tools/tool-manifest.json
|
{ "schemaVersion": "2.2", "report_architecture": { "schemaVersion": "1.0", "default_tier": "PureJson", "headroom_factor": 1.25, "thresholds": { "findings": { "embedded": 10000, "sidecar": 100000, "pode": 500000 }, "entities": { "embedded": 10000, "sidecar": 100000, "pode": 500000 }, "edges": { "embedded": 2500, "pode": 50000 } }, "vendored_dependencies": [ { "name": "cytoscape", "placeholder": true, "verify_stub": "Test-CytoscapePlaceholder", "applicable_tiers": [ "EmbeddedSqlite", "SidecarSqlite", "PodeViewer" ] }, { "name": "dagre", "placeholder": true, "verify_stub": "Test-DagrePlaceholder", "applicable_tiers": [ "EmbeddedSqlite", "SidecarSqlite", "PodeViewer" ] }, { "name": "Pode", "placeholder": true, "verify_stub": "Test-PodePlaceholder", "applicable_tiers": [ "PodeViewer" ] }, { "name": "sqlite-wasm", "placeholder": true, "verify_stub": "Test-SqliteWasmPlaceholder", "applicable_tiers": [ "EmbeddedSqlite", "SidecarSqlite", "PodeViewer" ] } ] }, "tools": [ { "name": "ado-connections", "displayName": "ADO Service Connections", "source": "ado-connections", "provider": "ado", "scope": "ado", "normalizer": "Normalize-ADOConnections", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-ADOServiceConnections.ps1", "requiredParams": [ "AdoOrg" ], "optionalParams": [ "AdoProject", "AdoPat" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#0078d4", "phase": 2 }, "install": { "kind": "none" }, "frameworks": [ "NIST 800-53", "SOC2", "PCI-DSS" ] }, { "name": "ado-consumption", "displayName": "ADO Pipeline Consumption", "source": "ado-consumption", "provider": "ado", "scope": "ado", "normalizer": "Normalize-AdoConsumption", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-AdoConsumption.ps1", "requiredParams": [ "AdoOrg" ], "optionalParams": [ "AdoProject", "DaysBack", "MonthlyBudgetUsd", "AdoPat" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#5e35b1", "phase": 2 }, "install": { "kind": "none" }, "frameworks": [ "Azure CAF", "SOC2" ] }, { "name": "ado-pipeline-correlator", "displayName": "ADO Pipeline Run Correlator", "source": "ado-pipeline-correlator", "provider": "ado", "scope": "ado", "normalizer": "Normalize-ADOPipelineCorrelator", "invokeMethod": "script", "type": "correlator", "script": "modules/Invoke-ADOPipelineCorrelator.ps1", "requiredParams": [ "AdoOrg" ], "optionalParams": [ "AdoProject", "AdoPat", "SecretsFindingsPath" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#00838f", "phase": 2 }, "install": { "kind": "none" }, "frameworks": [ "NIST 800-53", "SOC2" ] }, { "name": "ado-pipelines", "displayName": "ADO Pipeline Security", "source": "ado-pipelines", "provider": "ado", "scope": "ado", "normalizer": "Normalize-ADOPipelineSecurity", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-ADOPipelineSecurity.ps1", "requiredParams": [ "AdoOrg" ], "optionalParams": [ "AdoProject", "AdoPat" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#006064", "phase": 2 }, "install": { "kind": "none" }, "frameworks": [ "NIST 800-53", "SOC2", "PCI-DSS" ] }, { "name": "ado-repos-secrets", "displayName": "ADO Repos Secret Scanning", "source": "ado-repos-secrets", "provider": "ado", "scope": "ado", "normalizer": "Normalize-ADORepoSecrets", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-ADORepoSecrets.ps1", "requiredParams": [ "AdoOrg" ], "optionalParams": [ "AdoProject", "AdoPat", "AdoOrganizationUrl", "AdoServerUrl", "OutputPath" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#ad1457", "phase": 2 }, "install": { "kind": "none" }, "frameworks": [ "NIST 800-53", "SOC2", "PCI-DSS" ] }, { "name": "aks-karpenter-cost", "displayName": "AKS Karpenter Cost (consolidation + node utilization)", "source": "aks-karpenter-cost", "provider": "azure", "scope": "subscription", "normalizer": "Normalize-AksKarpenterCost", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-AksKarpenterCost.ps1", "requiredParams": [ "SubscriptionId" ], "optionalParams": [ "ResourceGroup", "ClusterName", "LogAnalyticsWorkspaceId", "LookbackDays", "KubeconfigPath", "KubeContext", "Namespace", "KubeAuthMode", "KubeloginServerId", "KubeloginClientId", "KubeloginTenantId", "WorkloadIdentityClientId", "WorkloadIdentityTenantId", "WorkloadIdentityServiceAccountToken", "EnableElevatedRbac", "OutputPath" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "label": "AKS Karpenter Cost", "color": "#00695c", "phase": 4 }, "install": { "kind": "psmodule", "modules": [ "Az.Accounts", "Az.ResourceGraph", "Az.OperationalInsights" ] }, "frameworks": [ "Azure WAF", "Azure CAF" ] }, { "name": "aks-rightsizing", "displayName": "AKS Rightsizing (Container Insights utilization)", "source": "aks-rightsizing", "provider": "azure", "scope": "subscription", "normalizer": "Normalize-AksRightsizing", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-AksRightsizing.ps1", "requiredParams": [ "SubscriptionId" ], "optionalParams": [ "ResourceGroup", "ClusterName", "LogAnalyticsWorkspaceId", "LookbackDays", "OutputPath" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "label": "AKS Rightsizing", "color": "#2e7d32", "phase": 4 }, "install": { "kind": "psmodule", "modules": [ "Az.Accounts", "Az.ResourceGraph", "Az.OperationalInsights" ] }, "frameworks": [ "Azure WAF", "Azure CAF" ] }, { "name": "alz-queries", "displayName": "ALZ Resource Graph Queries", "source": "alz-queries", "provider": "azure", "scope": "managementGroup", "normalizer": "Normalize-AlzQueries", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-AlzQueries.ps1", "requiredParams": [ "SubscriptionId", "ManagementGroupId" ], "optionalParams": [ "QueriesFile" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#e65100", "phase": 1 }, "install": { "kind": "psmodule", "modules": [ "Az.ResourceGraph" ] }, "upstream": { "repo": "martinopedal/alz-graph-queries", "releaseApi": "https://api.github.com/repos/martinopedal/alz-graph-queries/commits/main", "pinType": "sha", "currentPin": "58867cb377b4" }, "frameworks": [ "CIS Azure", "NIST 800-53", "Azure WAF", "Azure CAF" ] }, { "name": "amass", "displayName": "OWASP Amass (passive subdomain enum)", "source": "amass", "provider": "easm", "scope": "tenant", "normalizer": "Normalize-Amass", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-Amass.ps1", "requiredParams": [], "optionalParams": [ "SeedFile" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": false, "report": { "color": "#00838f", "phase": 4 }, "install": { "kind": "cli", "command": "amass", "preferredManagers": [ "brew", "snap" ], "windows": { "url": "https://github.com/owasp-amass/amass/releases/latest" }, "macos": { "brew": "amass" }, "linux": { "snap": "amass" } }, "upstream": { "repo": "owasp-amass/amass", "releaseApi": "https://api.github.com/repos/owasp-amass/amass/releases/latest", "pinType": "cli-version", "currentPin": "5.1.1" }, "comment": "EASM passive subdomain enumeration. Wrapper ships in R2; manifest entry pre-registered so report wiring (R5) sees the entry.", "frameworks": [ "NIST 800-53" ] }, { "name": "appinsights", "displayName": "Application Insights Performance Signals", "source": "appinsights", "provider": "azure", "scope": "subscription", "normalizer": "Normalize-AppInsights", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-AppInsights.ps1", "requiredParams": [ "SubscriptionId" ], "optionalParams": [ "ResourceGroup", "AppInsightsName", "TimeRangeHours", "OutputPath" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "label": "App Insights", "color": "#00838f", "phase": 4 }, "install": { "kind": "psmodule", "modules": [ "Az.Accounts", "Az.ApplicationInsights", "Az.Monitor" ] }, "frameworks": [ "Azure WAF" ] }, { "name": "azgovviz", "displayName": "AzGovViz", "source": "azgovviz", "provider": "azure", "scope": "managementGroup", "normalizer": "Normalize-AzGovViz", "invokeMethod": "script", "comment": "Auto-cloned