Skip to content

AzSK version 4.12 Security Status Report does not create SecurityEvaluationData json  #1201

Description

@v1r7u

AzSK version 4.12 Security Status Report does not create SecurityEvaluationData json

Description

Up to version 4.11 AzSK creates SecurityEvaluationData-xxxxx.json file which contains audited environment description together with audit results. This file was a useful part of our automated pipeline and we used it to normalize audit-result: it had tags, the full azure-identifier of the resource, etc. Based on this file we were able to map results to exact azure components and get required metadata without additional requests to the Azure API.

In version 4.12 AzSK still writes Report in csv, but does not create SecurityEvaluationData json file.

Is it intentional behavior? Is it possible to keep this file generation in further version?

Steps to reproduce

  1. Run:
    ### Run Subscription Security check
    Get-AzSKSubscriptionSecurityStatus -SubscriptionId $SubscriptionId -DoNotOpenOutputFolder
    
    ### Run Components Security check 
    Get-AzSKAzureServicesSecurityStatus -SubscriptionId $SubscriptionId -DoNotOpenOutputFolder
  2. Check output folders \AzSKLogs\Sub_SUBSCRIPTION_NAME\****_GSS\Etc and \AzSKLogs\Sub_SUBSCRIPTION_NAME\****_GRS\Etc if SecurityEvaluationData-xxxxx.json was created.

Expected behavior

SecurityEvaluationData-xxxxx.json exists

Actual behavior

SecurityEvaluationData-xxxxx.json does not exist

Thanks for your work ;)

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions