Identidad y control de acceso",
            "text": "Deshabilitar tokens de acceso con ámbito de repositorio"
        },
        {
            "category": "Seguridad",
            "description": "Implementar imágenes de contenedor en un ACR detrás de un punto de conexión privado dentro de una red de confianza",
            "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee",
            "severity": "Alto",
            "subcategory": "Identidad y control de acceso",
            "text": "Implementar imágenes desde un entorno de confianza"
        },
        {
            "category": "Seguridad",
            "description": "Solo se pueden usar tokens con una audiencia ACR para la autenticación. Se utiliza al analizar directivas de acceso condicional para ACR",
            "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy",
            "severity": "Medio",
            "subcategory": "Identidad y control de acceso",
            "text": "Deshabilitar tokens de audiencia de Azure ARM para la autenticación"
        },
        {
            "category": "Seguridad",
            "description": "Configure una configuración de diagnóstico para enviar 'repositoryEvents' y 'LoginEvents' a Log Analytics como destino central para el registro y la supervisión. Esto le permite supervisar la actividad del plano de control en el propio recurso ACR.",
            "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6",
            "link": "https://learn.microsoft.com/azure/container-registry/monitor-service",
            "severity": "Medio",
            "subcategory": "Registro y supervisión",
            "text": "Habilitar el registro de diagnósticos"
        },
        {
            "category": "Seguridad",
            "description": "El servicio admite la deshabilitación del acceso a la red pública mediante el uso de la regla de filtrado de ACL de IP de nivel de servicio (no NSG o Azure Firewall) o mediante un conmutador de alternancia \"Deshabilitar acceso a redes públicas\"",
            "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link",
            "severity": "Medio",
            "subcategory": "Seguridad de red",
            "text": "Controle el acceso a la red entrante con Private Link"
        },
        {
            "category": "Seguridad",
            "description": "Deshabilitar el acceso a la red pública si el acceso a la red entrante está protegido mediante Private Link",
            "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access",
            "severity": "Medio",
            "subcategory": "Seguridad de red",
            "text": "Deshabilitar el acceso a la red pública"
        },
        {
            "category": "Seguridad",
            "description": "Solo la SKU Premium de ACR admite el acceso a Private Link",
            "guid": "fc833934-8b26-42d6-ac5f-512925498f6d",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus",
            "severity": "Medio",
            "subcategory": "Seguridad de red",
            "text": "Use una SKU de Azure Container Registry que admita Private Link (SKU Premium)"
        },
        {
            "category": "Seguridad",
            "description": "Azure Defender para contenedores o el servicio equivalente se debe usar para examinar imágenes de contenedor en busca de vulnerabilidades",
            "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction",
            "severity": "Bajo",
            "subcategory": "Seguridad de red",
            "text": "Habilitar Defender for Containers para examinar Azure Container Registry en busca de vulnerabilidades"
        },
        {
            "category": "Seguridad",
            "description": "Implemente código de confianza validado y analizado en busca de vulnerabilidades de acuerdo con las prácticas de DevSecOps.",
            "guid": "4451e1a2-d345-4293-a763-9637a551c5c0",
            "severity": "Medio",
            "subcategory": "Gestión de vulnerabilidades",
            "text": "Implementar imágenes de contenedor validadas"
        },
        {
            "category": "Seguridad",
            "description": "Utilice las últimas versiones de plataformas, lenguajes de programación, protocolos y marcos compatibles.",
            "guid": "4e401955-387e-45ce-b126-cd132af5b20c",
            "severity": "Alto",
            "subcategory": "Gestión de vulnerabilidades",
            "text": "Utilice plataformas, lenguajes, protocolos y marcos actualizados"
        }
    ],
    "metadata": {
        "name": "Azure Container Registry Security Review"
    },
    "severities": [
        {
            "name": "Alto"
        },
        {
            "name": "Medio"
        },
        {
            "name": "Bajo"
        }
    ],
    "status": [
        {
            "description": "Esta comprobación aún no se ha examinado",
            "name": "No verificado"
        },
        {
            "description": "Hay un elemento de acción asociado a esta comprobación",
            "name": "Abrir"
        },
        {
            "description": "Esta comprobación se ha comprobado y no hay más elementos de acción asociados a ella",
            "name": "Cumplido"
        },
        {
            "description": "No aplicable para el diseño actual",
            "name": "N/A"
        },
        {
            "description": "No es necesario",
            "name": "No es necesario"
        }
    ]
}
checklists/acr_security_checklist.en.json METASEP
{
    "items": [
        {
            "category": "Security",
            "subcategory": "Data Protection",
            "text": "Disable Azure Container Registry image export",
            "description": "Disable image export to prevent data exfiltration. Note that this will prevent image import of images into another ACR instance.",
            "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention"
        },
        {
            "category": "Security",
            "subcategory": "Data Protection",
            "text": "Enable Azure Policies for Azure Container Registry",
            "description": "Enable audit compliance visibility by enabling Azure Policy for Azure Container Registry",
            "guid": "d503547c-d447-4e82-9128-a7100f1cac6d",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy"
        },
        {
            "category": "Security",
            "subcategory": "Data Protection",
            "text": "Sign and Verify containers with notation (Notary v2)",
            "description": "The Azure Key Vault (AKV) is used to store a signing key that can be utilized by\ufffdnotation\ufffdwith the notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach these signatures using the\ufffdaz\ufffdor\ufffdoras\ufffdCLI commands.",
            "guid": "d345293c-7639-4637-a551-c5c04e401955",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push"
        },
        {
            "category": "Security",
            "subcategory": "Data Protection",
            "text": "Encrypt registry with a customer managed key",
            "description": "Azure Container Registry automatically encrypts images and other artifacts that you store. By default, Azure automatically encrypts the registry content at rest by using service-managed keys. By using a customer-managed key, you can supplement default encryption with an additional encryption layer.",
            "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Control",
            "text": "Use Managed Identities to connect instead of Service Principals",
            "description": "Use managed identities to secure ACRPull/Push RBAC access from client applications",
            "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Control",
            "text": "Disable local authentication for management plane access",
            "description": "The local Administrator account is disabled by default and should not be enabled. Use either Token or RBAC-based access methods instead",
            "guid": "be0e38ce-e297-411b-b363-caaab79b198d",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Control",
            "text": "Assign AcrPull & AcrPush RBAC roles rather than granting Administrative access to identity principals",
            "description": "Disable Administrator account and assign RBAC roles to principals for ACR Pull/Push operations",
            "guid": "387e5ced-126c-4d13-8af5-b20c6998a646",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Control",
            "text": "Disable Anonymous pull access",
            "description": "Disable anonymous pull/push access",
            "guid": "e338997e-41c7-47d7-acf6-a62a1194956d",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Control",
            "text": "Disable repository-scoped access tokens",
            "description": "Token authentication doesn't support assignment to an AAD principal. Any tokens provided are able to be used by anyone who can access the token",
            "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Control",
            "text": "Deploy images from a trusted environment",
            "description": "Deploy container images to an ACR behind a Private endpoint within a trusted network",
            "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee",
            "severity": "High"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Control",
            "text": "Disable Azure ARM audience tokens for authentication",
            "description": "Only tokens with an ACR audience can be used for authentication. Used when enabling Conditional access policies for ACR",
            "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy"
        },
        {
            "category": "Security",
            "subcategory": "Logging and Monitoring",
            "text": "Enable diagnostics logging",
            "description": "Set up a diagnostic setting to send 'repositoryEvents' & 'LoginEvents' to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the ACR resource itself.",
            "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/container-registry/monitor-service"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Control inbound network access with Private Link",
            "description": "Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch",
            "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Disable Public Network access",
            "description": "Disable public network access if inbound network access is secured using Private Link",
            "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Use an Azure Container Registry SKU that supports Private Link (Premium SKU)",
            "description": "Only the ACR Premium SKU supports Private Link access",
            "guid": "fc833934-8b26-42d6-ac5f-512925498f6d",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Enable Defender for Containers to scan Azure Container Registry for vulnerabilities",
            "description": "Azure Defender for containers or equivalent service should be used to scan container images for vulnerabilities",
            "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction"
        },
        {
            "category": "Security",
            "subcategory": "Vulnerability Management",
            "text": "Deploy validated container images",
            "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.",
            "guid": "4451e1a2-d345-4293-a763-9637a551c5c0",
            "severity": "Medium"
        },
        {
            "category": "Security",
            "subcategory": "Vulnerability Management",
            "text": "Use up-to-date platforms, languages, protocols and frameworks",
            "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.",
            "guid": "4e401955-387e-45ce-b126-cd132af5b20c",
            "severity": "High"
        }
    ],
    "categories": [
        {
            "name": "Security"
        }
    ],
    "status": [
        {
            "name": "Not verified",
            "description": "This check has not been looked at yet"
        },
        {
            "name": "Open",
            "description": "There is an action item associated to this check"
        },
        {
            "name": "Fulfilled",
            "description": "This check has been verified, and there are no further action items associated to it"
        },
        {
            "name": "N/A",
            "description": "Not applicable for current design"
        },
        {
            "name": "Not required",
            "description": "Not required"
        }
    ],
    "severities": [
        {
            "name": "High"
        },
        {
            "name": "Medium"
        },
        {
            "name": "Low"
        }
    ],
    "metadata": {
        "name": "Azure Container Registry Security Review",
        "timestamp": "Feb 13 2023",
        "state": "Preview"
    }
}
checklists/README.md METASEP
# Azure Review Checklist Samples

In this repo you can find localized versions of checklists used to review different technologies in Azure.

If you notice any error or omission, please send a pull request **against the English version** of the checklist files, since the other localizations are automatically generated using [Azure Translator](https://azure.microsoft.com/services/cognitive-services/translator/)
SUPPORT.md METASEP
# Support

## How to file issues and get help  

This project uses GitHub Issues to track bugs and feature requests. Please search the existing [issues](https://github.com/Azure/review-checklists/issues) before filing new issues to avoid duplicates.  For new issues, file your bug or feature request as a new issue in [Issues](https://github.com/Azure/review-checklists/issues).

If the requested change concerns a specific checklist, please make sure to mention the relevant `.en.json` filename in the issue description.


SECURITY.md METASEP
<!-- BEGIN MICROSOFT SECURITY.MD V0.0.5 BLOCK -->

## Security

Microsoft takes the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations, which include [Microsoft](https://github.com/Microsoft), [Azure](https://github.com/Azure), [DotNet](https://github.com/dotnet), [AspNet](https://github.com/aspnet), [Xamarin](https://github.com/xamarin), and [our GitHub organizations](https://opensource.microsoft.com/).

If you believe you have found a security vulnerability in any Microsoft-owned repository that meets [Microsoft's definition of a security vulnerability](https://learn.microsoft.com/previous-versions/tn-archive/cc751383(v=technet.10)), please report it to us as described below.

## Reporting Security Issues

**Please do not report security vulnerabilities through public GitHub issues.**

Instead, please report them to the Microsoft Security Response Center (MSRC) at [https://msrc.microsoft.com/create-report](https://msrc.microsoft.com/create-report).

If you prefer to submit without logging in, send email to [secure@microsoft.com](mailto:secure@microsoft.com).  If possible, encrypt your message with our PGP key; please download it from the [Microsoft Security Response Center PGP Key page](https://www.microsoft.com/msrc/pgp-key-msrc).

You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message. Additional information can be found at [microsoft.com/msrc](https://www.microsoft.com/msrc). 

Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:

  * Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
  * Full paths of source file(s) related to the manifestation of the issue
  * The location of the affected source code (tag/branch/commit or direct URL)
  * Any special configuration required to reproduce the issue
  * Step-by-step instructions to reproduce the issue
  * Proof-of-concept or exploit code (if possible)
  * Impact of the issue, including how an attacker might exploit the issue

This information will help us triage your report more quickly.

If you are reporting for a bug bounty, more complete reports can contribute to a higher bounty award. Please visit our [Microsoft Bug Bounty Program](https://microsoft.com/msrc/bounty) page for more details about our active programs.

## Preferred Languages

We prefer all communications to be in English.

## Policy

Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https://www.microsoft.com/msrc/cvd).

<!-- END MICROSOFT SECURITY.MD BLOCK -->
README.md METASEP
[![GitHub Super-Linter](https://github.com/Azure/review-checklists/workflows/Lint%20Code%20Base/badge.svg)](https://github.com/marketplace/actions/super-linter)

# Azure Review Checklists

![](./pictures/overview.png)

Quick links for using the checklists in this repo:

- [Latest release of the Excel spreadsheet](https://github.com/Azure/review-checklists/releases/latest/download/review_checklist.xlsm)
- [https://aka.ms/ftaaas](https://aka.ms/ftaaas) for a web frontend (check out our sister repo [https://github.com/Azure/fta-aas](https://github.com/Azure/fta-aas)).

Summary of checklists supported and the respective responsible owners:

| Checklist | Status | CodeOwners |
| --- | --- | --- |
| LZ  | GA | [@alejandra8481](https://github.com/alejandra8481) [@anbengts](https://github.com/anbengts) [@sdolgin](https://github.com/sdolgin) [@akasnik](https://github.com/akasnik) [@Kiwibayer](https://github.com/Kiwibayer) |
| AKS | GA | [@msftnadavbh](https://github.com/msftnadavbh) [@seenu433](https://github.com/seenu433) [@erjosito](https://github.com/erjosito) |
| AVD | GA | [@igorpag](https://github.com/igorpag) [@mikewarr](https://github.com/mikewarr) [@bagwyth](https://github.com/bagwyth) |
| Multitenancy | GA | [@arsenvlad](https://github.com/arsenvlad) [@johndowns](https://github.com/johndowns) [@cherchyk](https://github.com/cherchyk) |
| Security | GA | [@mgodfrey50](https://github.com/mgodfrey50) [@rudneir2](https://github.com/rudneir2) |
| AVS | Preview | [@fskelly](https://github.com/fskelly) [@mgodfrey50](https://github.com/mgodfrey50) [@Kiwibayer](https://github.com/Kiwibayer) [@robinher](https://github.com/robinher) |
| SAP | Preview | [@AlastairMorrison](https://github.com/AlastairMorrison) [@videshmukh](https://github.com/videshmukh) |
| API Management | Preview | [@andredewes](https://github.com/andredewes) [@seenu433](https://github.com/seenu433) |

## What is an Azure Design Review?

A common request of many organizations starting with public cloud is having their design double-checked to make sure that best practices are being followed. One of the teams in Microsoft providing this kind of design reviews and guidance is [FastTrack for Azure (FTA)](https://azure.microsoft.com/programs/azure-fasttrack/), part of Azure Engineering at Microsoft.

When doing Azure design reviews (or any review for that matter), Microsoft employees (such as FastTrack for Azure engineers) and Microsoft partners often leverage Excel spreadsheets as the medium of choice to document findings and track design improvements and recommendations. A problem with Excel spreadsheets is that they are not easily made subject to revision control. Additionally, team collaboration with branching, issues, pull requests, reviews and others is difficult at best, impossible in most cases.

## Why this repository?

This repo separates the actual review checklist content from the presentation layer, so that the JSON-formated checklist that can be subject to version control, and it can then be imported into an Excel spreadsheet by means of Visual Basic for Applications (VBA) macros for easier handling (not all of us like working natively with JSON). The provided [Checklist Review Spreadsheet](https://github.com/Azure/review-checklists/releases/latest/download/review_checklist.xlsm) leverages code to interpret JSON from the VBA module in [https://github.com/VBA-tools/VBA-JSON/](https://github.com/VBA-tools/VBA-JSON/), from which there is a copy in this repo to be self-contained (make sure you use the latest version though). The [Checklist Review Spreadsheet](https://github.com/Azure/review-checklists/releases/latest/download/review_checklist.xlsm) includes some macros (find the source code both in the spreadsheet as well as [here](./spreadsheet/Sheet1.cls)), which are accessible from control buttons in the main sheet.

