Cis m365 5.0

[rfernandezdo]

Context

Ruleset and findings for CIS_Microsoft_365_Foundations_Benchmark_v5.0.0 added

Description

ruleset and findings for rules CIS_Microsoft_365_Foundations_Benchmark_v5.0.0

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[silverhack]

Hi @rfernandezdo

Firstly I want to thank you for your pull request, it's really appreciated.

Secondly, and after carefully reviewed your code, I realised that this pull request will be very difficult to approve. I will try to explain better.

It seems that new implemented checks are incorrectly using the "Path" property, as shown below:

Instead of calling directly to internal PowerShell functions, Monkey365 stores all information from collectors into an internal PowerShell custom object that act as a local database. Another internal PowerShell module is used to run queries against this "local database". This is by design to prevent script command injection attacks. Please, see information about how to create custom rules in Monkey365.

Also, and as far as I can see, several duplicate entries were created as part of this pull request:

I'm not sure if those duplicated files are included for any specific reason.

Regarding errors, I believe that all your tests passed correctly because you forget to pass --Ruleset to Monkey365. According to my internal tests, several internal functions and modules will be affected if this pull request is approved.

On the other hand and thanks to your pull request I have found a couple of bugs within the ruleset engine that needs to be addressed, so thanks!

Please, do let me know with your thoughts about the above comments. I can remove duplicate files and wrong rules to fix your pull request and move the rest of the valid code to the develop branch. With that, you will be added as a contributor of this project, which I believe is good.

Cheers,
Juan

[rfernandezdo]

The duplicate files as well as the rules have been due to little knowledge of the tool.
In the case of the files, I thought that they had to be generated for each version, although I had seen that there were some override sessions.

In the case of the rules, it's similar :D

Go ahead, Juan, with the proposed changes. We'll try to make the code better in the next iteration.

Thanks!

[rfernandezdo]

Hi Juan,

I've tried to apply the changes mentioned above and have started to look at the data model by importing it and running queries, but I haven't been able to progress much further because I don't have an environment from which to feed all the collectors.

I hope you can continue working on this PR so that it's useful ;)