Checks

Azure Function apps configured with Virtual Network integration uses a chosen subnet so outbound traffic is routed via the VNet and can reach private or service-endpoint-secured resources.

The finding reflects whether a function app is associated with a subnet resource ID.

Azure App Service web apps diagnostic settings include HTTP request logging when the AppServiceHTTPLogs category (or the allLogs group) is enabled to capture web access events.

Azure subscription contains at least one Application Insights resource collecting application telemetry (metrics, traces, logs) for monitored workloads.

The check determines whether telemetry collection exists at the subscription level, indicating that application monitoring is configured.

The Authentication Policy bound to the Okta Admin Console app must require MFA. On its top active rule, User must authenticate with must be set to Password / IdP + Another factor or Any 2 factor types (factorMode=2FA in the API).

The Authentication Policy bound to the Okta Admin Console app must restrict possession factors to phishing-resistant authenticators (FIDO2/WebAuthn, PIV/CAC, Okta FastPass with biometrics). On the top active rule, Possession factor constraints are: Phishing resistant must be checked (possession.phishingResistant=REQUIRED).

The integrated Okta Admin Console app must close idle privileged sessions. Maximum app session idle time on the Sign On tab must be 15 minutes or less.

Threshold override: okta_admin_console_idle_timeout_max_minutes.

Every active Okta application must be bound to an Authentication Policy that uses Network Zones. Each active non-default rule must map User's IP to In zone or Not in zone, and the active built-in Catch-all Rule must set Access is to Denied.

The Authentication Policy bound to the Okta Dashboard app must require MFA for end users. On its top active rule, User must authenticate with must be set to Password / IdP + Another factor or Any 2 factor types (factorMode=2FA in the API).

The Authentication Policy bound to the Okta Dashboard app must restrict possession factors to phishing-resistant authenticators. On the top active rule, Possession factor constraints are: Phishing resistant must be checked (possession.phishingResistant=REQUIRED).

Azure App Service web apps are assessed for the configured minimum TLS version for HTTPS. The expected baseline is 1.2 or 1.3; settings that permit lower versions indicate acceptance of legacy TLS during client negotiation.

Azure App Service web apps are configured with a managed identity (identity: SystemAssigned or UserAssigned) for token-based access to Azure resources without embedded credentials

Amazon AppStream fleets are assessed for the EnableDefaultInternetAccess setting, identifying fleets where streaming instances have default Internet connectivity.

AppStream fleets enforce a maximum user session duration. This finding evaluates each fleet's configured limit against a threshold-default 10 hours (36000 seconds)-and identifies fleets whose session duration exceeds that limit.

AppStream fleets are evaluated for DisconnectTimeoutInSeconds being at or below 300 seconds (5 minutes), which defines how long a streaming session remains active after a user disconnects.

Amazon AppStream fleets are evaluated for the idle disconnect timeout setting, confirming it is configured to 10 minutes (<=600s) or less before inactive users are dropped and the session's disconnect_timeout window begins.

AWS AppSync GraphQL APIs have field-level logging configured at the resolver level. The check looks for log levels of ERROR or ALL to confirm field resolution events are recorded.

AWS AppSync GraphQL APIs are examined for the default authorization type. The finding indicates an API configured with API_KEY instead of IAM, Cognito, OIDC, or Lambda authorizers.

Evaluates whether Artifact Analysis (containeranalysis.googleapis.com) is enabled at the project level to support vulnerability scanning and metadata for container images in Artifact Registry or Container Registry.

Athena workgroups are evaluated for encryption of query results to confirm result data is stored encrypted at rest, whether saved in Amazon S3 or via managed query results

Athena workgroups that set enforce_workgroup_configuration=true apply the workgroup's settings to every query, overriding client-side options for results location, expected bucket owner, encryption, and control of objects written to the results bucket.

Athena workgroups publish query metrics to CloudWatch. This evaluation determines whether each workgroup has query activity logging enabled in CloudWatch.

OCI Audit configuration defines tenancy-wide log retention for audit events. The finding evaluates whether the retention period (days) is >= 365 and that an audit configuration exists, applying across all regions and compartments.

Vercel API tokens are assessed for staleness by checking whether each token has been active within the last 90 days. Stale tokens that remain unused for extended periods represent unnecessary access credentials that increase the attack surface. Tokens with no recorded activity are also flagged.

Vercel API tokens are assessed for expiration status to identify expired tokens or those about to expire within a configurable threshold (default: 7 days). Tokens about to expire are flagged proactively so they can be rotated before causing disruptions. Tokens without an expiration date are considered valid.