Checks

Azure Databricks workspaces are evaluated for use of customer-managed keys (CMK) on at-rest encryption, based on the workspace's managed disk encryption configuration.

Azure Databricks workspaces are evaluated for secure cluster connectivity (No Public IP / NPIP). When enabled, compute (cluster) nodes are deployed without public IP addresses and communicate with the control plane through a secure relay, reducing the workspace's exposure to the internet.

Azure Databricks workspaces are evaluated for public network access. Disabling public network access ensures the workspace is only reachable through private endpoints, reducing the attack surface and preventing direct exposure of the control plane and data plane to the internet.

Azure Databricks workspaces using VNet injection are placed in a customer-managed VNet rather than a Databricks-managed network. This evaluates whether a workspace is linked to a customer VNet.

AWS Data Pipeline definitions are inspected for hardcoded secrets, such as keys, tokens, passwords, or database credentials embedded directly in pipeline objects, parameters, or parameter values.

Dataproc clusters use Customer-Managed Encryption Keys (CMEK) for VM persistent disk encryption. The finding determines whether a customer KMS key is configured for disk data instead of the default Google-managed keys.

AWS DataSync tasks are evaluated for a configured CloudWatch Logs destination (CloudWatchLogGroupArn).

Tasks that specify a log group are recognized as logging-enabled; those without one are identified as not publishing execution events.

Microsoft Defender for Cloud security contact settings include additional email recipients defined in the emails field to receive alert notifications.

Microsoft Defender for Office 365 anti-phishing policies are evaluated for custom scoping to users, groups, or domains and precedence over the default, plus key settings: spoof intelligence, DMARC honoring, quarantine actions for spoof/DMARC, safety tips, unauthenticated sender indicators, and policy enablement.

Microsoft Defender connection filter policy is evaluated to determine whether the IP Allowlist (IPAllowList) is configured. The finding indicates if any IP addresses are present in the policy's allow list for Exchange Online or standalone EOP environments.

Microsoft Defender for Office 365 connection filter policy safe list setting is evaluated. When enabled, mail from Microsoft-managed IPs skips spam filtering and some sender authentication. The finding indicates whether this implicit bypass is turned off.

Microsoft Defender for Office 365 outbound spam policies must send administrator alerts and Bcc suspicious outbound messages when a sender exceeds limits or is blocked. The assessment checks for notify limit exceeded and notify sender blocked with recipient addresses in the default policy and any applicable custom policies.

Microsoft Defender for Office 365 outbound spam policies are evaluated to confirm that automatic mail forwarding is disabled in the default policy and in any custom policies applied to users, groups, or domains.

Microsoft Defender for Office 365 inbound anti-spam policies are evaluated for domains listed in AllowedSenderDomains.

The finding identifies any policy where this list is populated rather than empty.

Azure virtual machines are assessed for the presence of an endpoint protection (antimalware) solution and its reported health across the subscription

Microsoft Defender for Office 365 Safe Attachments for SharePoint, OneDrive, and Microsoft Teams protects organizations from inadvertently sharing malicious files. When enabled, files identified as malicious are blocked and cannot be opened, copied, moved, or shared until further actions are taken by the organization's security team.

Microsoft Defender for Cloud attack path email notifications are configured per subscription with a defined minimal risk level, and the setting is present and meets the required threshold.

Microsoft Defender for Cloud auto-provisioning of the Log Analytics agent to Azure VMs is configured to On at the subscription level

Microsoft Defender for Cloud evaluates whether Azure VMs and Arc-enabled machines have a vulnerability assessment solution deployed and reporting healthy coverage across the subscription.

Microsoft Defender for Office 365 user-reported settings ensure junk, not-junk, and phish reports are sent to customized addresses with valid destinations, and that Teams chat reports route to customized addresses while direct chat reporting to Microsoft is disabled.

Running container images are evaluated for unresolved vulnerability findings (CVEs) reported by Microsoft Defender for Cloud. The check reviews images currently in use across Kubernetes workloads and identifies where vulnerabilities remain unremediated.

Azure subscriptions have container image vulnerability assessment enabled for Azure Container Registry via Microsoft Defender for Cloud (ContainerRegistriesVulnerabilityAssessments). Images in registries are evaluated for known package vulnerabilities in their packages and dependencies.

Microsoft 365 Exchange Online domains use DKIM signing for outbound mail. This evaluates each domain to confirm an active DKIM configuration so messages include a verifiable signature via the domain's DKIM selectors.

Microsoft 365 Exchange Online domains should publish a DMARC DNS TXT record at _dmarc.<domain> with an enforcement policy (p=quarantine or p=reject). This evaluates each accepted domain to confirm the published record and that it does not rely solely on the monitoring-only p=none policy.