Skip to content

Commit f6d6fba

Browse files
earlduqueearlduque
authored
Merge pull request #34 from niamccash/adding-contrib-checks-into-scoped-app
Adding contrib checks into scoped app
2 parents c408012 + 85eb0fc commit f6d6fba

13 files changed

+246
-253
lines changed

‎Update set description should not be empty‎

Lines changed: 0 additions & 43 deletions
This file was deleted.

‎Update set should not have more than 1000 updates‎

Lines changed: 0 additions & 48 deletions
This file was deleted.

‎ca8467c41b9abc10ce0f62c3b24bcbaa/checksum.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
PYWlzL3phWC3TxAkkqZGhFLHO8eR23fT2C80-qZIVh29O9G7xv31P52Hfu3B7OFy5imHwEwPrXUyc4Q-JhEwngWKv5Yo7ypMfXQw_5bU9xJqAtA-9JxAhaxsQN-7OknEjTvLM50REdUiemr-OrICrDfFARf3ewCNvnmeG64_eMqM3pJPmw8aMukmEoiztnYs07N1sFwqShlZutUFme6YoGnK2dk8eKxUreM9CgSIqqhldUU9h1yaghPLWiSBp6I3haCv8qHJ_BF6MuJ5HpvKKAl2r-JnSSuLs8-t6eHwQ5BC5MYbDGtbVoA578dk7UfZnGx3ZE3QldnciCtCDUNTLmkimdYcZ6tcHbreQ6rA_eJeWl7VE7Je7KJpvaJ8NE_plaY-QHG1cu1P2S4a3hntImTAM6wDmJUpG0OWFl8XjnyDyFyiYZZOyg1EHBfQRgZdgEx0tCxK42mbh51XsXQSwVE_jPKwc5X8Vv6GFBF1gHpPx_ATE8A7m5Tt_5FvGtUnY25TFwEs6b_gMHgtANE9iEZyioWLOu54wG17ZUHa-aplP9N30mHznR0s8wdWaB0LnwumsPiInmtDGMl9FPvv_ss5IICNb3UbjeVCEX5v3yLgs9A5TUGVgTdET2SunV3sH0PNk1hpwY_PkU2gzi_-qcVuBQgRTSd2j1DDcTUB39o
1+
aQgfvSnhfC1wVpuKQWhyhUbVCWpldAIXeFWQKJua_aMBJoo85rtlMi5xn9KG5nidXKThCkM8feBrcyFJeo-VtULwIXM7nd5AhwRgHc-VCp5tkNM4hsqpmD28YvfJ-rPIJYR_mUqcUwW_ID_GEKPARpUmsJXWMf-jmcc-ObkNNXJvYdzC2bWesQhNmYZP8gmjejTCkz-ID2_yOqqtcrxakfHtzadbAlixtE6-Ips8WZJwkFKogWjfXbeRFkkt2Q38ElCebT3gI8d3EFmdRZLHW20jpzYWgOR4HbGWM4zWyWoOlfcPGgYwheLugrwtDHodWMf6VDAvnmLqHCORandvFfF8o2Ci794mag0lIWxXsQ3Jzl5gZMb4Hu2I9wFSw0sJzwfYUnD1DB-gLlKaRN-0rWcW2b8ik8yt26GVcMXoqUdX514AFoPk4RO-Q-QpoEaBJ5RskOvepYP62AZ8zMb3wDqJUTJRfy3_uQQXMOmIHTI8HSVUL54ddI2uRrfEtvBlYldjHECjFOu716btBVX9WW828DhvbDtGE2VA4cKz4O4LRWQenhRdbhdWcPKAcAYSMLyliNLMkABTEd6OfpJD_GPA5AGlgb12DZtneAqIUEFFzpuS1fQMZLOd8ceXGo4o1bk-W6fH8PiNGkK2Xtyb93W2UXBvDNRxKlNWVeaIEVY