Note: the VBA code in the spreadsheet does not work on Excel for Mac, due to some critical missing libraries.

Additionally, a Github action in this repository translates after every commit the English version of the checklist to additional languages (Japanese, Korean, Spanish and Brazilian Portuguese), using the cognitive service [Azure Translator](https://azure.microsoft.com/services/cognitive-services/translator/). See an example of a translated checklist in [aks_checklist.ja.json](./checklists/aks_checklist.ja.json)

## Reporting errors and contributing

Please feel free to open an issue or create a PR if you find any error or missing information in the checklists, following the [Contributing guidelines](./CONTRIBUTING.md)

## Using the spreadsheet for Azure reviews

1. Download the Excel spreadsheet from the [latest release](https://github.com/Azure/review-checklists/releases/latest/download/review_checklist.xlsm) to your PC

2. Use the dropdown lists to select the technology and language you would like to do your review

![](./pictures/spreadsheet_screenshot.png)

3. Click the control button "Import latest checklist". After you accept the verification message, the spreadsheet will load the latest version of the selected technology and language

4. (Optional) If you are going to distribute the spreadsheet to users that cannot work with macros (for example, either because of security reasons or because they use Office for Mac), save a version of the spreadsheet in xlsx format (instead of xlsm). Note that disabling macros will result in the spreadsheet losing its ability to import updated versions of the checklist or JSON-based Azure Resource Graph query results

5. Go row by row, and set the "Status" field to one of the available options, and write any remarks in the "Comments" field (such as why a recommendation is not relevant, or who will fix the open item)

   1. Since there are many rows in a review, it is recommended proceeding in chunks: either going area after area (first "Networking", then "Security", etc) or starting with the "High" priority elements and afterwards moving down to "Medium" and "Low"
   1. If any recommendation is not clear, there is a "More Info" link with more context information.
   1. **IMPORTANT**: design decisions are not a checkbox exercise, but a series of compromises. It is OK deviating from certain recommendations, if the implications are clear (for example, sacrificing security with operational simplicity or lower cost for non-critical applications)

6. Check the "Dashboard" worksheet for a graphical representation of the review progress

![](./pictures/spreadsheet_screenshot_dashboard.png)

## Security settings running macros

There are some settings that you might need to change in your system to run macro-enabled Excel spreadsheets. When initially opening the file you may see the following error, which prevents Excel from loading:

> Excel cannot open the file 'review_checklist.xlsm' because the file format or file extension is not valid. Verify that the file has not been corrupted and that the file extension matches the format of the file.

In other cases the file opens with the following message, which prevents you from being able to load the checklist items:

![macro warning in excel](./pictures/macro_warning.png)

### Unblock file or add an exception to Windows Security

1. You might need to unblock the file from the file properties in the Windows File Explorer, so that you can use the macros required to import the checklist content from github.com:

![how to unblock a file to run macros](./pictures/unblock.png)

2. Additionally, you might want to add the macro-enabled spreadsheet file to the list of exceptions in Windows Security (in the Virus & Threat Protection section):

![how to add an exception to windows security 1](./pictures/defender_settings_1.png)
![how to add an exception to windows security 2](./pictures/defender_settings_2.png)
![how to add an exception to windows security 3](./pictures/defender_settings_3.png)
![how to add an exception to windows security 4](./pictures/defender_settings_4.png)

## Using the spreadsheet to generate JSON checklist files (advanced)

If you wish to do contributions to the checklists, one option is the following:

1. Load up the latest version of the checklist you want to modify
2. Do the required modifications to the checklist items
3. Push the button "Export checklist to JSON" in the **"Advanced"** section of controls in the checklist. Store your file in your local file system, and upload it to the [checklists folder](./checklists) of this Github repo (use the format `<technology>_checklist.en.json`, for example, `lz_checklist.en.json`)
4. This will create a PR, and will be reviewed by the corresponding aprovers.

## Using Azure Resource Graph to verify Azure environments (advanced)

Some of the checks have associated [Azure Resource Graph](https://learn.microsoft.com/azure/governance/resource-graph/overview) queries, which return a list of related resources and a compliance status for each. Resource Graph queries enable objective verification of the associated checks and make filling out the spreadsheet easier by collecting some environment details for you. 

Along with the spreadsheet, this repo includes the script [checklist_graph.sh](./scripts/checklist_graph.sh). This script will run the graph queries stored in the JSON checklists and produce an output that can easily be copied and pasted into the spreadsheet, or alternatively generate a JSON file that can then be imported to the spreadsheet.

See the [checklist_graph.sh README file](./scripts/README.md) for more information about how to use [checklist_graph.sh](./scripts/checklist_graph.sh).

## Disclaimer

- This is not official Microsoft documentation or software.
- This is not an endorsement or a sign-off of an architecture or a design.
- This code-sample is provided "AS IT IS" without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.
- This sample is not supported under any Microsoft standard support program or service.
- Microsoft further disclaims all implied warranties, including, without limitation, any implied warranties of merchantability or fitness for a particular purpose.
- The entire risk arising out of the use or performance of the sample and documentation remains with you.
- In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the script be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample or documentation, even if Microsoft has been advised of the possibility of such damages

CONTRIBUTING.md METASEP
# Contributing

For any contribution, please create the proposed changes in a forked repo, and open a Pull Request against the main branch.

## Changes to existing checklists

There are two ways in which you can send changes to the existing checklists:

### Option 1: Modifying the JSON file directly

Modify the relevant `.en.json` file in the `checklists` directory, either in the Github portal or in your own clone with your favorite text editor, and send a Pull Request to the main branch. Each checklist (LZ, AKS, AVD) has a predefined set of owners that will review the individual PRs (see [CODEOWNERS](./CODEOWNERS)).

> **Warning**
> Do not modify the non-English versions of the checklists, since they are dynamically generated

If you are adding new rules, make sure to include unique GUIDs for each. You can use your favorite GUID generation tool to generate new random GUIDs, such as [https://guidgenerator.com/](https://guidgenerator.com/)

### Option 2: Using the spreadsheet to create new JSON files

Optionally, you can use the provided Excel spreadsheet to do changes to the existing checklists:

1. Open the [Excel spreadsheet](./spreadsheet/review_checklist.xlsm), and load the English version of any of the supported checklist
1. Do any change you want. Some remarks:
    - If adding or changing hyperlinks, it is OK putting the raw URL in the corresponding cell. The export mechanism will take care of removing the localization
    - If adding new rules, you can leave the GUID field empty, the export mechanism will generate a new random GUID
1. Export the checklist to a JSON file (using the button "Export checklist to JSON"), which you can check into the Github repository (refer to [Option 1: Modifying the JSON file directly](#option-1-modifying-the-jSON-file-directly))

## Adding Resource Graph queries

When adding Azure Resource Graph queries, the query is expected to return two fields:

* `id`: ARM ID of the resource being evaluated
* `compliant`: boolean value that indicates whether the resource is compliant or non-compliant with the recommendation

For example, take the recommendation in the AKS checklist "Use Availability Zones if supported in your Azure region". The following query creates the `compliant` column based on a boolean check, and returns both the `id` and the new `compliant` columns:

```
where type=='microsoft.containerservice/managedclusters' | extend compliant= isnotnull(zones) | distinct id,compliant
```

## Changes to the spreadsheet

Modify the file [spreadsheet/review_checklist.xlsm](./spreadsheet/review_checklist.xlsm) in your own fork, and send a Pull Request to the main branch. Make sure not to check in temporary files (by closing the Excel spreadsheet before git-adding the files).

## Forking the repo

If you fork this repository you will need to create an Azure Translator in Azure, and define three secrets in your repo so that automatic translation works:

- `AZURE_TRANSLATOR_ENDPOINT`: containing the endpoint URL for your Azure Translator. You will find this in the Azure Portal, in the blade "Keys and Endpoint" of your Azure Translator, under "Text Translation".
- `AZURE_TRANSLATOR_REGION` (optional): containing the region for your Azure Translator. You will find this in the Azure Portal, in the blade "Keys and Endpoint" of your Azure Translator, under "Location/Region".
- `AZURE_TRANSLATOR_SUBSCRIPTION_KEY`: the subscription key for your Azure Translator. You will find this in the Azure Portal, in the blade "Keys and Endpoint" of your Azure Translator, under "Key 1" or "Key 2" (you can use either of them).

CODE_OF_CONDUCT.md METASEP
# Microsoft Open Source Code of Conduct

This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).

Resources:

- [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/)
- [Microsoft Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/)
- Contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with questions or concerns

CODEOWNERS METASEP
# This is a comment.
# Each line is a file pattern followed by one or more owners.

# These owners will be the default owners for everything in
# the repo. Unless a later match takes precedence,
# @global-owner1 and @global-owner2 will be requested for
# review when someone opens a pull request.
# *       @global-owner1 @global-owner2
*   @erjosito @sdolgin

# Order is important; the last matching pattern takes the most
# precedence. When someone opens a pull request that only
# modifies JS files, only @js-owner and not the global
# owner(s) will be requested for a review.
# *.js    @js-owner

# You can also use email addresses if you prefer. They'll be
# used to look up users just like we do for commit author
# emails.
# *.go docs@example.com

# Teams can be specified as code owners as well. Teams should
# be identified in the format @org/team-name. Teams must have
# explicit write access to the repository. In this example,
# the octocats team in the octo-org organization owns all .txt files.
# *.txt @octo-org/octocats

# In this example, @doctocat owns any files in the build/logs
# directory at the root of the repository and any of its
# subdirectories.
/checklists/ @erjosito @Kiwibayer @sdolgin
/checklists/lz_checklist.en.json @alejandra8481 @anbengts @akasnik @brsteph @sdolgin
/checklists/aks_checklist.en.json @erjosito @seenu433 @msftnadavbh
/checklists/avd_checklist.en.json @igorpag @mikewarr @bagwyth
/checklists/avs_checklist.en.json @fskelly @mgodfrey50 @Kiwibayer @robinher
/checklists/security_checklist.en.json @mgodfrey50 @rudneir2 @sikovatc
/checklists/sap_checklist.en.json @AlastairMorrison @videshmukh @mottach
/checklists/multitenancy_checklist.en.json @arsenvlad @johndowns @cherchyk
/checklists/appsvc_security_checklist.en.json @jelledruyts @xstof
/checklists/sqldb_security_checklist.en.json @igorpag
/checklists/apim_checklist.en.json @seenu433 @andredewes
/checklists/blob_storage_security_checklist.en.json @chgeuer
/checklists/acr_security_checklist.en.json @cbellee
/scripts/ @fskelly @erjosito
/spreadsheet/ @erjosito
/web/ @erjosito

# The `docs/*` pattern will match files like
# `docs/getting-started.md` but not further nested files like
# `docs/build-app/troubleshooting.md`.
# docs/*  docs@example.com

# In this example, @octocat owns any file in an apps directory
# anywhere in your repository.
# apps/ @octocat

# In this example, @doctocat owns any file in the `/docs`
# directory in the root of your repository and any of its
# subdirectories.
# /docs/ @doctocat

# In this example, @octocat owns any file in the `/apps` 
# directory in the root of your repository except for the `/apps/github` 
# subdirectory, as its owners are left empty.
# /apps/ @octocat
# /apps/github 

scripts/process_checklist.sh METASEP
#!/bin/bash
#########################################################
# This script triggers post-processing of changes
#    in a checklist file, that should be provided as
#    first argument.
# This script should be run from the root directory of
#    of the repo
# Example:
#    ./scripts/process_checklist ./checklists/aks_checklist.en.json
#########################################################
checklist_file=$1
if [[ -z $checklist_file ]]; then
    echo "You should supply a parameter with the path location of the checklist to process"
    exit 0
else
    if [[ -e $checklist_file ]]; then
        file_beginning=${checklist_file:0:12}
        if [[ "$file_beginning" == "./checklists" ]]; then
            file_end=${checklist_file: -8}
            if [[ "$file_end" == ".en.json" ]]; then
                echo "Processing file $checklist_file..."
                # Sort original checklist
                python3 ./scripts/sort_checklist.py --input-file "$checklist_file"
                # Timestamp original checklist
                python3 ./scripts/timestamp_checklist.py --input-file "$checklist_file"
                # Translate checklist
                python3 ./scripts/translate.py --input-file "$checklist_file"
                # Generate macro-free spreadsheets
                python3 ./scripts/update_excel_openpyxl.py --checklist-file="$checklist_file" --find-all --excel-file="./spreadsheet/review_checklist_empty.xlsx" --output-name-is-input-name --output-path="./spreadsheet/macrofree/" --verbose
                # Create Azure Monitor Workbook
                python3 ./scripts/workbook_create.py --checklist-file "$checklist_file" --output-path ./workbooks --blocks-path ./workbooks/blocks
            else
                echo "File $checklist_file doesn't have the right extension '.en.json'"
            fi
        else
            echo "File $checklist_file doesnt start with './checklists' but with $file_beginning, are you sure you are in the right folder?"
            exit 0
        fi
    else
        echo "File $checklist_file could not be found"
        exit 0
    fi
fi
scripts/checklist_graph.sh METASEP
#!/usr/bin/zsh

##################################################################################################
# This script downloads the latest JSON checklist in https://github.com/Azure/review-checklists
#    and performs the Azure Resource Graph queries defined in the tests.
# It will output a the test results (successful/failed) for each check in the list, that can be
#    then sent to a file or copy/pasted in a different tool (like the sample spreadsheet in this
#    repository).
# The script can take some arguments:
#    -b/--base-url: URL where to download the JSON file from. Defaults to https://raw.githubusercontent.com/Azure/review-checklists/main/samples/
#    -t/--technology: technology to verify. Accepted values lz, aks and avd. Defaults to aks
#    -c/--category: category to filter the tests. Accepted values: 0 to (number_of_categories-1)
#    -l/--list-categories: instead of running Azure Graph queries, it only displays the categories in the file and its corresponding indexes
#    -f/--format: can be either text or json (defaults to json)
#    --file: custom JSON file (otherwise the latest checklist is downloaded from Github)
#    -mg/--management-group: per default the Azure Resource Graph queries are scoped to the current subscription, you can enlarge the scope to a given management group
#    -d/--debug: increase verbosity
#
# Example:
#       ./checklist_graph.sh -l -t=aks
#       ./checklist_graph.sh -c=0 -t=aks -f=text
#       ./checklist_graph.sh -t=aks -f=json >graph_results.json
#
# Jose Moreno, October 2021
###################################################################################################


# Defaults
base_url="https://raw.githubusercontent.com/Azure/review-checklists/main/checklists/"
technology="aks"
category_id=""
debug="no"
help="no"
error_file=/tmp/error.json
list_categories=no
check_text=no
format=json
mg=""
filename=""
no_empty=yes

# Color format variables
normal="\e[0m"
underline="\e[4m"
red="\e[31m"
green="\e[32m"
yellow="\e[33m"
blue="\e[34m"
bold="\e[1m"

# Parse arguments
for i in "$@"
do
     case $i in
          -b=*|--base-url=*)
               base_url="${i#*=}"
               shift # past argument=value
               ;;
          -t=*|--technology=*)
               technology="${i#*=}"
               shift # past argument=value
               ;;
          -l*|--list-categories*)
               list_categories="yes"
               shift # past argument with no value
               ;;
          -t*|--list-technologies*)
               list_technologies="yes"
               shift # past argument with no value
               ;;
          -c=*|--category=*)
               category_id="${i#*=}"
               shift # past argument=value
               ;;
          -f=*|--format=*)
               format="${i#*=}"
               shift # past argument=value
               ;;
          -mg=*|--management-group=*)
               mg="${i#*=}"
               shift # past argument=value
               ;;
          --file=*)
               filename="${i#*=}"
               shift # past argument=value
               ;;
          -d*|--debug*)
               debug="yes"
               shift # past argument with no value
               ;;
          --help|-h)
               help=yes
               shift # past argument with no value
               ;;
          *)
                    # unknown option
               ;;
     esac
done
set -- "${POSITIONAL[@]}" # restore positional parameters

# Get list of checklists
checklist_list=$(curl -s "https://api.github.com/repos/Azure/review-checklists/git/trees/2ef1d5ca7dbdc4a3125901ab1364be0338f390a1?recursive=true" | jq -r '.tree[].path' | grep en.json | sed -e 's/_checklist.en.json//')

# Print help message
if [[ "$help" == "yes" ]]
then
    script_name="$0"
     echo "Please run this script as:
        $script_name [--list-technologies] [--base-url=<base_url>] [--debug]
        $script_name [--list-categories] [--base-url=<base_url>] [--technology=<technology>] [--debug]
        $script_name [--technology=<technology>] [--category=<category_id>] [--format=json|text] [--management-group=<mgmt_group>] [--base-url=<base_url>] [--debug]
        $script_name [--technology=<technology>] [--category=<category_id>] [--file=<json_file_path>] [--format=json|text] [--management-group=<mgmt_group>] [--base-url=<base_url>] [--debug]"
    exit
fi

# If outputing to JSON, we dont want output that breaks the JSON syntax
if [[ "$format" == "json" ]]; then
    check_text=no
    no_empty=yes
    if [[ "$debug" == "yes" ]]; then echo "DEBUG: Output is $output, setting --check-text=${check_text} and --no-empty=${no_empty}..."; fi
fi

# If a Management Group was specified, use it in the az graph command
if [[ -z "$mg" ]]; then
    mg_option=""
else
    mg_option="-m $mg"
    if [[ "$debug" == "yes" ]]; then echo "DEBUG: Setting management group $mg as scope for the az graph query commands..."; fi
fi

# Download checklist from Github or upload from file
if [[ -n "$filename" ]]
then
    if [[ -e "$filename" ]]
    then
        if [[ "$debug" == "yes" ]]; then echo "DEBUG: Getting JSON content from filename $filename..."; fi
        checklist_json=$(cat "$filename")
    else
        echo "ERROR: File $filename could not be found"
        exit
    fi
else
    # Set URL and download checklist from base URL
    checklist_url="${base_url}${technology}_checklist.en.json"
    if [[ "$debug" == "yes" ]]; then echo "DEBUG: Getting checklist from $checklist_url..."; fi
    checklist_json=$(curl -s "$checklist_url")
fi

# If in "list_technologies" mode, just get the categories part:
if [[ "$list_technologies" == "yes" ]]
then
    while IFS= read -r checklist; do
        checklist_url="${base_url}${checklist}_checklist.en.json"
        graph_query_no=$(curl -s "$checklist_url" | jq -r '.items[].graph' | grep -v -e '^null$' | wc -l)
        echo "$checklist ($graph_query_no graph queries)"
    done <<< "$checklist_list"
    exit 0
fi

# If in "list_categories" mode, just get the categories part:
if [[ "$list_categories" == "yes" ]]
then
    i=0
    category_list=$(echo $checklist_json | jq -r '.categories[].name')
    while IFS= read -r category; do
        echo "${i}: - $category"
        i=$(($i+1))
    done <<< "$category_list"
    exit 0
fi

# If there is a category specified, get the name
if [[ -n "$category_id" ]]
then
    category_name=$(echo $checklist_json | jq -r '.categories['$category_id'].name')
    if [[ "$debug" == "yes" ]]; then echo "DEBUG: Performing tests for category $category_name..."; fi
else
    if [[ "$debug" == "yes" ]]; then echo "DEBUG: Performing tests for all categories..."; fi
fi

# Get a list of the items
if [[ "$debug" == "yes" ]]; then echo "DEBUG: Extracting information from JSON..."; fi
if [[ -n "$category_name" ]]
then
    graph_query_list=$(print -r "$checklist_json" | jq -r '.items[] | select(.category=="'$category_name'") | .graph')
    category_list=$(print -r "$checklist_json" | jq -r '.items[] | select(.category=="'$category_name'") | .category')
    text_list=$(print -r "$checklist_json" | jq -r '.items[] | select(.category=="'$category_name'") | .text')
    guid_list=$(print -r "$checklist_json" | jq -r '.items[] | select(.category=="'$category_name'") | .guid')
    if [[ -z "$text_list" ]]; then
        echo "ERROR: error processing JSON file, please verify the syntax"
        exit
    fi
    if [[ "$debug" == "yes" ]]; then echo "DEBUG: $(echo $text_list | wc -l) tests found in the checklist for category ${category_name}."; fi
else
    graph_query_list=$(print -r "$checklist_json" | jq -r '.items[] | .graph')
    category_list=$(print -r "$checklist_json" | jq -r '.items[] | .category')
    text_list=$(print -r "$checklist_json" | jq -r '.items[] | .text')
    guid_list=$(print -r "$checklist_json" | jq -r '.items[] | .guid')
    if [[ -z "$text_list" ]]; then
        echo "ERROR: error processing JSON file, please verify the syntax"
        exit
    fi
    if [[ "$debug" == "yes" ]]; then echo "DEBUG: $(echo $text_list | wc -l) tests found in the checklist."; fi
fi

# Debug
if [[ "$debug" == "yes" ]]; then 
    echo "DEBUG: $(echo $graph_query_list | wc -l) graph queries found in the checklist."
    # echo "$graph_success_list"
fi
if [[ "$debug" == "yes" ]]; then 
    echo "DEBUG: $(echo $graph_failure_list | wc -l) graph queries for failure tests found in the checklist."
    # echo "$graph_failure_list"
fi
if [[ "$debug" == "yes" ]]; then 
    echo "DEBUG: $(echo $guid_list | wc -l) GUIDs with a defined Graph query found in the checklist"
    # echo "$guid_list"
fi

# Make sure the Azure CLI extension for Azure Resource Graph is installed and updated
extension_name=resource-graph
extension_version=$(az extension show -n $extension_name --query version -o tsv 2>/dev/null)
if [[ -z "$extension_version" ]]
then
    if [[ "$debug" == "yes" ]]; then echo "DEBUG: Azure CLI extension $extension_name not found, installing now..."; fi
    az extension add -n $extension_name -o none 2>/dev/null
else
    if [[ "$debug" == "yes" ]]; then echo "DEBUG: Azure CLI extension $extension_name found with version $extension_version, trying to upgrade..."; fi
    az extension update -n $extension_name -o none 2>/dev/null
fi
extension_version=$(az extension show -n $extension_name --query version -o tsv 2>/dev/null)
if [[ "$debug" == "yes" ]]; then echo "DEBUG: Azure CLI extension $extension_name running with version $extension_version"; fi

# Run queries
i=0
query_no=0
this_category_name=""
json_output="{ \"metadata\": {\"format\": \"${format}\", \"timestamp\": \"$(date)\"}, \"checks\": ["
json_output_empty="yes"
while IFS= read -r graph_query; do
    i=$(($i+1))
    this_guid=$(echo $guid_list | head -$i | tail -1)
    if [[ "$debug" == "yes" ]]; then echo "DEBUG: Processing check item $i, GUID '$this_guid'..."; fi
    if [[ "$this_guid" == "null" ]] && [[ "$output" == "json" ]]; then
        if [[ "$debug" == "yes" ]]; then echo "ERROR: GUID not defined for check number $i"; fi
    fi
    # Print header category if required
    # if [[ "$this_category_name" != "$(echo $category_list | head -$i | tail -1)" ]]
    # then
    #     this_category_name=$(echo $category_list | head -$i | tail -1)
    #     if [[ "$format" == "text" ]]; then
    #         echo "${bold}${blue}CHECKLIST CATEGORY: ${this_category_name}${normal}"
    #     fi
    # fi
    # Check if there is any query
    if [[ "$graph_query" == "null" ]]; then
        if [[ "$no_empty" != "yes" ]]; then
            # Print title if required
            if [[ "$check_text" == "yes" ]]; then
                this_text=$(echo $text_list | head -$i | tail -1)
                echo "${blue}CHECKLIST ITEM: ${this_text}:${normal}"
            fi
            # Print output
            echo "N/A"
        fi
    else
        # Increase counter
        query_no=$(($query_no+1))
        # Print title if text format
        if [[ "$format" == "text" ]]; then
            this_text=$(echo $text_list | head -$i | tail -1)
            echo "${blue}CHECKLIST ITEM: ${this_text}:${normal}"
        fi
        rm $error_file 2>/dev/null; touch $error_file
        if [[ "$debug" == "yes" ]]; then echo "DEBUG: Running query \"$graph_query\"..."; fi
        # The query should return one line per result. Fields ID and Compliant and mandatory
        query_result=$(az graph query -q "$graph_query" ${(z)mg_option} -o tsv 2>$error_file --query 'data[].[id,compliant]' | sort -u)
        rm $error_file 2>/dev/null; touch $error_file
        while IFS= read -r result
        do
            if [[ -n "$result" ]]; then
                # Extract the tab-separated fields (ID and compliant)
                resource_id=$(echo $result | cut -f 1)
                result_id=$(echo $result | cut -f 2)
                # Print output in color if format is text
                if [[ "$format" == "text" ]]; then
                    if [[ "$result_id" == "1" ]]; then
                        result_text="compliant"
                        color=$green
                    elif [[ "$result_id" == "0" ]]; then
                        result_text="non-compliant"
                        color=$red;
                    else
                        if [[ "$debug" == "yes" ]]; then echo "WARNING: unknown result code returned: $result_id..."; fi
                        result_text="undefined"
                        color=$blue;
                    fi
                    echo "${resource_id}: ${color}${result_text}${normal} "
                # With JSON format, we append a line for each found compliant/non-compliant resource
                elif [[ "$format" == "json" ]]; then
                    if [[ "$result_id" == "1" ]]; then
                        result_bool=true
                    elif [[ "$result_id" == "0" ]]; then
                        result_bool=false
                    else
                        if [[ "$debug" == "yes" ]]; then echo "WARNING: unknown result code returned \"$result_id\""; fi
                        result_bool=undefined
                    fi
                    if [[ -n "$resource_id" ]]; then
                        # First, add a comma if this wasnt the first element
                        if [[ "$json_output_empty" == "yes" ]]; then
                            json_output_empty="no"
                        else
                            json_output+=", "
                        fi
                        # Add an item per compliant resource
                        json_output+="{\"guid\": \"$this_guid\", \"compliant\": \"$result_bool\", \"id\": \"$resource_id\"}"
                    fi
                else
                    echo "ERROR: format $format not recognized, only 'json' or 'text' are accepted formats"
                fi
            else
                if [[ "$debug" == "yes" ]]; then echo "WARNING: Graph query returned an empty result"; fi
            fi
        done < <(printf '%s\n' "$query_result")
    fi
done <<< "$graph_query_list"

if (( $query_no == 0 )); then
    echo "ERROR: The checklist for the selected technology does not contain any graph query"
fi

# Close JSON format
json_output+=" ] }"

# If output is JSON, print check_results variable
if [[ "$format" == "json" ]]; then
    echo "$json_output"
fi

scripts/aks_graph_results.json METASEP
{
  "metadata": {
    "format": "json",
    "timestamp": "Fri Mar 18 09:14:09 CET 2022"
  },
  "checks": [
    {
      "guid": "578a219a-46be-4b54-9350-24922634292b",
      "compliant": "false",
      "id": "/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist"
    },
    {
      "guid": "71d41e36-10cc-457b-9a4b-1410d4395898",
      "compliant": "false",
      "id": "/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist"
    },
    {
      "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a",
      "compliant": "true",
      "id": "/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist"
    },
    {
      "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4",
      "compliant": "false",
      "id": "/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist"
    },
    {
      "guid": "a0f61565-9de5-458f-a372-49c831112dbd",
      "compliant": "true",
      "id": "/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist"
    },
    {
      "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba",
      "compliant": "false",
      "id": "/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist"
    },
    {
      "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2",
      "compliant": "false",
      "id": "/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist"
    },
    {
      "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a",
      "compliant": "false",
      "id": "/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist"
    },
    {
      "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d",
      "compliant": "true",
      "id": "/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist"
    },
    {
      "guid": "ba7da7be-9952-4914-a384-5d997cb39132",
      "compliant": "true",
      "id": "/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist"
    },
    {
      "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1",
      "compliant": "false",
      "id": "/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist"
    },
    {
      "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4",
      "compliant": "false",
      "id": "/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist"
    },
    {
      "guid": "24367b33-6971-45b1-952b-eee0b9b588de",
      "compliant": "false",
      "id": "/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist"
    },
    {
      "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0",
      "compliant": "false",
      "id": "/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist"
    },
    {
      "guid": "c755562f-2b4e-4456-9b4d-874a748b662e",
      "compliant": "false",
      "id": "/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist"
    },
    {
      "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812",
      "compliant": "false",
      "id": "/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist"
    },
    {
      "guid": "90ce65de-8e13-4f9c-abd4-69266abca264",
      "compliant": "false",
      "id": "/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist"
    }
  ]
}

scripts/README.md METASEP
# Review Checklist Scripts (preview)

In this folder you can find scripts supporting the review process.

## Azure Resource Graph reviews

The script [checklist_graph.sh](./checklist_graph.sh) can do the automated graph queries associated to checklist items in the checklists in the [../checklists](../checklists) folder. It has multiple modes of operations, the following sections show some examples of how to use it.

### Installation

> :warning: ***The `checklist_graph.sh` script must be run from a Bash environment shell. If you are using Azure Cloud Shell be sure to select the correct environment.***

> Note: In case you are in the context of a private AKS cluster (API server is private), there is no restriction to use Azure Cloud Shell to run the `checklist_graph.sh` script. 
> Make sure that the identity (the one Azure Cloud Shell uses) used to execute the checklist_graph script, [has appropriate rights in Azure RBAC with at least read access to the resources you want to query](https://learn.microsoft.com/azure/governance/resource-graph/overview#permissions-in-azure-resource-graph) (in this case AKS cluster(s)). 
> Without at least read permissions to the Azure object or object group, results won't be returned.
> The script just queries the Azure Resource Graph API and does not communicate with the API Server(s) of your clusters(s).
	
You can download the script in any environment that supports Azure CLI, such as the [Azure Cloud Shell](https://shell.azure.com). In order to download the script and prepare it for execution you can run this command:

```Shell
wget –quiet –output-document ./checklist_graph.sh https://raw.githubusercontent.com/Azure/review-checklists/main/scripts/checklist_graph.sh
chmod +xr ./checklist_graph.sh
```

### Basic usage

You can run the script to produce a JSON-formatted output of all the checklist items with documented Azure Resource Graph queries. For example, to run the Azure Resource Graph queries for the AKS checklist:

```Shell
./checklist_graph.sh --technology=aks --format=json > ./graph_results.json
```

The previous command will generate a JSON file `./graph_results.json`. You can go now to your Excel spreadsheet. Make sure you have loaded up the corresponding checklist already (AKS in this example), and use the Advanced command "Import Graph Results" to import this file into the spreadsheet:

![Advanced buttons](../pictures/advanced_buttons.png)

The "Comments" column of the spreadsheet will fill in with the results of the Azure Graph Queries, and display resource IDs that are compliant or non-compliant with the recommendation, as the following picture shows (in this case, after importing the results of the Azure Resource Graph checks on a subscription with a single AKS cluster):

![Advanced ](../pictures/graph_import_result.png)

The following sections will show more advanced usage of the script.