into tools/AzGovViz/ on first run if missing. Normalizer emits policy edge relations for policy-enforcement visualization.", "type": "collector", "script": "modules/Invoke-AzGovViz.ps1", "requiredParams": [ "ManagementGroupId" ], "optionalParams": [ "OutputPath" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#00838f", "phase": 1 }, "install": { "kind": "gitclone", "repo": "https://github.com/JulianHayward/Azure-MG-Sub-Governance-Reporting", "target": "tools/AzGovViz", "probe": "AzGovVizParallel.ps1" }, "upstream": { "repo": "JulianHayward/Azure-MG-Sub-Governance-Reporting", "releaseApi": "https://api.github.com/repos/JulianHayward/Azure-MG-Sub-Governance-Reporting/commits/master", "pinType": "sha", "currentPin": "11b4206b2c9e" }, "frameworks": [ "Azure WAF", "Azure CAF" ] }, { "name": "azqr", "displayName": "Azure Quick Review", "source": "azqr", "provider": "azure", "scope": "subscription", "normalizer": "Normalize-Azqr", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-Azqr.ps1", "requiredParams": [ "SubscriptionId" ], "required_inputs": [ { "name": "SubscriptionId", "type": "guid", "prompt": "Enter the Azure subscription ID to scan with azqr", "envVar": "AZURE_SUBSCRIPTION_ID", "example": "00000000-0000-0000-0000-000000000000", "validator": "^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$", "conditional": { "param": "ManagementGroupId", "equals": "" } } ], "optionalParams": [ "OutputPath" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#1565c0", "phase": 1 }, "install": { "kind": "cli", "command": "azqr", "preferredManagers": [ "winget", "brew" ], "windows": { "winget": "Microsoft.Azure.QuickReview" }, "macos": { "brew": "azure/azqr/azqr" }, "linux": { "url": "https://github.com/Azure/azqr/releases/latest" } }, "upstream": { "repo": "Azure/azqr", "releaseApi": "https://api.github.com/repos/Azure/azqr/releases/latest", "pinType": "cli-version", "currentPin": "latest" }, "frameworks": [ "Azure WAF", "Azure CAF" ] }, { "name": "azure-cost", "displayName": "Azure Cost (Consumption API)", "source": "azure-cost", "provider": "azure", "scope": "subscription", "normalizer": "Normalize-AzureCost", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-AzureCost.ps1", "requiredParams": [ "SubscriptionId" ], "optionalParams": [ "TopN", "OutputPath" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#388e3c", "phase": 4 }, "install": { "kind": "psmodule", "modules": [ "Az.Accounts" ] }, "frameworks": [ "Azure CAF" ] }, { "name": "azure-quota", "displayName": "Azure Quota Reports", "source": "azure-quota", "provider": "azure", "scope": "subscription", "normalizer": "Normalize-AzureQuotaReports", "invokeMethod": "script", "comment": "Manifest registration only; wrapper + normalizer will land in #322-#325.", "type": "collector", "script": "modules/Invoke-AzureQuotaReports.ps1", "requiredParams": [ "SubscriptionId" ], "optionalParams": [ "OutputPath" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "source": "azure-quota", "label": "Azure Quota", "color": "#455a64", "phase": 4, "pillar": "Reliability", "category": "Capacity" }, "install": { "kind": "cli", "command": "az", "commands": [ "az" ] }, "upstream": { "repo": "martinopedal/azure-quota-reports" }, "frameworks": [ "Azure WAF", "Azure CAF" ] }, { "name": "azurehound", "displayName": "AzureHound (SpecterOps attack-path collector)", "source": "azurehound", "provider": "graph", "scope": "tenant", "normalizer": "Normalize-Azurehound", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-Azurehound.ps1", "requiredParams": [], "optionalParams": [], "requiredPermissionTier": 3, "platforms": [ "windows", "macos", "linux" ], "enabled": false, "report": { "color": "#1565c0", "phase": 2 }, "install": { "kind": "cli", "command": "azurehound", "preferredManagers": [ "brew", "winget" ], "windows": { "url": "https://github.com/SpecterOps/AzureHound/releases/latest" }, "macos": { "brew": "azurehound" }, "linux": { "url": "https://github.com/SpecterOps/AzureHound/releases/latest" } }, "comment": "Graph mapping family. Pre-registered as enabled:false; wrapper ships in R2 (see docs/design/graph-mapping-integration.md).", "frameworks": [ "NIST 800-53" ] }, { "name": "bicep-iac", "displayName": "Bicep IaC Validation", "source": "bicep-iac", "provider": "cli", "scope": "repository", "normalizer": "Normalize-IaCBicep", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-IaCBicep.ps1", "requiredParams": [], "optionalParams": [ "RepoPath", "RemoteUrl" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#0d47a1", "phase": 7 }, "install": { "kind": "cli", "command": "bicep", "windows": { "winget": "Microsoft.Bicep" }, "macos": { "brew": "bicep" }, "linux": { "url": "https://github.com/Azure/bicep/releases/latest", "note": "No package manager available for Linux; download the binary from the releases page and place on PATH. See https://learn.microsoft.com/azure/azure-resource-manager/bicep/install#linux" } }, "upstream": { "repo": "Azure/bicep", "releaseApi": "https://api.github.com/repos/Azure/bicep/releases/latest", "pinType": "cli-version", "currentPin": "0.46.1" }, "frameworks": [ "CIS Azure", "NIST 800-53", "Azure WAF", "Azure CAF" ] }, { "name": "bloodhound-ce", "displayName": "BloodHound CE (Neo4j ingest helper)", "source": "bloodhound-ce", "provider": "graph", "scope": "tenant", "normalizer": "Normalize-BloodhoundCe", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-BloodhoundCe.ps1", "requiredParams": [], "optionalParams": [], "requiredPermissionTier": 3, "platforms": [ "windows", "macos", "linux" ], "enabled": false, "report": { "color": "#0d47a1", "phase": 2 }, "install": { "kind": "none" }, "comment": "Graph mapping family. Pre-registered as enabled:false; wrapper ships in R3 (Neo4j ingest of AzureHound JSON).", "frameworks": [ "NIST 800-53" ] }, { "name": "censys", "displayName": "Censys Search (cert transparency + host scan)", "source": "censys", "provider": "easm", "scope": "tenant", "normalizer": "Normalize-Censys", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-Censys.ps1", "requiredParams": [], "optionalParams": [ "SeedFile" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": false, "report": { "color": "#5c6bc0", "phase": 4 }, "install": { "kind": "none" }, "comment": "EASM commercial: requires CENSYS_API_ID + CENSYS_API_SECRET env vars. Wrapper ships in R3.", "frameworks": [ "NIST 800-53" ] }, { "name": "conditional-access-graph", "displayName": "Conditional Access Policy Graph", "source": "conditional-access-graph", "provider": "graph", "scope": "tenant", "normalizer": "Normalize-ConditionalAccessGraph", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-ConditionalAccessGraph.ps1", "requiredParams": [], "optionalParams": [ "TenantId", "PreFetchedData" ], "requiredPermissionTier": 2, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#6a1b9a", "phase": 2 }, "install": { "kind": "psmodule", "modules": [ "Microsoft.Graph.Authentication", "Microsoft.Graph.Identity.SignIns", "Microsoft.Graph.Identity.DirectoryManagement" ] }, "frameworks": [ "NIST 800-53", "CIS Controls v8", "SOC2" ] }, { "name": "copilot-triage", "displayName": "Copilot AI Triage", "source": "copilot-triage", "provider": "cli", "scope": "repository", "normalizer": null, "invokeMethod": "script", "type": "enrichment", "script": "modules/shared/Triage/Invoke-CopilotTriage.ps1", "requiredParams": [], "optionalParams": [ "InputPath", "OutputPath" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": false, "report": { "color": "#6a1b9a", "phase": 8 }, "install": { "kind": "none" }, "comment": "Requires GitHub Copilot SDK token; opt-in via -EnableAiTriage switch.", "frameworks": [] }, { "name": "defender-easm", "displayName": "Microsoft Defender EASM (workspace consumer)", "source": "defender-easm", "provider": "azure", "scope": "subscription", "normalizer": "Normalize-DefenderEasm", "invokeMethod": "script", "type": "enrichment", "script": "modules/Invoke-DefenderEasm.ps1", "requiredParams": [ "SubscriptionId" ], "optionalParams": [ "WorkspaceName", "ResourceGroupName" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": false, "report": { "color": "#0078d4", "phase": 4 }, "install": { "kind": "psmodule", "modules": [ "Az.Accounts" ] }, "comment": "Consumes findings from a provisioned Microsoft Defender EASM workspace. Reader on Microsoft.Easm/workspaces. Wrapper ships in R4.", "frameworks": [ "MCSB", "NIST 800-53" ] }, { "name": "defender-for-cloud", "displayName": "Microsoft Defender for Cloud", "source": "defender-for-cloud", "provider": "azure", "scope": "subscription", "normalizer": "Normalize-DefenderForCloud", "invokeMethod": "script", "type": "enrichment", "script": "modules/Invoke-DefenderForCloud.ps1", "requiredParams": [ "SubscriptionId" ], "optionalParams": [ "OutputPath" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#0078d4", "phase": 4 }, "install": { "kind": "psmodule", "modules": [ "Az.Accounts" ] }, "frameworks": [ "CIS Azure", "NIST 800-53", "Azure WAF", "Azure CAF", "SOC2", "PCI-DSS" ] }, { "name": "dnstwist", "displayName": "DNSTwist (typosquat / homoglyph detection)", "source": "dnstwist", "provider": "easm", "scope": "tenant", "normalizer": "Normalize-DnsTwist", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-DnsTwist.ps1", "requiredParams": [], "optionalParams": [ "SeedFile" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#ad1457", "phase": 4 }, "install": { "kind": "cli", "command": "dnstwist", "preferredManagers": [ "pipx", "pip", "brew" ], "windows": { "pipx": "dnstwist" }, "macos": { "brew": "dnstwist" }, "linux": { "pipx": "dnstwist" } }, "upstream": { "repo": "elceef/dnstwist", "releaseApi": "https://api.github.com/repos/elceef/dnstwist/releases/latest", "pinType": "cli-version", "currentPin": "20250130" }, "frameworks": [ "NIST 800-53" ] }, { "name": "entra-permissions-mgmt", "displayName": "Microsoft Entra Permissions Management (RBAC right-sizing)", "source": "entra-permissions-mgmt", "provider": "graph", "scope": "tenant", "normalizer": "Normalize-EntraPermissionsMgmt", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-EntraPermissionsMgmt.ps1", "requiredParams": [], "optionalParams": [], "requiredPermissionTier": 3, "platforms": [ "windows", "macos", "linux" ], "enabled": false, "report": { "color": "#283593", "phase": 2 }, "install": { "kind": "psmodule", "modules": [ "Microsoft.Graph.Authentication" ] }, "comment": "Graph mapping family. Pre-registered as enabled:false; wrapper ships in R3 (REST endpoints under entrapermissionsmanagement.microsoft.com).", "frameworks": [ "NIST 800-53", "SOC2" ] }, { "name": "falco", "displayName": "Falco (AKS runtime anomaly detection)", "source": "falco", "provider": "azure", "scope": "subscription", "normalizer": "Normalize-Falco", "invokeMethod": "script", "type": "scanner", "script": "modules/Invoke-Falco.ps1", "requiredParams": [ "SubscriptionId" ], "optionalParams": [ "ClusterArmIds", "InstallFalco", "UninstallFalco", "CaptureMinutes" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#ef6c00", "phase": 6 }, "install": { "kind": "psmodule", "modules": [ "Az.ResourceGraph" ], "comment": "Query mode uses Az.ResourceGraph; -InstallFalco opt-in mode also requires helm and kubectl on PATH." }, "upstream": { "repo": "falcosecurity/falco", "releaseApi": "https://api.github.com/repos/falcosecurity/falco/releases/latest", "pinType": "cli-version", "currentPin": "0.44.1" }, "frameworks": [ "CIS Azure", "NIST 800-53" ] }, { "name": "finops", "displayName": "FinOps Signals (Idle Resource Detection)", "source": "finops", "provider": "azure", "scope": "subscription", "normalizer": "Normalize-FinOpsSignals", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-FinOpsSignals.ps1", "requiredParams": [ "SubscriptionId" ], "optionalParams": [ "OutputPath", "QueryFiles" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "label": "FinOps Signals", "color": "#00897b", "phase": 4 }, "install": { "kind": "psmodule", "modules": [ "Az.CostManagement", "Az.ResourceGraph" ] }, "frameworks": [ "Azure WAF", "Azure CAF" ] }, { "name": "forest-druid", "displayName": "Semperis Forest Druid (commercial, gated)", "source": "forest-druid", "provider": "graph", "scope": "tenant", "normalizer": "Normalize-ForestDruid", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-ForestDruid.ps1", "requiredParams": [], "optionalParams": [], "requiredPermissionTier": 3, "platforms": [ "windows", "macos", "linux" ], "enabled": false, "report": { "color": "#37474f", "phase": 2 }, "install": { "kind": "none" }, "comment": "Graph mapping family. Commercial; gated on env-var presence. Wrapper ships in R4.", "frameworks": [ "NIST 800-53" ] }, { "name": "gh-actions-billing", "displayName": "GitHub Actions Billing", "source": "gh-actions-billing", "provider": "github", "scope": "repository", "normalizer": "Normalize-GhActionsBilling", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-GhActionsBilling.ps1", "requiredParams": [ "Org" ], "optionalParams": [ "Repo", "DaysBack", "MonthlyBudgetUsd" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#8e24aa", "phase": 1 }, "install": { "kind": "cli", "command": "gh", "preferredManagers": [ "winget", "brew" ], "windows": { "winget": "GitHub.cli" }, "macos": { "brew": "gh" }, "linux": { "url": "https://cli.github.com/" } }, "frameworks": [ "Azure CAF", "SOC2" ] }, { "name": "gitleaks", "displayName": "gitleaks (Secrets Scanner)", "source": "gitleaks", "provider": "cli", "scope": "repository", "normalizer": "Normalize-Gitleaks", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-Gitleaks.ps1", "requiredParams": [], "required_inputs": [], "optionalParams": [ "RepoPath", "NoGit" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#c62828", "phase": 3 }, "install": { "kind": "cli", "command": "gitleaks", "preferredManagers": [ "winget", "brew" ], "windows": { "winget": "gitleaks.gitleaks" }, "macos": { "brew": "gitleaks" }, "linux": { "url": "https://github.com/gitleaks/gitleaks/releases/latest" } }, "upstream": { "repo": "gitleaks/gitleaks", "releaseApi": "https://api.github.com/repos/gitleaks/gitleaks/releases/latest", "pinType": "cli-version", "currentPin": "8.30.1" }, "frameworks": [ "NIST 800-53", "SOC2", "PCI-DSS" ] }, { "name": "graphrunner", "displayName": "GraphRunner (post-compromise Graph enumeration, passive)", "source": "graphrunner", "provider": "graph", "scope": "tenant", "normalizer": "Normalize-Graphrunner", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-Graphrunner.ps1", "requiredParams": [], "optionalParams": [], "requiredPermissionTier": 3, "platforms": [ "windows", "macos", "linux" ], "enabled": false, "report": { "color": "#4527a0", "phase": 2 }, "install": { "kind": "gitclone", "repo": "https://github.com/dafthack/GraphRunner.git", "ref": "main" }, "comment": "Graph mapping family. Pre-registered as enabled:false; wrapper ships in R2 (passive read-only mode only).", "frameworks": [ "NIST 800-53" ] }, { "name": "httpx", "displayName": "httpx (ProjectDiscovery host probe)", "source": "httpx", "provider": "easm", "scope": "tenant", "normalizer": "Normalize-Httpx", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-Httpx.ps1", "requiredParams": [], "optionalParams": [ "SeedFile" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": false, "report": { "color": "#2e7d32", "phase": 4 }, "install": { "kind": "cli", "command": "httpx", "preferredManagers": [ "brew" ], "windows": { "url": "https://github.com/projectdiscovery/httpx/releases/latest" }, "macos": { "brew": "httpx" }, "linux": { "url": "https://github.com/projectdiscovery/httpx/releases/latest" } }, "upstream": { "repo": "projectdiscovery/httpx", "releaseApi": "https://api.github.com/repos/projectdiscovery/httpx/releases/latest", "pinType": "cli-version", "currentPin": "1.10.0" }, "comment": "EASM