‎ca8467c41b9abc10ce0f62c3b24bcbaa/update/scan_script_only_check_0dfff25a2f83301002f0ffecf699b649.xml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
<?xml version="1.0" encoding="UTF-8"?><record_update table="scan_script_only_check">
2+
<scan_script_only_check action="INSERT_OR_UPDATE">
3+
<active>true</active>
4+
<attributes/>
5+
<category>manageability</category>
6+
<description>Update set should not have more than 1000 updates as it makes it difficult for the release team to analyze, also could potentially bring in environment slowness while committing</description>
7+
<documentation_url/>
8+
<finding_type>scan_finding</finding_type>
9+
<name>Update set should not have more than 1000 updates</name>
10+
<priority>3</priority>
11+
<resolution_details>Rework story so they are more granular or split the updates into multiple updates sets</resolution_details>
12+
<run_condition/>
13+
<score_max>100</score_max>
14+
<score_min>0</score_min>
15+
<score_scale>1</score_scale>
16+
<script><![CDATA[(function(engine) {
17+
18+
var updateSetConfigCount;
19+
var checkConfisCount = new GlideAggregate('sys_update_xml');
20+
checkConfisCount.addEncodedQuery('update_set.state!=ignore');
21+
checkConfisCount.addAggregate('COUNT', 'update_set');
22+
checkConfisCount.orderBy('update_set');
23+
checkConfisCount.query();
24+
while (checkConfisCount.next()) {
25+
updateSetConfigCount = checkConfisCount.getAggregate('COUNT', 'update_set');
26+
if (updateSetConfigCount >= 1000) {
27+
finding.setCurrentSource(checkConfisCount);
28+
engine.finding.increment();
29+
}
30+
}
31+
32+
})(engine);]]></script>
33+
<short_description>Update set should not have more than 1000 updates</short_description>
34+
<sys_class_name>scan_script_only_check</sys_class_name>
35+
<sys_created_by>admin</sys_created_by>
36+
<sys_created_on>2021-10-09 18:01:53</sys_created_on>
37+
<sys_id>0dfff25a2f83301002f0ffecf699b649</sys_id>
38+
<sys_name>Update set should not have more than 1000 updates</sys_name>
39+
<sys_package display_value="Example Instance Checks" source="x_appe_exa_checks">ca8467c41b9abc10ce0f62c3b24bcbaa</sys_package>
40+
<sys_policy/>
41+
<sys_scope display_value="Example Instance Checks">ca8467c41b9abc10ce0f62c3b24bcbaa</sys_scope>
42+
<sys_update_name>scan_script_only_check_0dfff25a2f83301002f0ffecf699b649</sys_update_name>
43+
</scan_script_only_check>
44+
</record_update>

‎ca8467c41b9abc10ce0f62c3b24bcbaa/update/scan_script_only_check_1e7511642f2330100b40bea62799b6f1.xml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
<?xml version="1.0" encoding="UTF-8"?><record_update table="scan_script_only_check">
2+
<scan_script_only_check action="INSERT_OR_UPDATE">
3+
<active>true</active>
4+
<attributes display_value="">906611642f2330100b40bea62799b6b7</attributes>
5+
<category>security</category>
6+
<description>It is worthy to check all reports that are with role public - as they can expose data to unauthenticated users via:
7+
https : / / &lt;instance&gt;.service-now.com/sys_report_display.do?sysparm_report_id=&lt;sysID&gt;</description>
8+
<documentation_url/>
9+
<finding_type/>
10+
<name>Public reports to be verified </name>
11+
<priority>2</priority>
12+
<resolution_details/>
13+
<run_condition/>
14+
<score_max/>
15+
<score_min/>
16+
<score_scale/>
17+
<script><![CDATA[(function(finding) {
18+
19+
var grSysReport = new GlideRecord('sys_report');
20+
grSysReport.addEncodedQuery("roles=public");
21+
grSysReport.query();
22+
while (grSysReport.next()) {
23+
finding.setCurrentSource(grSysReport);
24+
finding.increment();
25+
}
26+
27+
})(finding);]]></script>
28+
<short_description>Candidates of publicly available reports (without needs to authorize) that shoul</short_description>
29+
<sys_class_name>scan_script_only_check</sys_class_name>
30+
<sys_created_by>admin</sys_created_by>
31+
<sys_created_on>2021-10-28 18:46:02</sys_created_on>
32+
<sys_id>1e7511642f2330100b40bea62799b6f1</sys_id>
33+
<sys_name>Public reports to be verified </sys_name>
34+
<sys_package display_value="Example Instance Checks" source="x_appe_exa_checks">ca8467c41b9abc10ce0f62c3b24bcbaa</sys_package>
35+
<sys_policy/>
36+
<sys_scope display_value="Example Instance Checks">ca8467c41b9abc10ce0f62c3b24bcbaa</sys_scope>
37+
<sys_update_name>scan_script_only_check_1e7511642f2330100b40bea62799b6f1</sys_update_name>
38+
</scan_script_only_check>
39+
</record_update>

‎ca8467c41b9abc10ce0f62c3b24bcbaa/update/scan_script_only_check_718e43b42f2330100b40bea62799b67f.xml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
<?xml version="1.0" encoding="UTF-8"?><record_update table="scan_script_only_check">
2+
<scan_script_only_check action="INSERT_OR_UPDATE">
3+
<active>true</active>
4+
<attributes display_value="">125fc7742f2330100b40bea62799b6fb</attributes>
5+
<category>security</category>
6+
<description/>
7+
<documentation_url/>
8+
<finding_type/>
9+
<name>Locked out user for Scheduled Job</name>
10+
<priority>2</priority>
11+
<resolution_details/>
12+
<run_condition/>
13+
<score_max/>
14+
<score_min/>
15+
<score_scale/>
16+
<script><![CDATA[(function(finding) {
17+
18+
var grSysauto = new GlideRecord('sysauto');
19+
grSysauto.addEncodedQuery("run_as.locked_out=true");
20+
grSysauto.query();
21+
while (grSysauto.next()) {
22+
finding.setCurrentSource(grSysauto);
23+
finding.increment();
24+
}
25+
26+
})(finding);
27+
]]></script>
28+
<short_description>Locked out user detection in Run as for Scheduled Jobs</short_description>
29+
<sys_class_name>scan_script_only_check</sys_class_name>
30+
<sys_created_by>admin</sys_created_by>
31+
<sys_created_on>2021-10-29 22:13:02</sys_created_on>
32+
<sys_id>718e43b42f2330100b40bea62799b67f</sys_id>
33+
<sys_name>Locked out user for Scheduled Job</sys_name>
34+
<sys_package display_value="Example Instance Checks" source="x_appe_exa_checks">ca8467c41b9abc10ce0f62c3b24bcbaa</sys_package>
35+
<sys_policy/>
36+
<sys_scope display_value="Example Instance Checks">ca8467c41b9abc10ce0f62c3b24bcbaa</sys_scope>
37+
<sys_update_name>scan_script_only_check_718e43b42f2330100b40bea62799b67f</sys_update_name>
38+
</scan_script_only_check>
39+
</record_update>

‎ca8467c41b9abc10ce0f62c3b24bcbaa/update/scan_table_check_003db2922f43301002f0ffecf699b617.xml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
<?xml version="1.0" encoding="UTF-8"?><record_update table="scan_table_check">
2+
<scan_table_check action="INSERT_OR_UPDATE">
3+
<active>true</active>
4+
<advanced>false</advanced>
5+
<attributes/>
6+
<category>manageability</category>
7+
<conditions table="sys_update_set">descriptionISEMPTY^state!=ignore^EQ<item endquery="false" field="description" goto="false" newquery="false" operator="ISEMPTY" or="false" value=""/>
8+
<item display_value="Ignore" endquery="false" field="state" goto="false" newquery="false" operator="!=" or="false" value="ignore"/>
9+
<item endquery="true" field="" goto="false" newquery="false" operator="=" or="false" value=""/>
10+
</conditions>
11+
<description>Update set description provides the release management team to better understand what's getting pushed</description>
12+
<documentation_url/>
13+
<finding_type>scan_finding</finding_type>
14+
<name>Update Set Description Empty</name>
15+
<priority>4</priority>
16+
<resolution_details>The description should not be empty</resolution_details>
17+
<run_condition/>
18+
<score_max>100</score_max>
19+
<score_min>0</score_min>
20+
<score_scale>1</score_scale>
21+
<script><![CDATA[(function (engine) {
22+
23+
// Add your code here
24+
25+
})(engine);]]></script>
26+
<short_description>Update set descriptions should not be left empty </short_description>
27+
<sys_class_name>scan_table_check</sys_class_name>
28+
<sys_created_by>admin</sys_created_by>
29+
<sys_created_on>2021-10-09 16:31:59</sys_created_on>
30+
<sys_id>003db2922f43301002f0ffecf699b617</sys_id>
31+
<sys_name>Update Set Description Empty</sys_name>
32+
<sys_package display_value="Example Instance Checks" source="x_appe_exa_checks">ca8467c41b9abc10ce0f62c3b24bcbaa</sys_package>
33+
<sys_policy/>
34+
<sys_scope display_value="Example Instance Checks">ca8467c41b9abc10ce0f62c3b24bcbaa</sys_scope>
35+
<sys_update_name>scan_table_check_003db2922f43301002f0ffecf699b617</sys_update_name>
36+
<table>sys_update_set</table>
37+
<use_manifest>false</use_manifest>
38+
</scan_table_check>
39+
</record_update>

‎ca8467c41b9abc10ce0f62c3b24bcbaa/update/scan_table_check_22a8ebad2fd3301036c51e282799b6b4.xml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
<?xml version="1.0" encoding="UTF-8"?><record_update table="scan_table_check">
2+
<scan_table_check action="INSERT_OR_UPDATE">
3+
<active>true</active>
4+
<advanced>false</advanced>
5+
<attributes/>
6+
<category>security</category>
7+
<conditions table="sys_user">locked_out=false^roles=admin^last_login_timeRELATIVELT@month@ago@1^ORlast_login_timeISEMPTY^EQ<item endquery="false" field="locked_out" goto="false" newquery="false" operator="=" or="false" value="false"/>
8+
<item endquery="false" field="roles" goto="false" newquery="false" operator="=" or="false" value="admin"/>
9+
<item endquery="false" field="last_login_time" goto="false" newquery="false" operator="RELATIVE" or="false" value="LT@month@ago@1"/>
10+
<item endquery="false" field="last_login_time" goto="false" newquery="false" operator="ISEMPTY" or="true" value=""/>
11+
<item endquery="true" field="" goto="false" newquery="false" operator="=" or="false" value=""/>
12+
</conditions>
13+
<description/>
14+
<documentation_url/>
15+
<finding_type>scan_finding</finding_type>
16+
<name>Admins not logged in for 1 month</name>
17+
<priority>2</priority>
18+
<resolution_details/>
19+
<run_condition/>
20+
<score_max>100</score_max>
21+
<score_min>0</score_min>
22+
<score_scale>1</score_scale>
23+
<script><![CDATA[(function (engine) {
24+
25+
// Add your code here
26+
27+
})(engine);]]></script>
28+
<short_description>List users with admin role that were inactive for at least 1 month</short_description>
29+
<sys_class_name>scan_table_check</sys_class_name>
30+
<sys_created_by>admin</sys_created_by>
31+
<sys_created_on>2021-10-19 21:45:37</sys_created_on>
32+
<sys_id>22a8ebad2fd3301036c51e282799b6b4</sys_id>
33+
<sys_name>Admins not logged in for 1 month</sys_name>
34+
<sys_package display_value="Example Instance Checks" source="x_appe_exa_checks">ca8467c41b9abc10ce0f62c3b24bcbaa</sys_package>
35+
<sys_policy/>
36+
<sys_scope display_value="Example Instance Checks">ca8467c41b9abc10ce0f62c3b24bcbaa</sys_scope>
37+
<sys_update_name>scan_table_check_22a8ebad2fd3301036c51e282799b6b4</sys_update_name>
38+
<table>sys_user</table>
39+
<use_manifest>false</use_manifest>
40+
</scan_table_check>
41+
</record_update>

‎ca8467c41b9abc10ce0f62c3b24bcbaa/update/scan_table_check_5adc555e2f9b30100b40bea62799b6e3.xml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<?xml version="1.0" encoding="UTF-8"?><record_update table="scan_table_check">
2+
<scan_table_check action="INSERT_OR_UPDATE">
3+
<active>true</active>
4+
<advanced>true</advanced>
5+
<attributes display_value="">a49d119e2f9b30100b40bea62799b627</attributes>
6+
<category>security</category>
7+
<conditions table="sys_user_grmember">group.active=false^EQ<item endquery="false" field="group.active" goto="false" newquery="false" operator="=" or="false" value="false"/>
8+
<item endquery="true" field="" goto="false" newquery="false" operator="=" or="false" value=""/>
9+
</conditions>
10+
<description/>
11+
<documentation_url/>
12+
<finding_type/>
13+
<name>Users belongs to inactive Group</name>
14+
<priority>3</priority>
15+
<resolution_details/>
16+
<run_condition/>
17+
<score_max/>
18+
<score_min/>
19+
<score_scale/>
20+
<script><![CDATA[(function(finding, current) {
21+
22+
var grGroup = new GlideRecord("sys_user_group");
23+
grGroup.get(current.group);
24+
25+
finding.setCurrentSource(grGroup);
26+
finding.increment();
27+
28+
29+
})(finding, current);]]></script>
30+
<short_description>List users that still belongs to already inactivated groups</short_description>
31+
<sys_class_name>scan_table_check</sys_class_name>
32+
<sys_created_by>admin</sys_created_by>
33+
<sys_created_on>2021-10-21 19:31:07</sys_created_on>
34+
<sys_id>5adc555e2f9b30100b40bea62799b6e3</sys_id>
35+
<sys_name>Users belongs to inactive Group</sys_name>
36+
<sys_package display_value="Example Instance Checks" source="x_appe_exa_checks">ca8467c41b9abc10ce0f62c3b24bcbaa</sys_package>
37+
<sys_policy/>
38+
<sys_scope display_value="Example Instance Checks">ca8467c41b9abc10ce0f62c3b24bcbaa</sys_scope>
39+
<sys_update_name>scan_table_check_5adc555e2f9b30100b40bea62799b6e3</sys_update_name>
40+
<table>sys_user_grmember</table>
41+
<use_manifest>false</use_manifest>
42+
</scan_table_check>
43+
</record_update>

‎scan_script_only_check_1e7511642f2330100b40bea62799b6f1.xml‎

Lines changed: 0 additions & 38 deletions
This file was deleted.

0 commit comments

Comments
 (0)