### Listing the available checklists available

You can run the script to find out which checklists are available. Note that not all checklists will contain Azure Resource Graph queries:

```
./checklist_graph.sh --list-technologies
```

### Listing the existing categories in a checklist

You can run the script as well to generate a more human-readable output. For example, run this in order to execute analysis scoped to a single category. Command:

```
./checklist_graph.sh --techonology=aks --list-categories
```

Output:

```
0: - Identity and Access Management
1: - Network Topology and Connectivity
2: - BC and DR
3: - Governance and Security
4: - Cost Governance
5: - Operations
6: - Application Deployment
```

### Doing a review for all categories with console output

This example shows how to run this for analysis on all categories in a single subscription. The output can be copy/pasted to the Excel spreadsheet (category by category). Command:

```
./checklist_graph.sh --technology=aks --format=text
```

Output (truncated for brevity). Note that the resources are formatted with the syntax `<resource-group>/<resource-name>`:

```
CHECKLIST ITEM: Use Availability Zones if supported in your Azure region:
/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist: non-compliant
CHECKLIST ITEM: Use the SLA-backed AKS offering:
/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist: non-compliant
CHECKLIST ITEM: Use managed identities instead of Service Principals:
/subscriptions/e7da9914-9b05-4891-893c-546cb7b0422e/resourceGroups/akstest/providers/Microsoft.ContainerService/managedClusters/checklist: compliant
...
```

### Run the graph queries scoped to a Management Group

All previous commands can be scoped to a management group, instead of to a single subscription by using the `--management-group` flag, to specify a management group name (make sure to specify the **name** and not the **display name** of the management group). Example:

```
./checklist_graph.sh --technology=aks --category=1 --management-group=mymgmtgroup
```

The output is the same as the previous examples, depending on which flags are used.

### Troubleshoot

To troubleshoot the execution of the `checklist_graph.sh` script you can run the command:

```
./checklist_graph.sh --technology=aks --format=json --debug
```

and check the debug messages being written in the Azure Cloud Shell console

scripts/workbook_create.py METASEP
######################################################################
#
# This script reads the checklist items from the latest checklist file
#   in Github (or from a local file) and generates an Azure Monitor
#   workbook in JSON format.
# 
# Last updated: February 2023
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import uuid

# Get input arguments
parser = argparse.ArgumentParser(description='Generate Azure Monitor workbook from Azure Review Checklist')
parser.add_argument('--checklist-file', dest='checklist_file', action='store',
                    help='You can optionally supply a JSON file containing the checklist you want to dump to the Excel spreadsheet. Otherwise it will take the latest file from Github')
parser.add_argument('--only-english', dest='only_english', action='store_true', default=False,
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--find-all', dest='find_all', action='store_true', default=False,
                    help='if checklist files are specified, find all the languages for the given checklists (default: False)')
parser.add_argument('--technology', dest='technology', action='store',
                    help='If you do not supply a JSON file with the checklist, you need to specify the technology from which the latest checklist will be downloaded from Github')
parser.add_argument('--output-file', dest='output_file', action='store',
                    help='You can optionally supply an Excel file where the checklist will be saved, otherwise it will be updated in-place')
parser.add_argument('--output-path', dest='output_path', action='store',
                    help='Folder where to store the results (using the same name as the input_file)')
parser.add_argument('--blocks-path', dest='blocks_path', action='store',
                    help='Folder where the building blocks to build the workbook are stored)')
parser.add_argument('--create-arm-template', dest='create_arm_template', action='store_true',
                    default=False,
                    help='create an ARM template, additionally to the workbook JSON (default: False)')
parser.add_argument('--category', dest='category', action='store',
                    help='if the workbook should be restricted to a category containing the specified string')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()
checklist_file = args.checklist_file
technology = args.technology

block_workbook = None
block_link = None
block_section = None
block_query = None
block_text = None

query_size = 4 # 0: medium, 1: small, 4: tiny

# Workbook building blocks
def load_building_blocks():

    # Define the blocks as global variables
    global block_workbook
    global block_link
    global block_section
    global block_query
    global block_text
    global block_arm

    # Set folder where to load from
    if args.blocks_path:
        blocks_path = args.blocks_path
        if args.verbose:
            print ("DEBUG: Setting building block folder to {0}".format(blocks_path))
    else:
        print("ERROR: please use the argument --blocks-path to specify the location of the workbook building blocks.")
        sys.exit(1)

    # Load initial workbook building block
    block_file = os.path.join(blocks_path, 'block_workbook.json')
    if args.verbose:
        print ("DEBUG: Loading file {0}...".format(block_file))
    try:
        with open(block_file) as f:
            block_workbook = json.load(f)
    except Exception as e:
        print("ERROR: Error when opening JSON workbook building block", block_file, "-", str(e))
        sys.exit(0)
    # Load link building block
    block_file = os.path.join(blocks_path, 'block_link.json')
    if args.verbose:
        print ("DEBUG: Loading file {0}...".format(block_file))
    try:
        with open(block_file) as f:
            block_link = json.load(f)
    except Exception as e:
        print("ERROR: Error when opening JSON workbook building block", block_file, "-", str(e))
        sys.exit(0)
    # Load itemgroup (aka section) building block
    block_file = os.path.join(blocks_path, 'block_itemgroup.json')
    if args.verbose:
        print ("DEBUG: Loading file {0}...".format(block_file))
    try:
        with open(block_file) as f:
            block_section = json.load(f)
    except Exception as e:
        print("ERROR: Error when opening JSON workbook building block", block_file, "-", str(e))
        sys.exit(0)
    # Load query building block
    block_file = os.path.join(blocks_path, 'block_query.json')
    if args.verbose:
        print ("DEBUG: Loading file {0}...".format(block_file))
    try:
        with open(block_file) as f:
            block_query = json.load(f)
    except Exception as e:
        print("ERROR: Error when opening JSON workbook building block", block_file, "-", str(e))
        sys.exit(0)
    # Load text building block
    block_file = os.path.join(blocks_path, 'block_text.json')
    if args.verbose:
        print ("DEBUG: Loading file {0}...".format(block_file))
    try:
        with open(block_file) as f:
            block_text = json.load(f)
    except Exception as e:
        print("ERROR: Error when opening JSON workbook building block", block_file, "-", str(e))
        sys.exit(0)
    # Load ARM template building block
    block_file = os.path.join(blocks_path, 'block_arm.json')
    if args.verbose:
        print ("DEBUG: Loading file {0}...".format(block_file))
    try:
        with open(block_file) as f:
            block_arm = json.load(f)
    except Exception as e:
        print("ERROR: Error when opening JSON ARM template building block", block_file, "-", str(e))
        sys.exit(0)

# Function that corrects format issues in the queries stored in JSON
def fix_query_format(query_string):
    if query_string:
        query_string = str(query_string).replace('\\\\', '\\')  # Replace a double escaping inverted bar ('\\\\') through a single one ('\')
        return query_string
    else:
        return None

# Function that transforms a JSON string to be included in an ARM template
def serialize_data(workbook_string):
    if workbook_string:
        # Escape double quotes
        workbook_string = str(workbook_string).replace('"', '\"')
        # Escape escape characters
        # workbook_string = str(workbook_string).replace('\\', '\\\\')
        # Undo the scaping for the newline character (otherwise the markdown in the workbook would look wrong).
        # Note that this might impact newline characters in queries!
        # workbook_string = str(workbook_string).replace('\\\\n', '\\n')
        return workbook_string
    else:
        return None

# Main function to generate the workbook JSON
def generate_workbook(output_file, checklist_data):

    # Initialize an empty workbook
    workbook = json.loads(json.dumps(block_workbook))
    workbook_title = "## " + checklist_data['metadata']['name']
    if args.category:
        workbook_title += ' - ' + args.category[0].upper() + args.category[1:]
    workbook_title += "\n---\n\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists)."
    workbook['items'][0]['content']['json'] = workbook_title

    # Decide whether we will match in the category, or subcategory, and update the corresponding variables
    if args.category:
        if args.verbose:
            print("DEBUG: creating tab list with subcategories list for categories containing the term {0}...".format(args.category))
        tab_name_field = 'subcategory'
        tab_title_list = [x["subcategory"] for x in checklist_data.get("items") if (args.category.lower() in str(x["category"]).lower())]
        tab_title_list = list(set(tab_title_list))
    else:
        if args.verbose:
            print("DEBUG: creating tab list with categories...")
        tab_name_field = 'category'
        tab_title_list = [x["name"] for x in checklist_data.get("categories")]
    if args.verbose:
        print("DEBUG: created tab list: {0}".format(str(tab_title_list)))

    # Generate one tab in the workbook for each category/subcategory
    tab_id = 0
    query_id = 0
    tab_dict = {}
    
    for tab_title in tab_title_list:
        tab_dict[tab_title] = tab_id  # We will use this dict later to know where to put each query
        tab_id += 1
        # Create new link
        new_link = block_link.copy()
        new_link['id'] = str(uuid.uuid4())   # RANDOM GUID
        new_link['linkLabel'] = tab_title
        new_link['subTarget'] = 'category' + str(tab_id)
        new_link['preText'] = tab_title
        # Create new section
        new_section = block_section.copy()
        new_section['name'] = 'category' + str(tab_id)
        new_section['conditionalVisibility']['value'] = 'category' + str(tab_id)
        new_section['content']['items'][0]['content']['json'] = "## " + tab_title
        new_section['content']['items'][0]['name'] = 'category' + str(tab_id) + 'title'
        # Add link and query to workbook
        # if args.verbose:
        #     print()
        #     print ("DEBUG: Adding link: {0}".format(json.dumps(new_link)))
        #     print ("DEBUG: Adding section: {0}".format(json.dumps(new_section)))
        #     print("DEBUG: Workbook so far: {0}".format(json.dumps(workbook)))
        workbook['items'][2]['content']['links'].append(new_link.copy())   # I am getting crazy with Python variable references :(
        # Add section to workbook
        new_new_section=json.loads(json.dumps(new_section.copy()))
        workbook['items'].append(new_new_section)

    if args.verbose:
        print("DEBUG: category dictionary generated: {0}".format(str(tab_dict)))

    # For each checklist item, add a query to the workbook
    for item in checklist_data.get("items"):
        # Read variables from JSON
        guid = item.get("guid")
        tab = item.get(tab_name_field)
        text = item.get("text")
        description = item.get("description")
        severity = item.get("severity")
        link = item.get("link")
        training = item.get("training")
        graph_query = fix_query_format(item.get("graph"))
        if graph_query and (tab in tab_title_list):
            if args.verbose:
                print("DEBUG: adding sections to workbook for ARG query '{0}', length of query is {1}".format(str(graph_query), str(len(str(graph_query)))))
            query_id += 1
            # Create new text
            new_text = block_text.copy()
            new_text['name'] = 'querytext' + str(query_id)
            new_text['content']['json'] = text
            if link:
                new_text['content']['json'] += ". Check [this link](" + link + ") for further information."
            if training:
                new_text['content']['json'] += ". [This training](" + training + ") can help to educate yourself on this."
            # Create new query
            new_query = block_query.copy()
            new_query['name'] = 'query' + str(query_id)
            new_query['content']['query'] = graph_query
            new_query['content']['size'] = query_size
            # Add text and query to the workbook
            tab_id = tab_dict[tab] + len(block_workbook['items'])
            if args.verbose:
                print ("DEBUG: Adding text and query to tab ID {0} ({1})".format(str(tab_id), tab))
                print ("DEBUG: Workbook object name is {0}".format(workbook['items'][tab_id]['name']))
            new_new_text = json.loads(json.dumps(new_text.copy()))
            new_new_query = json.loads(json.dumps(new_query.copy()))
            workbook['items'][tab_id]['content']['items'].append(new_new_text)
            workbook['items'][tab_id]['content']['items'].append(new_new_query)

    # Dump the workbook to the output file or to console, if there was any query in the original checklist
    if query_id > 0:
        if output_file:
            # Dump workbook JSON into a file
            workbook_string = json.dumps(workbook, indent=4)
            with open(output_file, 'w', encoding='utf-8') as f:
                f.write(workbook_string)
                f.close()
            # Create ARM template (optionally, if specified in the parameters)
            if args.create_arm_template:
                arm_output_file = os.path.splitext(output_file)[0] + '_template.json'
                if args.verbose:
                    print ("DEBUG: Creating ARM template in file {0}...".format(arm_output_file))
                block_arm['parameters']['workbookDisplayName']['defaultValue'] = checklist_data['metadata']['name']
                if args.category:
                    block_arm['parameters']['workbookDisplayName']['defaultValue'] += ' - ' + args.category[0].upper() + args.category[1:]
                block_arm['resources'][0]['properties']['serializedData'] = serialize_data(workbook_string)
                arm_string = json.dumps(block_arm, indent=4)
                with open(arm_output_file, 'w', encoding='utf-8') as f:
                    f.write(arm_string)
                    f.close()
        else:
            print(workbook_string)
    else:
        print("INFO: sorry, the analyzed checklist did not contain any graph query")

def get_output_file(checklist_file_or_url, is_file=True):
    if is_file:
        output_file = os.path.basename(checklist_file_or_url)
    else:
        output_file = checklist_file_or_url.split('/')[-1]
    if args.output_file:
        return args.output_file
    elif args.output_path:
        # Get filename without path and extension
        output_file = os.path.join(args.output_path, output_file)
        # If category specified, add to output file name
        if args.category:
            return os.path.splitext(output_file)[0] + '_' + str(args.category).lower() + '_workbook.json'
        else:
            return os.path.splitext(output_file)[0] + '_workbook.json'
    else:
        output_file = None


########
# Main #
########

# First thing of all, load the building blocks
load_building_blocks()
if args.verbose:
    print ("DEBUG: building blocks variables intialized:")
    print ("DEBUG:    - Workbook: {0}".format(str(block_workbook)))
    print ("DEBUG:    -    Number of items: {0}".format(str(len(block_workbook['items']))))
    print ("DEBUG:    - Link: {0}".format(str(block_link)))
    print ("DEBUG:    - Query: {0}".format(str(block_query)))

