Skip to content

AzSK version 4.12 Security Status Report does not create SecurityEvaluationData json  #1201

@v1r7u

Description

@v1r7u

AzSK version 4.12 Security Status Report does not create SecurityEvaluationData json

Description

Up to version 4.11 AzSK creates SecurityEvaluationData-xxxxx.json file which contains audited environment description together with audit results. This file was a useful part of our automated pipeline and we used it to normalize audit-result: it had tags, the full azure-identifier of the resource, etc. Based on this file we were able to map results to exact azure components and get required metadata without additional requests to the Azure API.

In version 4.12 AzSK still writes Report in csv, but does not create SecurityEvaluationData json file.

Is it intentional behavior? Is it possible to keep this file generation in further version?

Steps to reproduce

  1. Run:
    ### Run Subscription Security check
    Get-AzSKSubscriptionSecurityStatus -SubscriptionId $SubscriptionId -DoNotOpenOutputFolder
    
    ### Run Components Security check 
    Get-AzSKAzureServicesSecurityStatus -SubscriptionId $SubscriptionId -DoNotOpenOutputFolder
  2. Check output folders \AzSKLogs\Sub_SUBSCRIPTION_NAME\****_GSS\Etc and \AzSKLogs\Sub_SUBSCRIPTION_NAME\****_GRS\Etc if SecurityEvaluationData-xxxxx.json was created.

Expected behavior

SecurityEvaluationData-xxxxx.json exists

Actual behavior

SecurityEvaluationData-xxxxx.json does not exist

Thanks for your work ;)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions