Implement CIS control 1.3.3: Ensure 'External sharing' of calendars is not available - #297
Implement CIS control 1.3.3: Ensure 'External sharing' of calendars is not available#297Trunaw wants to merge 1 commit into
Conversation
- Add Rego policy checking for enabled sharing policies with external domains - Policy distinguishes enabled vs disabled policies to avoid false failures - Add unit tests covering compliant, non-compliant, mixed and missing-data cases (7/7 passing) - Update metadata.json: automation_status not_started -> ready, link policy file
Preview EnvironmentA preview environment can be spun up on demand for this PR.
|
CI: Engine
All checks passed. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 05a9632cd9
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| policies_allowing_external := object.get(input, "policies_allowing_external", []) | ||
|
|
||
| enabled_external_policies := [p | | ||
| some p in policies_allowing_external | ||
| p.enabled == true |
There was a problem hiding this comment.
The CIS benchmark text in docs/engine/Framework/CIS_M365_Benchmarks.json:125 audits Get-SharingPolicy -Identity "Default Sharing Policy" | ft Name,Enabled and requires Enabled to be false, but this rule only derives failures from the collector's filtered policies_allowing_external list. Because the collector populates that list only when Domains is non-empty (engine/collectors/exchange/organization/sharing_policy.py:52-64), an enabled Default Sharing Policy with no domain entries would be reported compliant even though the benchmark's required Enabled check fails; evaluate input.default_policy.Enabled for the default policy directly.
Useful? React with 👍 / 👎.
1 participant
Summary
Implements the Rego policy for CIS Microsoft 365 Foundations control 1.3.3
(Ensure 'External sharing' of calendars is not available).
enabled AND have external domains configured (a disabled policy with domains defined
is still compliant)
and missing-data cases
Testing
with enabled=false -> policy correctly evaluates compliant=true