# Download checklist or process from local file
if checklist_file:
    checklist_file_list = checklist_file.split(" ")
    # Take only the English versions of the checklists (JSON files)
    checklist_file_list = [file[:-8] + '.en.json' for file in checklist_file_list if (os.path.splitext(file)[1] == '.json')]
    # Remove duplicates
    checklist_file_list = list(set(checklist_file_list))
    # Go over the list(s)
    for checklist_file in checklist_file_list:
        if args.verbose:
            print("DEBUG: Opening checklist file", checklist_file)
        # Get JSON
        try:
            # Open file
            with open(checklist_file) as f:
                checklist_data = json.load(f)
            # Set output file variable
            output_file = get_output_file(checklist_file, is_file=True)
            # Generate workbook
            generate_workbook(output_file, checklist_data)
        # If error, just continue
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
            # sys.exit(0)
else:
    # If no input files specified, fetch the latest from Github...
    if technology:
        checklist_url = "https://raw.githubusercontent.com/Azure/review-checklists/main/checklists/" + technology + "_checklist.en.json"
    else:
        checklist_url = "https://raw.githubusercontent.com/Azure/review-checklists/main/checklists/lz_checklist.en.json"
    if args.verbose:
        print("DEBUG: Downloading checklist file from", checklist_url)
    response = requests.get(checklist_url)
    # If download was successful
    if response.status_code == 200:
        if args.verbose:
            print ("DEBUG: File {0} downloaded successfully".format(checklist_url))
        try:
            # Deserialize JSON to object variable
            checklist_data = json.loads(response.text)
        except Exception as e:
            print("Error deserializing JSON content: {0}".format(str(e)))
            sys.exit(1)
        # Set output files
        output_file = get_output_file(checklist_url, is_file=False)
        # Generate workbook
        generate_workbook(output_file, checklist_data)


scripts/update_excel_openpyxl.py METASEP
######################################################################
#
# This script reads the checklist items from the latest checklist file
#   in Github (or from a local file) and populates an Excel spreadsheet
#   with the contents.
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--checklist-file', dest='checklist_file', action='store',
                    help='You can optionally supply a JSON file containing the checklist you want to dump to the Excel spreadsheet. Otherwise it will take the latest file from Github')
parser.add_argument('--only-english', dest='only_english', action='store_true', default=False,
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--find-all', dest='find_all', action='store_true', default=False,
                    help='if checklist files are specified, find all the languages for the given checklists (default: False)')
parser.add_argument('--technology', dest='technology', action='store',
                    help='If you do not supply a JSON file with the checklist, you need to specify the technology from which the latest checklist will be downloaded from Github')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file where the checklist will be written')
parser.add_argument('--output-excel-file', dest='output_excel_file', action='store',
                    help='You can optionally supply an Excel file where the checklist will be saved, otherwise it will be updated in-place')
parser.add_argument('--output-path', dest='output_path', action='store',
                    help='If using --output-name-is-input-name, folder where to store the results')
parser.add_argument('--output-name-is-input-name', dest='output_name_is_input_name', action='store_true',
                    default=False,
                    help='Save the output in a file with the same filename as the JSON input, but with xlsx extension')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()
checklist_file = args.checklist_file
excel_file = args.excel_file
technology = args.technology

# Constants
worksheet_checklist_name = 'Checklist'
row1 = 8        # First row after which the Excel spreadsheet will be updated
col_checklist_name = "A"
row_checklist_name = "4"
guid_column_index = "L"
comment_column_index = "G"
sample_cell_index = 'A4'
col_area = "A"
col_subarea = "B"
col_check = "C"
col_desc = "D"
col_sev = "E"
col_status = "F"
col_comment = "G"
col_link = "H"
col_training = "I"
col_arg_success = "J"
col_arg_failure = "K"
col_guid = "L"
info_link_text = 'More info'
training_link_text = 'Training'
worksheet_values_name = 'Values'
values_row1 = 2
col_values_severity = "A"
col_values_status = "B"
col_values_area = "C"
col_values_description = "H"

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")
        text = item.get("text")
        description = item.get("description")
        severity = item.get("severity")
        link = item.get("link")
        training = item.get("training")
        status = default_status
        graph_query_success = item.get("graph_success")
        graph_query_failure = item.get("graph_failure")
        # Update Excel
        ws[col_area + str(row_counter)].value = category
        ws[col_subarea + str(row_counter)].value = subcategory
        ws[col_check + str(row_counter)].value = text
        ws[col_desc + str(row_counter)].value = description
        ws[col_sev + str(row_counter)].value = severity
        ws[col_status + str(row_counter)].value = status
        ws[col_link + str(row_counter)].value = link
        # if link != None:
        #     link_elements = link.split('#')
        #     link_address = link_elements[0]
        #     if len(link_elements) > 1:
        #         link_subaddress = link_elements[1]
        #     else:
        #         link_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_link + str(row_counter)].api, Address=link_address, SubAddress=link_subaddress, ScreenTip="", TextToDisplay=info_link_text)
        ws[col_training + str(row_counter)].value = training
        # if training != None:
        #     training_elements = training.split('#')
        #     training_address = training_elements[0]
        #     if len(training_elements) > 1:
        #         training_subaddress = training_elements[1]
        #     else:
        #         training_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_training + str(row_counter)].api, Address=training_address, SubAddress=training_subaddress, ScreenTip="", TextToDisplay=training_link_text)
        # GUID and ARG queries
        ws[col_arg_success + str(row_counter)].value = graph_query_success
        ws[col_arg_failure + str(row_counter)].value = graph_query_failure
        ws[col_guid + str(row_counter)].value = guid
        # Next row
        row_counter += 1

    # Display summary
    if args.verbose:
        number_of_checks = row_counter - row1
        print("DEBUG:", str(number_of_checks), "checks addedd to Excel spreadsheet")

    # Get worksheet
    try:
        wsv = wb[worksheet_values_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_values_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_values_name, "-", str(e))
        sys.exit(1)

    # Update categories
    row_counter = values_row1
    for item in checklist_data.get("categories"):
        area = item.get("name")
        wsv[col_values_area + str(row_counter)].value = area
        row_counter += 1

    # Display summary
    if args.verbose:
        print("DEBUG:", str(row_counter - values_row1), "categories addedd to Excel spreadsheet")

    # Update status
    row_counter = values_row1
    for item in checklist_data.get("status"):
        status = item.get("name")
        description = item.get("description")
        wsv[col_values_status + str(row_counter)].value = status
        wsv[col_values_description + str(row_counter)].value = description
        row_counter += 1

    # Display summary
    if args.verbose:
        print("DEBUG:", str(row_counter - values_row1), "statuses addedd to Excel spreadsheet")

    # Update severities
    row_counter = values_row1
    for item in checklist_data.get("severities"):
        severity = item.get("name")
        wsv[col_values_severity + str(row_counter)].value = severity
        row_counter += 1

    # Display summary
    if args.verbose:
        print("DEBUG:", str(row_counter - values_row1), "severities addedd to Excel spreadsheet")

    # Data validation
    # dv = DataValidation(type="list", formula1='=Values!$B$2:$B$6', allow_blank=True, showDropDown=True)
    dv = DataValidation(type="list", formula1='=Values!$B$2:$B$6', allow_blank=True)
    rangevar = col_status + str(row1) +':' + col_status + str(row1 + number_of_checks)
    if args.verbose:
        print("DEBUG: adding data validation to range", rangevar)
    dv.add(rangevar)
    ws.add_data_validation(dv)

    # Close book
    if args.verbose:
        print("DEBUG: saving workbook", output_excel_file)
    try:
        wb.save(output_excel_file)
    except Exception as e:
        print("ERROR: Error when saving Excel file to", output_excel_file, "-", str(e))
        sys.exit(1)

########
# Main #
########

# Download checklist
if checklist_file:
    checklist_file_list = checklist_file.split(" ")
    # If --only-english parameter was supplied, take only the English version and remove duplicates
    if args.only_english:
        checklist_file_list = [file[:-8] + '.en.json' for file in checklist_file_list]
        checklist_file_list = list(set(checklist_file_list))
        if args.verbose:
            print("DEBUG: new checklist file list:", str(checklist_file_list))
    # If --find-all paramater was supplied, find all the languages for the checklist
    if args.find_all:
        new_file_list = []
        for checklist_file in checklist_file_list:
            filedir = os.path.dirname(checklist_file)
            filebase = os.path.basename(checklist_file)
            filebase_noext = filebase[:-8]   # Remove '.en.json'
            file_match_list = glob.glob(os.path.join(filedir, filebase_noext + '.*.json'))
            for checklist_match in file_match_list:
                # new_file_list.append(os.path.join(filedir, checklist_match))
                new_file_list.append(checklist_match)
        checklist_file_list = list(set(new_file_list))
        if args.verbose:
            print("DEBUG: new checklist file list:", str(checklist_file_list))
    # Go over the list
    for checklist_file in checklist_file_list:
        if args.verbose:
            print("DEBUG: Opening checklist file", checklist_file)
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
            sys.exit(0)
        # Set input and output files
        input_excel_file = excel_file
        if args.output_excel_file:
            output_excel_file = args.output_excel_file
        elif args.output_name_is_input_name:
            if args.output_path:
                # Get filename without path and extension
                output_excel_file = os.path.splitext(os.path.basename(checklist_file))[0] + '.xlsx'
                output_excel_file = os.path.join(args.output_path, output_excel_file)
            else:
                # Just change the extension
                output_excel_file = os.path.splitext(checklist_file)[0] + '.xlsx'
        # Update spreadsheet
        update_excel_file(input_excel_file, output_excel_file, checklist_data)
else:
    if technology:
        checklist_url = "https://raw.githubusercontent.com/Azure/review-checklists/main/checklists/" + technology + "_checklist.en.json"
    else:
        checklist_url = "https://raw.githubusercontent.com/Azure/review-checklists/main/checklists/lz_checklist.en.json"
    if args.verbose:
        print("DEBUG: Downloading checklist file from", checklist_url)
    response = requests.get(checklist_url)
    # If download was successful
    if response.status_code == 200:
        if args.verbose:
            print ("DEBUG: File {0} downloaded successfully".format(checklist_url))
        try:
            # Deserialize JSON to object variable
            checklist_data = json.loads(response.text)
        except Exception as e:
            print("Error deserializing JSON content: {0}".format(str(e)))
            sys.exit(1)
    # Upload spreadsheet
    if args.output_excel_file:
        output_excel_file = args.output_excel_file
    else:
        output_excel_file = excel_file
    update_excel_file(excel_file, output_excel_file, checklist_data)


scripts/translate.py METASEP
import requests
import os
import argparse
import sys
import json
import uuid

# Variables
translate_keys = ('description', 'name', 'category', 'subcategory', 'text', 'severity')
translate_languages = ['es', 'ja', 'pt', 'ko']

# Get environment variables
translator_endpoint = os.environ["AZURE_TRANSLATOR_ENDPOINT"]
translator_region = os.environ["AZURE_TRANSLATOR_REGION"]
translator_key = os.environ["AZURE_TRANSLATOR_SUBSCRIPTION_KEY"]
translator_url = translator_endpoint + 'translate'

# Get input arguments
parser = argparse.ArgumentParser(description='Translate a JSON file')
parser.add_argument('--input-file-name', dest='file_name_in', action='store',
                    help='you need to supply file name where your JSON to be translated is located')
parser.add_argument('--output-file-name', dest='file_name_out', action='store',
                    help='you need to supply file name where the translated JSON will be saved')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Check we have all information
if translator_endpoint and translator_region and translator_key:
    if args.verbose:
        print('DEBUG: environment variables retrieved successfully: {0}, {1}, {2}'.format(translator_endpoint, translator_region, translator_key))
else:
    print('ERROR: couldnt retrieve environment variables for translation')
    sys.exit(1)

# Get JSON
try:
    with open(args.file_name_in) as f:
        checklist = json.load(f)
except Exception as e:
    print("ERROR: Error when processing JSON file", args.file_name_in, "-", str(e))
    sys.exit(1)

# Function to translate a single line of text to a single language
def translate_text(text_to_translate, languages):
    if args.verbose:
        print('DEBUG: translating text "{0}" on {1}...'.format(text_to_translate, translator_url))
    # If a single languages specified, convert to array
    if not type(languages) == list:
        languages = [languages]
    # Azure Translator parameters
    translator_params = {
        'api-version': '3.0',
        'from': 'en',
        'to': languages
    }
    translator_headers = {
        'Ocp-Apim-Subscription-Key': translator_key,
        'Ocp-Apim-Subscription-Region': translator_region,
        'Content-type': 'application/json',
        'Accept': 'application/json',
        'X-ClientTraceId': str(uuid.uuid4())
    }
    translator_body = [{
        'text': text_to_translate
    }]
    if args.verbose:
        print ("DEBUG: sending body", str(translator_body))
        print ("DEBUG: sending HTTP headers", str(translator_headers))
        print ("DEBUG: sending parameters", str(translator_params))
    try:
        request = requests.post(translator_url, params=translator_params, headers=translator_headers, json=translator_body)
        response = request.json()
        if args.verbose:
            print("DEBUG: translator response:")
            print(json.dumps(response, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': ')))
        return str(response[0]['translations'][0]['text'])
    except Exception as e:
        print("ERROR: Error in translation:", str(e))

# Go over all keys and translate them if required
def translate_object(checklist_object, language):
    translated_object = checklist_object.copy()
    for (k, v) in translated_object.items():
        if isinstance(v, list):
            translated_items = []
            for list_item in v:
                translated_items.append(translate_object(list_item, language))
            translated_object[k] = translated_items
        else:
            if k in translate_keys:
                # print("Found key", k, "and scalar value", v)
                translated_object[k] = translate_text(v, language)
    return translated_object

################
#     Main     #
################

if args.verbose:
    print("DEBUG: Starting translations for languages", str(translate_languages))

for using_language in translate_languages:
    print("INFO: Starting translation to", using_language)
    translated_checklist = translate_object(checklist, using_language)
    # If no output file was specified, use the input file, and append the language as extension before .json
    if not args.file_name_out:
        file_name_in_base = os.path.basename(args.file_name_in)
        file_name_in_dir = os.path.dirname(args.file_name_in)
        file_name_in_noext = file_name_in_base.split('.')[0]
        file_name_out = file_name_in_noext + '.' + using_language + '.json'
        file_name_out = os.path.join(file_name_in_dir, file_name_out)
        print("INFO: saving output file to", file_name_out)
        translated_checklist_string = json.dumps(translated_checklist, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
        with open(file_name_out, 'w', encoding='utf-8') as f:
            f.write(translated_checklist_string)
            f.close()
        # print(json.dumps(translated_checklist, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': ')))

scripts/timestamp_checklist.py METASEP
#################################################################################
#
# This script updates the timestamp of a specific checklist and saves it.
# 
# Last updated: January 2023
#
#################################################################################

import json
import argparse
import sys
import requests
import datetime

# Get input arguments
parser = argparse.ArgumentParser(description='Timestamp an Azure Review Checklist')
parser.add_argument('--input-file', dest='input_file', action='store',
                    help='You need to supply the name of the JSON file with the checklist to be timestamped')
parser.add_argument('--output-file', dest='output_file', action='store',
                    help='You can optionally supply the name of a new JSON file that will be used to save the output. Otherwise the sorted checklist will replace the unused one')
parser.add_argument('--dry-run', dest='dry_run', action='store_true',
                    default=False,
                    help='do not save anything, only output to console (default: False)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

if not args.input_file:
    print("ERROR: no input file specified, not doing anything")

# Load the checklist
try:
    with open(args.input_file) as f:
        checklist = json.load(f)
except Exception as e:
    print("ERROR: Error when processing JSON file, nothing changed", args.input_file, "-", str(e))

# Overwrite the timestamp
checklist['metadata']['timestamp'] = datetime.date.today().strftime("%B %d, %Y")

# If dry-run, show on screen
if args.dry_run:
    print(json.dumps(checklist, indent=4))

# Saving output file if specified in the argument
if not args.dry_run:
    if args.output_file:
        output_file = args.output_file
    else:
        output_file = args.input_file
    if args.verbose:
        print("DEBUG: saving output file to", output_file)
    checklist_string = json.dumps(checklist, indent=4)
    with open(output_file, 'w', encoding='utf-8') as f:
        f.write(checklist_string)
        f.close()

scripts/sort_checklist.py METASEP
#################################################################################
#
# This script sorts a specific checklist and saves it.
# 
# Last updated: January 2023
#
#################################################################################

import json
import argparse
import sys
import requests

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-file', dest='input_file', action='store',
                    help='You need to supply the name of the JSON file with the checklist to be filtered')
parser.add_argument('--output-file', dest='output_file', action='store',
                    help='You can optionally supply the name of a new JSON file that will be used to save the output. Otherwise the sorted checklist will replace the unused one')
parser.add_argument('--dry-run', dest='dry_run', action='store_true',
                    default=False,
                    help='do not save anything, only output to console (default: False)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

if not args.input_file:
    print("ERROR: no input file specified, not doing anything")

# Load the checklist
try:
    with open(args.input_file) as f:
        checklist = json.load(f)
except Exception as e:
    print("ERROR: Error when processing JSON file, nothing changed", args.input_file, "-", str(e))

# Sort the items per category and subcategory
items = checklist['items']
items = sorted(items, key=lambda k: (k['category'],k["subcategory"]))
checklist['items'] = items

# If dry-run, show on screen
if args.dry_run:
    print(json.dumps(checklist, indent=4))

# Saving output file if specified in the argument
if not args.dry_run:
    if args.output_file:
        output_file = args.output_file
    else:
        output_file = args.input_file
    if args.verbose:
        print("DEBUG: saving output file to", output_file)
    checklist_string = json.dumps(checklist, indent=4)
    with open(output_file, 'w', encoding='utf-8') as f:
        f.write(checklist_string)
        f.close()

scripts/compile_checklist.py METASEP
#################################################################################
#
# This script attempts to build a unified checklist out of all the different checklists
#   stored in this repo, and optionally filter it per design area.
# 
# Last updated: June 2022
#
#################################################################################

import json
import argparse
import sys
import requests

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--output-file', dest='output_file', action='store',
                    help='You can optionally supply the name of the JSON file that will be created. Otherwise no output will be generated')
parser.add_argument('--category', dest='category_filter', action='store',
                    help='You can optionally provide a category name as a filter')
parser.add_argument('--checklist-name', dest='new_checklist_name', action='store',
                    default='Combined checklist',
                    help='You can optionally provide a category name as a filter')
parser.add_argument('--print-categories', dest='print_categories', action='store_true',
                    default=False,
                    help='print the categories of the combined checklist (default: False)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

if args.category_filter:
    category_filter = args.category_filter.lower()

# Variables
repo_contents_url = 'https://api.github.com/repos/azure/review-checklists/contents/checklists'

# Get existing checklists in the repo
response = requests.get(repo_contents_url)
# If download was successful
if response.status_code == 200:
    if args.verbose:
        print ("DEBUG: Github contents downloaded successfully from {0}".format(repo_contents_url))
    try:
        content_data = json.loads(response.text)
    except Exception as e:
        print("Error deserializing JSON content: {0}".format(str(e)))
        sys.exit(1)

# Get the list of checklist files
checklist_urls = []
if content_data:
    for github_object in content_data:
        if github_object['name'][-7:] == 'en.json':
            checklist_urls.append(github_object['download_url'])
else:
    print("Error deserializing JSON content from GitHub repository contents: {0}".format(str(e)))
    sys.exit(1)
if args.verbose:
    print("DEBUG: {0} checklists found".format(str(len(checklist_urls))))

# Load all of the items in memory
new_checklist = { 
    'items': [],
    'status': [
        {'name': 'Not verified', 'description': 'This check has not been looked at yet'},
        {'name': 'Open', 'description': 'There is an action item associated to this check'},
        {'name': 'Fulfilled', 'description': 'This check has been verified, and there are no further action items associated to it'},
        {'name': 'Not required', 'description': 'Recommendation understood, but not needed by current requirements'},
        {'name': 'N/A', 'description': 'Not applicable for current design'}
    ],
    'severities': [ {'name': 'High'}, {'name': 'Medium'}, {'name': 'Low'} ],
    'categories': [],
    'metadata': { 'name': args.new_checklist_name }
    }
for checklist_url in checklist_urls:
    if args.verbose:
        print("DEBUG: Downloading checklist file from", checklist_url)
    response = requests.get(checklist_url)
    if response.status_code == 200:
        if args.verbose:
            print ("DEBUG: File {0} downloaded successfully".format(checklist_url))
        try:
            # Deserialize JSON to object variable
            checklist_data = json.loads(response.text)
            checklist_name = checklist_data['metadata']['name']
            for item in checklist_data['items']:
                if checklist_name:
                    item['checklist'] = checklist_name
                item_category = str(item['category']).lower()
                if not args.category_filter or item_category.__contains__(category_filter):
                    new_checklist['items'].append(item)
        except Exception as e:
            print("Error deserializing JSON content: {0}".format(str(e)))
            sys.exit(1)
if args.verbose:
    print("DEBUG: Resulting combined checklist has {0} items".format(str(len(new_checklist['items']))))

# Add the categories to the new checklist
categories = []
for item in new_checklist['items']:
    category_name=item['checklist'] + '/' + item['category']
    if not category_name in categories:
        categories.append(category_name)
if args.verbose:
    print("DEBUG: {0} categories found".format(str(len(categories))))
for category in categories:
    new_checklist['categories'].append({'name': category})
    if args.print_categories:
        print(category)

# Saving output file if specified in the argument
if args.output_file:
    if args.verbose:
        print("DEBUG: saving output file to", args.output_file)
    new_checklist_string = json.dumps(new_checklist)
    with open(args.output_file, 'w', encoding='utf-8') as f:
        f.write(new_checklist_string)
        f.close()

scripts/checklist_graph_update.py METASEP
#################################################################################
#
# This is a study on two libraries to update Excel files: openpyxl and xlwings
# This exercise has shown that openpyxl breaks the xlsx files in this repo (maybe
#   because of the macros, or the formulae), while xlwings works fine.
#
# This script reads a previously generated JSON file with the results of Azure
#   Resource Graph queries, and stores them in the 'Comments' column of a
#   spreadsheet. Both the JSON file and the spreadsheet file are supplied as
#   parameters.
# 
# Last updated: March 2022
#
#################################################################################

import json
import argparse
import sys
from pandas import DataFrame
from openpyxl import load_workbook
import xlwings as xw

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--graph-file', dest='graph_file', action='store',
                    help='You need to supply a JSON file containing the results of Azure Resource Graph Queries')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file where the query results will be stored')
parser.add_argument('--mode', dest='mode', action='store', default="openpyxl",
                    help='It can be either xlwings or openpyxl (default is openpyxl)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()
graph_file = args.graph_file
excel_file = args.excel_file
mode = args.mode

# Constants
guid_column_index = "K"
comment_column_index = "G"
sample_cell_index = 'A4'

# Get JSON
try:
    with open(graph_file) as f:
        graph_data = json.load(f)
except Exception as e:
    print("ERROR: Error when processing JSON file", graph_file, "-", str(e))
    sys.exit(1)

# Load workbook
try:
    if mode == 'openpyxl':
        if args.verbose:
            print("DEBUG: working with openpyxl library")
        wb = load_workbook(filename = excel_file)
        ws = wb['Checklist']
    elif mode == 'xlwings':
        if args.verbose:
            print("DEBUG: working with xlwings library")
        wb = xw.Book(excel_file)
        ws = wb.sheets['Checklist']
    else:
        print("ERROR: mode {0} not recognized".format(mode))
except Exception as e:
    print("ERROR: Error when opening Excel file", excel_file, "-", str(e))
    sys.exit(1)

# Print specific cell
if args.verbose:
    print("DEBUG: looking at spreadsheet for", ws[sample_cell_index].value)

# Get GUID column into a list
if mode == 'openpyxl':
    guid_col = ws[guid_column_index]
    guid_col_values = [x.value for x in guid_col]
    if args.verbose:
        print("DEBUG: GUID column retrieved with", str(len(guid_col_values)), "values")
elif mode == 'xlwings':
    guid_col_values = ws.range(guid_column_index + ":" + guid_column_index).value
    if args.verbose:
        print("DEBUG: GUID column retrieved with", str(len(guid_col_values)), "values")
else:
    print("ERROR: mode {0} not recognized".format(mode))
    sys.exit(1)

# Go over all checks in the JSON file
for check in graph_data['checks']:
    guid = check['guid']
    arm_id = check['id']
    compliant = check['compliant']
    if (compliant == "false"):
        comment = "Non-compliant: {0}\n".format(arm_id)
    elif (compliant == "true"):
        comment = "Compliant: {0}\n".format(arm_id)
    else:
        print("ERROR: compliant status {0} not recognized".format(compliant))
    # Find the guid in the list
    if guid in guid_col_values:
        row = guid_col_values.index(guid)
        cell_index = comment_column_index + str(row)
        print("DEBUG: updating cell", cell_index)
        if mode == 'openpyxl':
            ws[cell_index] = comment
        elif mode == 'xlwings':
            ws.range(cell_index).value = comment
    else:
        print("ERROR: could not find GUID {0} in the Excel list".format(guid))

# Saving file
if mode == 'openpyxl':
    print("DEBUG: saving workbook", excel_file)
    try:
        wb.save(excel_file)
    except Exception as e:
        print("ERROR: Error when saving Excel file", excel_file, "-", str(e))
        sys.exit(1)
elif mode == 'xlwings':
    print("DEBUG: saving workbook", excel_file)
    try:
        wb.save()
    except Exception as e:
        print("ERROR: Error when saving Excel file", excel_file, "-", str(e))
        sys.exit(1)
else:
    print("ERROR: mode {0} not recognized".format(mode))

scripts/create_master_checklist.py METASEP

######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")
        text = item.get("text")
        description = item.get("description")
        severity = item.get("severity")
        link = item.get("link")
        training = item.get("training")
        status = default_status
        graph_query_success = item.get("graph_success")
        graph_query_failure = item.get("graph_failure")
        # Update Excel
        ws[col_checklist + str(row_counter)].value = checklist_name
        ws[col_area + str(row_counter)].value = category
        ws[col_subarea + str(row_counter)].value = subcategory
        ws[col_check + str(row_counter)].value = text
        ws[col_desc + str(row_counter)].value = description
        ws[col_sev + str(row_counter)].value = severity
        ws[col_status + str(row_counter)].value = status
        ws[col_link + str(row_counter)].value = link
        # if link != None:
        #     link_elements = link.split('#')
        #     link_address = link_elements[0]
        #     if len(link_elements) > 1:
        #         link_subaddress = link_elements[1]
        #     else:
        #         link_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_link + str(row_counter)].api, Address=link_address, SubAddress=link_subaddress, ScreenTip="", TextToDisplay=info_link_text)
        ws[col_training + str(row_counter)].value = training
        # if training != None:
        #     training_elements = training.split('#')
        #     training_address = training_elements[0]
        #     if len(training_elements) > 1:
        #         training_subaddress = training_elements[1]
        #     else:
        #         training_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_training + str(row_counter)].api, Address=training_address, SubAddress=training_subaddress, ScreenTip="", TextToDisplay=training_link_text)
        # GUID and ARG queries
        ws[col_arg_success + str(row_counter)].value = graph_query_success
        ws[col_arg_failure + str(row_counter)].value = graph_query_failure
        ws[col_guid + str(row_counter)].value = guid
        # Next row
        row_counter += 1

    # Display summary
    if args.verbose:
        number_of_checks = row_counter - row1
        print("DEBUG:", str(number_of_checks), "checks addedd to Excel spreadsheet")

    # Get worksheet
    try:
        wsv = wb[worksheet_values_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_values_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_values_name, "-", str(e))
        sys.exit(1)

    # Update status
    row_counter = values_row1
    for item in checklist_data.get("status"):
        status = item.get("name")
        description = item.get("description")
        wsv[col_values_status + str(row_counter)].value = status
        wsv[col_values_description + str(row_counter)].value = description
        row_counter += 1

    # Display summary
    if args.verbose:
        print("DEBUG:", str(row_counter - values_row1), "statuses addedd to Excel spreadsheet")

    # Update severities
    row_counter = values_row1
    for item in checklist_data.get("severities"):
        severity = item.get("name")
        wsv[col_values_severity + str(row_counter)].value = severity
        row_counter += 1

    # Display summary
    if args.verbose:
        print("DEBUG:", str(row_counter - values_row1), "severities addedd to Excel spreadsheet")

    # Data validation
    # dv = DataValidation(type="list", formula1='=Values!$B$2:$B$6', allow_blank=True, showDropDown=True)
    dv = DataValidation(type="list", formula1='=Values!$B$2:$B$6', allow_blank=True)
    rangevar = col_status + str(row1) +':' + col_status + str(row1 + number_of_checks)
    if args.verbose:
        print("DEBUG: adding data validation to range", rangevar)
    dv.add(rangevar)
    ws.add_data_validation(dv)

    # Close book
    if args.verbose:
        print("DEBUG: saving workbook", output_excel_file)
    try:
        wb.save(output_excel_file)
    except Exception as e:
        print("ERROR: Error when saving Excel file to", output_excel_file, "-", str(e))
        sys.exit(1)

########
# Main #
########

# Download checklist
if args.input_folder:
    # Get consolidated checklist
    checklist_master_data = get_consolidated_checklist(args.input_folder, args.language)
    # Set output file variables
    xlsx_output_file = os.path.join(args.xlsx_output_folder, args.output_name + ".xlsx")
    json_output_file = os.path.join(args.json_output_folder, args.output_name + ".json")
    # Dump master checklist to JSON file

infile
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")
        text = item.get("text")
        description = item.get("description")
        severity = item.get("severity")
        link = item.get("link")
        training = item.get("training")
        status = default_status
        graph_query_success = item.get("graph_success")
        graph_query_failure = item.get("graph_failure")
        # Update Excel
        ws[col_checklist + str(row_counter)].value = checklist_name
        ws[col_area + str(row_counter)].value = category
        ws[col_subarea + str(row_counter)].value = subcategory
        ws[col_check + str(row_counter)].value = text
        ws[col_desc + str(row_counter)].value = description
        ws[col_sev + str(row_counter)].value = severity
        ws[col_status + str(row_counter)].value = status
        ws[col_link + str(row_counter)].value = link
        # if link != None:
        #     link_elements = link.split('#')
        #     link_address = link_elements[0]
        #     if len(link_elements) > 1:
        #         link_subaddress = link_elements[1]
        #     else:
        #         link_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_link + str(row_counter)].api, Address=link_address, SubAddress=link_subaddress, ScreenTip="", TextToDisplay=info_link_text)
        ws[col_training + str(row_counter)].value = training
        # if training != None:
        #     training_elements = training.split('#')
        #     training_address = training_elements[0]
        #     if len(training_elements) > 1:
        #         training_subaddress = training_elements[1]
        #     else:
        #         training_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_training + str(row_counter)].api, Address=training_address, SubAddress=training_subaddress, ScreenTip="", TextToDisplay=training_link_text)
        # GUID and ARG queries
        ws[col_arg_success + str(row_counter)].value = graph_query_success
        ws[col_arg_failure + str(row_counter)].value = graph_query_failure
        ws[col_guid + str(row_counter)].value = guid
        # Next row
        row_counter += 1

    # Display summary
    if args.verbose:
        number_of_checks = row_counter - row1
        print("DEBUG:", str(number_of_checks), "checks addedd to Excel spreadsheet")

    # Get worksheet
    try:
        wsv = wb[worksheet_values_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_values_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_values_name, "-", str(e))
        sys.exit(1)

    # Update status
    row_counter = values_row1
    for item in checklist_data.get("status"):
        status = item.get("name")
        description = item.get("description")
        wsv[col_values_status + str(row_counter)].value = status
        wsv[col_values_description + str(row_counter)].value = description
        row_counter += 1

    # Display summary
    if args.verbose:
        print("DEBUG:", str(row_counter - values_row1), "statuses addedd to Excel spreadsheet")

    # Update severities
    row_counter = values_row1
    for item in checklist_data.get("severities"):
        severity = item.get("name")
        wsv[col_values_severity + str(row_counter)].value = severity
        row_counter += 1

    # Display summary
    if args.verbose:
        print("DEBUG:", str(row_counter - values_row1), "severities addedd to Excel spreadsheet")

    # Data validation
    # dv = DataValidation(type="list", formula1='=Values!$B$2:$B$6', allow_blank=True, showDropDown=True)
    dv = DataValidation(type="list", formula1='=Values!$B$2:$B$6', allow_blank=True)
    rangevar = col_status + str(row1) +':' + col_status + str(row1 + number_of_checks)
    if args.verbose:
        print("DEBUG: adding data validation to range", rangevar)
    dv.add(rangevar)
    ws.add_data_validation(dv)

    # Close book
    if args.verbose:
        print("DEBUG: saving workbook", output_excel_file)
    try:
        wb.save(output_excel_file)
    except Exception as e:
        print("ERROR: Error when saving Excel file to", output_excel_file, "-", str(e))
        sys.exit(1)

########
# Main #
########

# Download checklist
if args.input_folder:
    # Get consolidated checklist
    checklist_master_data = get_consolidated_checklist(args.input_folder, args.language)
    # Set output file variables
    xlsx_output_file = os.path.join(args.xlsx_output_folder, args.output_name + ".xlsx")
    json_output_file = os.path.join(args.json_output_folder, args.output_name + ".json")
    # Dump master checklist to JSON file
    dump_json_file(checklist_master_data, json_output_file)
    # Update spreadsheet

infile
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")
        text = item.get("text")
        description = item.get("description")
        severity = item.get("severity")
        link = item.get("link")
        training = item.get("training")
        status = default_status
        graph_query_success = item.get("graph_success")
        graph_query_failure = item.get("graph_failure")
        # Update Excel
        ws[col_checklist + str(row_counter)].value = checklist_name
        ws[col_area + str(row_counter)].value = category
        ws[col_subarea + str(row_counter)].value = subcategory
        ws[col_check + str(row_counter)].value = text
        ws[col_desc + str(row_counter)].value = description
        ws[col_sev + str(row_counter)].value = severity
        ws[col_status + str(row_counter)].value = status
        ws[col_link + str(row_counter)].value = link
        # if link != None:
        #     link_elements = link.split('#')
        #     link_address = link_elements[0]
        #     if len(link_elements) > 1:
        #         link_subaddress = link_elements[1]
        #     else:
        #         link_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_link + str(row_counter)].api, Address=link_address, SubAddress=link_subaddress, ScreenTip="", TextToDisplay=info_link_text)
        ws[col_training + str(row_counter)].value = training
        # if training != None:
        #     training_elements = training.split('#')
        #     training_address = training_elements[0]
        #     if len(training_elements) > 1:
        #         training_subaddress = training_elements[1]
        #     else:
        #         training_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_training + str(row_counter)].api, Address=training_address, SubAddress=training_subaddress, ScreenTip="", TextToDisplay=training_link_text)
        # GUID and ARG queries
        ws[col_arg_success + str(row_counter)].value = graph_query_success
        ws[col_arg_failure + str(row_counter)].value = graph_query_failure
        ws[col_guid + str(row_counter)].value = guid
        # Next row
        row_counter += 1

    # Display summary
    if args.verbose:
        number_of_checks = row_counter - row1
        print("DEBUG:", str(number_of_checks), "checks addedd to Excel spreadsheet")

    # Get worksheet
    try:
        wsv = wb[worksheet_values_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_values_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_values_name, "-", str(e))
        sys.exit(1)

    # Update status
    row_counter = values_row1
    for item in checklist_data.get("status"):
        status = item.get("name")
        description = item.get("description")
        wsv[col_values_status + str(row_counter)].value = status
        wsv[col_values_description + str(row_counter)].value = description
        row_counter += 1

    # Display summary
    if args.verbose:
        print("DEBUG:", str(row_counter - values_row1), "statuses addedd to Excel spreadsheet")

    # Update severities
    row_counter = values_row1
    for item in checklist_data.get("severities"):
        severity = item.get("name")
        wsv[col_values_severity + str(row_counter)].value = severity
        row_counter += 1

    # Display summary
    if args.verbose:
        print("DEBUG:", str(row_counter - values_row1), "severities addedd to Excel spreadsheet")

    # Data validation
    # dv = DataValidation(type="list", formula1='=Values!$B$2:$B$6', allow_blank=True, showDropDown=True)
    dv = DataValidation(type="list", formula1='=Values!$B$2:$B$6', allow_blank=True)
    rangevar = col_status + str(row1) +':' + col_status + str(row1 + number_of_checks)
    if args.verbose:
        print("DEBUG: adding data validation to range", rangevar)
    dv.add(rangevar)
    ws.add_data_validation(dv)

    # Close book
    if args.verbose:
        print("DEBUG: saving workbook", output_excel_file)
    try:
        wb.save(output_excel_file)
    except Exception as e:
        print("ERROR: Error when saving Excel file to", output_excel_file, "-", str(e))
        sys.exit(1)

########
# Main #
########

# Download checklist
if args.input_folder:
    # Get consolidated checklist

infile
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")
        text = item.get("text")
        description = item.get("description")
        severity = item.get("severity")
        link = item.get("link")
        training = item.get("training")
        status = default_status
        graph_query_success = item.get("graph_success")
        graph_query_failure = item.get("graph_failure")
        # Update Excel
        ws[col_checklist + str(row_counter)].value = checklist_name
        ws[col_area + str(row_counter)].value = category
        ws[col_subarea + str(row_counter)].value = subcategory
        ws[col_check + str(row_counter)].value = text
        ws[col_desc + str(row_counter)].value = description
        ws[col_sev + str(row_counter)].value = severity
        ws[col_status + str(row_counter)].value = status
        ws[col_link + str(row_counter)].value = link
        # if link != None:
        #     link_elements = link.split('#')
        #     link_address = link_elements[0]
        #     if len(link_elements) > 1:
        #         link_subaddress = link_elements[1]
        #     else:
        #         link_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_link + str(row_counter)].api, Address=link_address, SubAddress=link_subaddress, ScreenTip="", TextToDisplay=info_link_text)
        ws[col_training + str(row_counter)].value = training
        # if training != None:
        #     training_elements = training.split('#')
        #     training_address = training_elements[0]
        #     if len(training_elements) > 1:
        #         training_subaddress = training_elements[1]
        #     else:
        #         training_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_training + str(row_counter)].api, Address=training_address, SubAddress=training_subaddress, ScreenTip="", TextToDisplay=training_link_text)
        # GUID and ARG queries
        ws[col_arg_success + str(row_counter)].value = graph_query_success
        ws[col_arg_failure + str(row_counter)].value = graph_query_failure
        ws[col_guid + str(row_counter)].value = guid
        # Next row
        row_counter += 1

    # Display summary
    if args.verbose:
        number_of_checks = row_counter - row1
        print("DEBUG:", str(number_of_checks), "checks addedd to Excel spreadsheet")

    # Get worksheet
    try:
        wsv = wb[worksheet_values_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_values_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_values_name, "-", str(e))
        sys.exit(1)

    # Update status
    row_counter = values_row1
    for item in checklist_data.get("status"):
        status = item.get("name")
        description = item.get("description")
        wsv[col_values_status + str(row_counter)].value = status
        wsv[col_values_description + str(row_counter)].value = description
        row_counter += 1

    # Display summary
    if args.verbose:
        print("DEBUG:", str(row_counter - values_row1), "statuses addedd to Excel spreadsheet")

    # Update severities
    row_counter = values_row1
    for item in checklist_data.get("severities"):
        severity = item.get("name")
        wsv[col_values_severity + str(row_counter)].value = severity
        row_counter += 1

    # Display summary
    if args.verbose:
        print("DEBUG:", str(row_counter - values_row1), "severities addedd to Excel spreadsheet")

    # Data validation
    # dv = DataValidation(type="list", formula1='=Values!$B$2:$B$6', allow_blank=True, showDropDown=True)
    dv = DataValidation(type="list", formula1='=Values!$B$2:$B$6', allow_blank=True)
    rangevar = col_status + str(row1) +':' + col_status + str(row1 + number_of_checks)
    if args.verbose:
        print("DEBUG: adding data validation to range", rangevar)
    dv.add(rangevar)
    ws.add_data_validation(dv)

    # Close book
    if args.verbose:
        print("DEBUG: saving workbook", output_excel_file)
    try:

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")
        category = item.get("category")

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")
        text = item.get("text")

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")
        text = item.get("text")
        description = item.get("description")

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")
        text = item.get("text")
        description = item.get("description")
        severity = item.get("severity")

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")
        text = item.get("text")
        description = item.get("description")
        severity = item.get("severity")
        link = item.get("link")

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")
        text = item.get("text")
        description = item.get("description")
        severity = item.get("severity")
        link = item.get("link")
        training = item.get("training")
        status = default_status

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")
        text = item.get("text")
        description = item.get("description")
        severity = item.get("severity")
        link = item.get("link")
        training = item.get("training")
        status = default_status
        graph_query_success = item.get("graph_success")

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")
        text = item.get("text")
        description = item.get("description")
        severity = item.get("severity")
        link = item.get("link")
        training = item.get("training")
        status = default_status
        graph_query_success = item.get("graph_success")
        graph_query_failure = item.get("graph_failure")
        # Update Excel
        ws[col_checklist + str(row_counter)].value = checklist_name
        ws[col_area + str(row_counter)].value = category
        ws[col_subarea + str(row_counter)].value = subcategory
        ws[col_check + str(row_counter)].value = text
        ws[col_desc + str(row_counter)].value = description
        ws[col_sev + str(row_counter)].value = severity
        ws[col_status + str(row_counter)].value = status
        ws[col_link + str(row_counter)].value = link
        # if link != None:
        #     link_elements = link.split('#')
        #     link_address = link_elements[0]
        #     if len(link_elements) > 1:
        #         link_subaddress = link_elements[1]
        #     else:
        #         link_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_link + str(row_counter)].api, Address=link_address, SubAddress=link_subaddress, ScreenTip="", TextToDisplay=info_link_text)
        ws[col_training + str(row_counter)].value = training
        # if training != None:
        #     training_elements = training.split('#')
        #     training_address = training_elements[0]
        #     if len(training_elements) > 1:
        #         training_subaddress = training_elements[1]
        #     else:
        #         training_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_training + str(row_counter)].api, Address=training_address, SubAddress=training_subaddress, ScreenTip="", TextToDisplay=training_link_text)
        # GUID and ARG queries
        ws[col_arg_success + str(row_counter)].value = graph_query_success
        ws[col_arg_failure + str(row_counter)].value = graph_query_failure
        ws[col_guid + str(row_counter)].value = guid
        # Next row
        row_counter += 1

    # Display summary
    if args.verbose:
        number_of_checks = row_counter - row1
        print("DEBUG:", str(number_of_checks), "checks addedd to Excel spreadsheet")

    # Get worksheet
    try:
        wsv = wb[worksheet_values_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_values_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_values_name, "-", str(e))
        sys.exit(1)

    # Update status
    row_counter = values_row1

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")
        text = item.get("text")
        description = item.get("description")
        severity = item.get("severity")
        link = item.get("link")
        training = item.get("training")
        status = default_status
        graph_query_success = item.get("graph_success")
        graph_query_failure = item.get("graph_failure")
        # Update Excel
        ws[col_checklist + str(row_counter)].value = checklist_name
        ws[col_area + str(row_counter)].value = category
        ws[col_subarea + str(row_counter)].value = subcategory
        ws[col_check + str(row_counter)].value = text
        ws[col_desc + str(row_counter)].value = description
        ws[col_sev + str(row_counter)].value = severity
        ws[col_status + str(row_counter)].value = status
        ws[col_link + str(row_counter)].value = link
        # if link != None:
        #     link_elements = link.split('#')
        #     link_address = link_elements[0]
        #     if len(link_elements) > 1:
        #         link_subaddress = link_elements[1]
        #     else:
        #         link_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_link + str(row_counter)].api, Address=link_address, SubAddress=link_subaddress, ScreenTip="", TextToDisplay=info_link_text)
        ws[col_training + str(row_counter)].value = training
        # if training != None:
        #     training_elements = training.split('#')
        #     training_address = training_elements[0]
        #     if len(training_elements) > 1:
        #         training_subaddress = training_elements[1]
        #     else:
        #         training_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_training + str(row_counter)].api, Address=training_address, SubAddress=training_subaddress, ScreenTip="", TextToDisplay=training_link_text)
        # GUID and ARG queries
        ws[col_arg_success + str(row_counter)].value = graph_query_success
        ws[col_arg_failure + str(row_counter)].value = graph_query_failure
        ws[col_guid + str(row_counter)].value = guid
        # Next row
        row_counter += 1

    # Display summary
    if args.verbose:
        number_of_checks = row_counter - row1
        print("DEBUG:", str(number_of_checks), "checks addedd to Excel spreadsheet")

    # Get worksheet
    try:
        wsv = wb[worksheet_values_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_values_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_values_name, "-", str(e))
        sys.exit(1)

    # Update status
    row_counter = values_row1
    for item in checklist_data.get("status"):

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")
        text = item.get("text")
        description = item.get("description")
        severity = item.get("severity")
        link = item.get("link")
        training = item.get("training")
        status = default_status
        graph_query_success = item.get("graph_success")
        graph_query_failure = item.get("graph_failure")
        # Update Excel
        ws[col_checklist + str(row_counter)].value = checklist_name
        ws[col_area + str(row_counter)].value = category
        ws[col_subarea + str(row_counter)].value = subcategory
        ws[col_check + str(row_counter)].value = text
        ws[col_desc + str(row_counter)].value = description
        ws[col_sev + str(row_counter)].value = severity
        ws[col_status + str(row_counter)].value = status
        ws[col_link + str(row_counter)].value = link
        # if link != None:
        #     link_elements = link.split('#')
        #     link_address = link_elements[0]
        #     if len(link_elements) > 1:
        #         link_subaddress = link_elements[1]
        #     else:
        #         link_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_link + str(row_counter)].api, Address=link_address, SubAddress=link_subaddress, ScreenTip="", TextToDisplay=info_link_text)
        ws[col_training + str(row_counter)].value = training
        # if training != None:
        #     training_elements = training.split('#')
        #     training_address = training_elements[0]
        #     if len(training_elements) > 1:
        #         training_subaddress = training_elements[1]
        #     else:
        #         training_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_training + str(row_counter)].api, Address=training_address, SubAddress=training_subaddress, ScreenTip="", TextToDisplay=training_link_text)
        # GUID and ARG queries
        ws[col_arg_success + str(row_counter)].value = graph_query_success
        ws[col_arg_failure + str(row_counter)].value = graph_query_failure
        ws[col_guid + str(row_counter)].value = guid
        # Next row
        row_counter += 1

    # Display summary
    if args.verbose:
        number_of_checks = row_counter - row1
        print("DEBUG:", str(number_of_checks), "checks addedd to Excel spreadsheet")

    # Get worksheet
    try:
        wsv = wb[worksheet_values_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_values_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_values_name, "-", str(e))
        sys.exit(1)

    # Update status
    row_counter = values_row1
    for item in checklist_data.get("status"):
        status = item.get("name")
        description = item.get("description")
        wsv[col_values_status + str(row_counter)].value = status
        wsv[col_values_description + str(row_counter)].value = description
        row_counter += 1

    # Display summary
    if args.verbose:
        print("DEBUG:", str(row_counter - values_row1), "statuses addedd to Excel spreadsheet")

    # Update severities
    row_counter = values_row1

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")
        text = item.get("text")
        description = item.get("description")
        severity = item.get("severity")
        link = item.get("link")
        training = item.get("training")
        status = default_status
        graph_query_success = item.get("graph_success")
        graph_query_failure = item.get("graph_failure")
        # Update Excel
        ws[col_checklist + str(row_counter)].value = checklist_name
        ws[col_area + str(row_counter)].value = category
        ws[col_subarea + str(row_counter)].value = subcategory
        ws[col_check + str(row_counter)].value = text
        ws[col_desc + str(row_counter)].value = description
        ws[col_sev + str(row_counter)].value = severity
        ws[col_status + str(row_counter)].value = status
        ws[col_link + str(row_counter)].value = link
        # if link != None:
        #     link_elements = link.split('#')
        #     link_address = link_elements[0]
        #     if len(link_elements) > 1:
        #         link_subaddress = link_elements[1]
        #     else:
        #         link_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_link + str(row_counter)].api, Address=link_address, SubAddress=link_subaddress, ScreenTip="", TextToDisplay=info_link_text)
        ws[col_training + str(row_counter)].value = training
        # if training != None:
        #     training_elements = training.split('#')
        #     training_address = training_elements[0]
        #     if len(training_elements) > 1:
        #         training_subaddress = training_elements[1]
        #     else:
        #         training_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_training + str(row_counter)].api, Address=training_address, SubAddress=training_subaddress, ScreenTip="", TextToDisplay=training_link_text)
        # GUID and ARG queries
        ws[col_arg_success + str(row_counter)].value = graph_query_success
        ws[col_arg_failure + str(row_counter)].value = graph_query_failure
        ws[col_guid + str(row_counter)].value = guid
        # Next row
        row_counter += 1

    # Display summary
    if args.verbose:
        number_of_checks = row_counter - row1
        print("DEBUG:", str(number_of_checks), "checks addedd to Excel spreadsheet")

    # Get worksheet
    try:
        wsv = wb[worksheet_values_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_values_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_values_name, "-", str(e))
        sys.exit(1)

    # Update status
    row_counter = values_row1
    for item in checklist_data.get("status"):
        status = item.get("name")
        description = item.get("description")
        wsv[col_values_status + str(row_counter)].value = status
        wsv[col_values_description + str(row_counter)].value = description
        row_counter += 1

    # Display summary
    if args.verbose:
        print("DEBUG:", str(row_counter - values_row1), "statuses addedd to Excel spreadsheet")

    # Update severities
    row_counter = values_row1
    for item in checklist_data.get("severities"):

common
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)


non_informative
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")
        text = item.get("text")
        description = item.get("description")
        severity = item.get("severity")
        link = item.get("link")
        training = item.get("training")
        status = default_status
        graph_query_success = item.get("graph_success")
        graph_query_failure = item.get("graph_failure")
        # Update Excel
        ws[col_checklist + str(row_counter)].value = checklist_name
        ws[col_area + str(row_counter)].value = category
        ws[col_subarea + str(row_counter)].value = subcategory
        ws[col_check + str(row_counter)].value = text
        ws[col_desc + str(row_counter)].value = description
        ws[col_sev + str(row_counter)].value = severity
        ws[col_status + str(row_counter)].value = status
        ws[col_link + str(row_counter)].value = link
        # if link != None:
        #     link_elements = link.split('#')
        #     link_address = link_elements[0]
        #     if len(link_elements) > 1:
        #         link_subaddress = link_elements[1]
        #     else:
        #         link_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_link + str(row_counter)].api, Address=link_address, SubAddress=link_subaddress, ScreenTip="", TextToDisplay=info_link_text)
        ws[col_training + str(row_counter)].value = training
        # if training != None:
        #     training_elements = training.split('#')
        #     training_address = training_elements[0]
        #     if len(training_elements) > 1:
        #         training_subaddress = training_elements[1]
        #     else:
        #         training_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_training + str(row_counter)].api, Address=training_address, SubAddress=training_subaddress, ScreenTip="", TextToDisplay=training_link_text)
        # GUID and ARG queries
        ws[col_arg_success + str(row_counter)].value = graph_query_success
        ws[col_arg_failure + str(row_counter)].value = graph_query_failure
        ws[col_guid + str(row_counter)].value = guid
        # Next row
        row_counter += 1

    # Display summary
    if args.verbose:
        number_of_checks = row_counter - row1
        print("DEBUG:", str(number_of_checks), "checks addedd to Excel spreadsheet")

    # Get worksheet
    try:
        wsv = wb[worksheet_values_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_values_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_values_name, "-", str(e))
        sys.exit(1)

    # Update status
    row_counter = values_row1
    for item in checklist_data.get("status"):
        status = item.get("name")
        description = item.get("description")
        wsv[col_values_status + str(row_counter)].value = status
        wsv[col_values_description + str(row_counter)].value = description
        row_counter += 1

    # Display summary
    if args.verbose:
        print("DEBUG:", str(row_counter - values_row1), "statuses addedd to Excel spreadsheet")

    # Update severities
    row_counter = values_row1
    for item in checklist_data.get("severities"):
        severity = item.get("name")
        wsv[col_values_severity + str(row_counter)].value = severity
        row_counter += 1

    # Display summary
    if args.verbose:
        print("DEBUG:", str(row_counter - values_row1), "severities addedd to Excel spreadsheet")

    # Data validation
    # dv = DataValidation(type="list", formula1='=Values!$B$2:$B$6', allow_blank=True, showDropDown=True)
    dv = DataValidation(type="list", formula1='=Values!$B$2:$B$6', allow_blank=True)
    rangevar = col_status + str(row1) +':' + col_status + str(row1 + number_of_checks)
    if args.verbose:
        print("DEBUG: adding data validation to range", rangevar)
    dv.add(rangevar)
    ws.add_data_validation(dv)

    # Close book
    if args.verbose:

non_informative
non_informative
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")
        text = item.get("text")
        description = item.get("description")
        severity = item.get("severity")
        link = item.get("link")
        training = item.get("training")
        status = default_status
        graph_query_success = item.get("graph_success")
        graph_query_failure = item.get("graph_failure")
        # Update Excel
        ws[col_checklist + str(row_counter)].value = checklist_name
        ws[col_area + str(row_counter)].value = category
        ws[col_subarea + str(row_counter)].value = subcategory
        ws[col_check + str(row_counter)].value = text
        ws[col_desc + str(row_counter)].value = description
        ws[col_sev + str(row_counter)].value = severity
        ws[col_status + str(row_counter)].value = status
        ws[col_link + str(row_counter)].value = link
        # if link != None:
        #     link_elements = link.split('#')
        #     link_address = link_elements[0]
        #     if len(link_elements) > 1:
        #         link_subaddress = link_elements[1]
        #     else:
        #         link_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_link + str(row_counter)].api, Address=link_address, SubAddress=link_subaddress, ScreenTip="", TextToDisplay=info_link_text)
        ws[col_training + str(row_counter)].value = training
        # if training != None:
        #     training_elements = training.split('#')
        #     training_address = training_elements[0]
        #     if len(training_elements) > 1:
        #         training_subaddress = training_elements[1]

non_informative
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']

non_informative
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:
        ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
        if args.verbose:
            print("DEBUG: starting filling the Excel spreadsheet with the values of checklist '{0}'".format(checklist_data["metadata"]["name"]))
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Get default status from the JSON, default to "Not verified"
    try:
        status_list = checklist_data.get("status")
        default_status = status_list[0].get("name")
        if args.verbose:
            print ("DEBUG: default status retrieved from checklist: '{0}'".format(default_status))
    except:
        default_status = "Not verified"
        if args.verbose:
            print ("DEBUG: Using default status 'Not verified'")
        pass

    # For each checklist item, add a row to spreadsheet
    row_counter = row1
    for item in checklist_data.get("items"):
        # Read variables from JSON
        checklist_name = item.get("checklist")
        guid = item.get("guid")
        category = item.get("category")
        subcategory = item.get("subcategory")
        text = item.get("text")
        description = item.get("description")
        severity = item.get("severity")
        link = item.get("link")
        training = item.get("training")
        status = default_status
        graph_query_success = item.get("graph_success")
        graph_query_failure = item.get("graph_failure")
        # Update Excel
        ws[col_checklist + str(row_counter)].value = checklist_name
        ws[col_area + str(row_counter)].value = category
        ws[col_subarea + str(row_counter)].value = subcategory
        ws[col_check + str(row_counter)].value = text
        ws[col_desc + str(row_counter)].value = description
        ws[col_sev + str(row_counter)].value = severity
        ws[col_status + str(row_counter)].value = status
        ws[col_link + str(row_counter)].value = link
        # if link != None:
        #     link_elements = link.split('#')
        #     link_address = link_elements[0]
        #     if len(link_elements) > 1:
        #         link_subaddress = link_elements[1]
        #     else:
        #         link_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_link + str(row_counter)].api, Address=link_address, SubAddress=link_subaddress, ScreenTip="", TextToDisplay=info_link_text)
        ws[col_training + str(row_counter)].value = training
        # if training != None:
        #     training_elements = training.split('#')
        #     training_address = training_elements[0]
        #     if len(training_elements) > 1:
        #         training_subaddress = training_elements[1]
        #     else:
        #         training_subaddress = ""
        #     ws.api.Hyperlinks.Add (Anchor=ws[col_training + str(row_counter)].api, Address=training_address, SubAddress=training_subaddress, ScreenTip="", TextToDisplay=training_link_text)
        # GUID and ARG queries
        ws[col_arg_success + str(row_counter)].value = graph_query_success
        ws[col_arg_failure + str(row_counter)].value = graph_query_failure

random
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"

random
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"

random
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')

random
######################################################################
#
# This script combines all of the existing checklists into one big
#   checklist, and saves it in JSON and XLSX (macrofree) formats.
#
# Example usage:
# python3 ./scripts/create_master_checklist.py \
#   --input-folder="./checklists" \
#   --language="en" \
#   --excel-file="./spreadsheet/macrofree/review_checklist_master_empty.xlsx" \
#   --output-name="checklist.en.master" \
#   --json-output-folder="./checklists/" \
#   --xlsx-output-folder="./spreadsheet/macrofree/"
# 
# Last updated: March 2022
#
######################################################################

import json
import argparse
import sys
import os
import requests
import glob
import datetime
from openpyxl import load_workbook
from openpyxl.worksheet.datavalidation import DataValidation

# Get input arguments
parser = argparse.ArgumentParser(description='Update a checklist spreadsheet with JSON-formatted Azure Resource Graph results')
parser.add_argument('--input-folder', dest='input_folder', action='store',
                    help='Input folder where the checklists to merge are stored')
parser.add_argument('--language', dest='language', action='store', default='en',
                    help='if checklist files are specified, ignore the non-English ones and only generate a spreadsheet for the English version (default: False)')
parser.add_argument('--excel-file', dest='excel_file', action='store',
                    help='You need to supply an Excel file that will be taken as template to create the XLSX file with the checklist')
parser.add_argument('--json-output-folder', dest='json_output_folder', action='store',
                    help='Folder where to store the JSON output')
parser.add_argument('--xlsx-output-folder', dest='xlsx_output_folder', action='store',
                    help='Folder where to store the macro free Excel output')
parser.add_argument('--output-name', dest='output_name', action='store',
                    help='File name (without extension) for the output files (.json and .xlsx extensions will be added automatically)')
parser.add_argument('--verbose', dest='verbose', action='store_true',
                    default=False,
                    help='run in verbose mode (default: False)')
args = parser.parse_args()

# Consolidate all checklists into one big checklist object
def get_consolidated_checklist(input_folder, language):
    # Initialize checklist object
    checklist_master_data = {
        'items': [],
        'metadata': {
            'name': 'Master checklist',
            'timestamp': datetime.date.today().strftime("%B %d, %Y")
        }
    }
    # Find all files in the input folder matching the pattern "language*.json"
    if args.verbose:
        print("DEBUG: looking for JSON files in folder", input_folder, "with pattern *.", language + ".json...")
    checklist_files = glob.glob(input_folder + "/*." + language + ".json")
    if args.verbose:
        print("DEBUG: found", len(checklist_files), "JSON files")
    for checklist_file in checklist_files:
        # Get JSON
        try:
            with open(checklist_file) as f:
                checklist_data = json.load(f)
                if args.verbose:
                    print("DEBUG: JSON file", checklist_file, "loaded successfully with {0} items".format(len(checklist_data["items"])))
                for item in checklist_data["items"]:
                    # Add field with the name of the checklist
                    item["checklist"] = checklist_data["metadata"]["name"]
                # Add items to the master checklist
                checklist_master_data['items'] += checklist_data['items']
                # Replace the master checklist severities and status sections (for a given language they should be all the same)
                checklist_master_data['severities'] = checklist_data['severities']
                checklist_master_data['status'] = checklist_data['status']
        except Exception as e:
            print("ERROR: Error when processing JSON file", checklist_file, "-", str(e))
    if args.verbose:
        print("DEBUG: master checklist contains", len(checklist_master_data["items"]), "items")
    return checklist_master_data

# Dump JSON object to file
def dump_json_file(json_object, filename):
    if args.verbose:
        print("DEBUG: dumping JSON object to file", filename)
    json_string = json.dumps(json_object, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))
    with open(filename, 'w', encoding='utf-8') as f:
        f.write(json_string)
        f.close()

# Main function
def update_excel_file(input_excel_file, output_excel_file, checklist_data):
    # Constants
    worksheet_checklist_name = 'Checklist'
    row1 = 8        # First row after which the Excel spreadsheet will be updated
    col_checklist_name = "A"
    row_checklist_name = "4"
    guid_column_index = "L"
    comment_column_index = "G"
    sample_cell_index = 'A4'
    col_checklist="A"
    col_area = "B"
    col_subarea = "C"
    col_check = "D"
    col_desc = "E"
    col_sev = "F"
    col_status = "G"
    col_comment = "H"
    col_link = "I"
    col_training = "J"
    col_arg_success = "K"
    col_arg_failure = "L"
    col_guid = "M"
    info_link_text = 'More info'
    training_link_text = 'Training'
    worksheet_values_name = 'Values'
    values_row1 = 2
    col_values_severity = "A"
    col_values_status = "B"
    col_values_area = "C"
    col_values_description = "H"

    # Load workbook
    try:
        wb = load_workbook(filename = input_excel_file)
        if args.verbose:
            print("DEBUG: workbook", input_excel_file, "opened successfully")
    except Exception as e:
        print("ERROR: Error when opening Excel file", input_excel_file, "-", str(e))
        sys.exit(1)

    # Get worksheet
    try:
        ws = wb[worksheet_checklist_name]
        if args.verbose:
            print("DEBUG: worksheet", worksheet_checklist_name, "selected successfully")
    except Exception as e:
        print("ERROR: Error when selecting worksheet", worksheet_checklist_name, "-", str(e))
        sys.exit(1)

    # Set checklist name
    try:

random
    dump_json_file(checklist_master_data, json_output_file)
     update_excel_file(args.excel_file, xlsx_output_file, checklist_master_data)
     checklist_master_data = get_consolidated_checklist(args.input_folder, args.language)
         wb.save(output_excel_file)
         status_list = checklist_data.get("status")
         default_status = status_list[0].get("name")
     for item in checklist_data.get("items"):
         checklist_name = item.get("checklist")
         guid = item.get("guid")
         category = item.get("category")
         subcategory = item.get("subcategory")
         text = item.get("text")
         description = item.get("description")
         severity = item.get("severity")
         link = item.get("link")
         training = item.get("training")
         graph_query_success = item.get("graph_success")
         graph_query_failure = item.get("graph_failure")
                 checklist_data = json.load(f)
     for item in checklist_data.get("status"):
         status = item.get("name")
     for item in checklist_data.get("severities"):
         severity = item.get("name")
     # Get worksheet
         print("DEBUG: saving workbook", output_excel_file)
 ######################################################################
         #     else:
                 # Replace the master checklist severities and status sections (for a given language they should be all the same)
         ws[col_guid + str(row_counter)].value = guid
     guid_column_index = "L"
     col_subarea = "C"
 parser.add_argument('--language', dest='language', action='store', default='en',
         ws[col_checklist_name + row_checklist_name] = checklist_data["metadata"]["name"]