passive host probe. Wrapper ships in R2.", "frameworks": [ "NIST 800-53" ] }, { "name": "identity-correlator", "displayName": "Identity Correlator", "source": "identity-correlator", "provider": "graph", "scope": "tenant", "normalizer": "Normalize-IdentityCorrelation", "entryFunction": "Invoke-IdentityCorrelation", "invokeMethod": "function", "type": "correlator", "script": "modules/Invoke-IdentityCorrelator.ps1", "requiredParams": [ "TenantId" ], "optionalParams": [ "IncludeGraphLookup" ], "requiredPermissionTier": 3, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#5e35b1", "phase": 2 }, "install": { "kind": "psmodule", "modules": [ "Microsoft.Graph.Authentication", "Microsoft.Graph.Applications" ] }, "frameworks": [ "NIST 800-53", "SOC2", "PCI-DSS" ] }, { "name": "identity-graph-expansion", "displayName": "Identity Graph Expansion", "source": "identity-graph-expansion", "provider": "graph", "scope": "tenant", "normalizer": "Normalize-IdentityGraphExpansion", "entryFunction": "Invoke-IdentityGraphExpansion", "invokeMethod": "function", "type": "correlator", "script": "modules/Invoke-IdentityGraphExpansion.ps1", "requiredParams": [ "TenantId" ], "optionalParams": [ "IncludeGraphLookup" ], "requiredPermissionTier": 3, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#283593", "phase": 2 }, "install": { "kind": "psmodule", "modules": [ "Microsoft.Graph.Authentication", "Microsoft.Graph.Users", "Microsoft.Graph.Identity.SignIns", "Microsoft.Graph.Groups", "Microsoft.Graph.Applications", "Az.Resources" ] }, "frameworks": [ "NIST 800-53", "SOC2" ] }, { "name": "infracost", "displayName": "Infracost IaC Cost Estimation", "source": "infracost", "provider": "cli", "scope": "repository", "normalizer": "Normalize-Infracost", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-Infracost.ps1", "requiredParams": [], "optionalParams": [ "Path", "Repository", "RemoteUrl", "RepoPath" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#2e7d32", "phase": 7 }, "install": { "kind": "cli", "command": "infracost", "preferredManagers": [ "winget", "brew" ], "windows": { "winget": "Infracost.Infracost" }, "macos": { "brew": "infracost" }, "linux": { "url": "https://www.infracost.io/docs/" } }, "upstream": { "repo": "infracost/infracost", "releaseApi": "https://api.github.com/repos/infracost/infracost/releases/latest", "pinType": "cli-version", "currentPin": "0.10.45" }, "frameworks": [ "Azure CAF" ] }, { "name": "kube-bench", "displayName": "kube-bench (AKS node-level CIS compliance)", "source": "kube-bench", "provider": "azure", "scope": "subscription", "normalizer": "Normalize-KubeBench", "invokeMethod": "script", "type": "scanner", "script": "modules/Invoke-KubeBench.ps1", "requiredParams": [ "SubscriptionId" ], "optionalParams": [ "ClusterArmIds", "OutputPath", "JobTimeoutSeconds", "KubeBenchImage" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#5e35b1", "phase": 6 }, "install": { "kind": "none" }, "frameworks": [ "CIS Azure" ] }, { "name": "kubescape", "displayName": "Kubescape (AKS runtime posture)", "source": "kubescape", "provider": "azure", "scope": "subscription", "normalizer": "Normalize-Kubescape", "invokeMethod": "script", "type": "scanner", "script": "modules/Invoke-Kubescape.ps1", "requiredParams": [ "SubscriptionId" ], "required_inputs": [ { "name": "SubscriptionId", "type": "guid", "prompt": "Enter the Azure subscription ID to scan with kubescape", "envVar": "AZURE_SUBSCRIPTION_ID", "example": "00000000-0000-0000-0000-000000000000", "validator": "^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$", "conditional": { "param": "ManagementGroupId", "equals": "" } } ], "optionalParams": [ "ClusterArmIds", "OutputPath" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#7b1fa2", "phase": 6 }, "install": { "kind": "cli", "command": "kubescape", "preferredManagers": [ "winget", "brew" ], "windows": { "manager": "winget", "package": "ARMO.kubescape" }, "macos": { "manager": "brew", "package": "kubescape" }, "linux": { "manager": "script", "url": "https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh" } }, "upstream": { "repo": "kubescape/kubescape", "releaseApi": "https://api.github.com/repos/kubescape/kubescape/releases/latest", "pinType": "version", "currentPin": "4.0.11" }, "frameworks": [ "CIS Azure", "NIST 800-53" ] }, { "name": "loadtesting", "displayName": "Azure Load Testing (Failed and Regressed Runs)", "source": "loadtesting", "provider": "azure", "scope": "subscription", "normalizer": "Normalize-AzureLoadTesting", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-AzureLoadTesting.ps1", "requiredParams": [ "SubscriptionId" ], "optionalParams": [ "ResourceGroup", "LoadTestResourceName", "DaysBack", "RegressionThresholdPercent", "IncludeHealthyRuns", "OutputPath" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "label": "Load Testing", "color": "#00695c", "phase": 4 }, "install": { "kind": "psmodule", "modules": [ "Az.Accounts", "Az.LoadTesting" ] }, "frameworks": [ "Azure WAF" ] }, { "name": "maester", "displayName": "Maester", "source": "maester", "provider": "microsoft365", "scope": "tenant", "normalizer": "Normalize-Maester", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-Maester.ps1", "requiredParams": [], "optionalParams": [], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#7b1fa2", "phase": 1 }, "install": { "kind": "psmodule", "modules": [ "Maester" ] }, "upstream": { "repo": "maester365/maester", "releaseApi": "https://api.github.com/repos/maester365/maester/releases/latest", "pinType": "psmodule-version", "currentPin": "2.2.0" }, "frameworks": [ "NIST 800-53", "SOC2", "PCI-DSS" ] }, { "name": "pim-graph", "displayName": "PIM Eligibility / Activation Graph", "source": "pim-graph", "provider": "graph", "scope": "tenant", "normalizer": "Normalize-PimGraph", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-PimGraph.ps1", "requiredParams": [], "optionalParams": [], "requiredPermissionTier": 3, "platforms": [ "windows", "macos", "linux" ], "enabled": false, "report": { "color": "#7b1fa2", "phase": 2 }, "install": { "kind": "psmodule", "modules": [ "Microsoft.Graph.Authentication", "Microsoft.Graph.Identity.Governance" ] }, "comment": "Graph mapping family. Pre-registered as enabled:false; wrapper ships in R2.", "frameworks": [ "NIST 800-53", "SOC2", "PCI-DSS" ] }, { "name": "powerpipe", "displayName": "Powerpipe Compliance Benchmarks", "source": "powerpipe", "provider": "azure", "scope": "subscription", "normalizer": "Normalize-Powerpipe", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-Powerpipe.ps1", "requiredParams": [ "SubscriptionId" ], "optionalParams": [ "Benchmark" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#455a64", "phase": 1 }, "install": { "kind": "cli", "command": "powerpipe", "preferredManagers": [ "winget", "brew" ], "windows": { "manager": "winget", "package": "Turbot.Powerpipe" }, "macos": { "manager": "brew", "package": "turbot/tap/powerpipe" }, "linux": { "url": "https://powerpipe.io/downloads" } }, "upstream": { "repo": "turbot/powerpipe", "releaseApi": "https://api.github.com/repos/turbot/powerpipe/releases/latest", "pinType": "cli-version", "currentPin": "1.5.2" }, "frameworks": [ "CIS Azure", "NIST 800-53", "PCI-DSS", "SOC2" ] }, { "name": "prowler", "displayName": "Prowler (Azure security posture)", "source": "prowler", "provider": "azure", "scope": "subscription", "normalizer": "Normalize-Prowler", "invokeMethod": "script", "type": "scanner", "script": "modules/Invoke-Prowler.ps1", "requiredParams": [ "SubscriptionId" ], "required_inputs": [ { "name": "SubscriptionId", "type": "guid", "prompt": "Enter the Azure subscription ID to scan with prowler", "envVar": "AZURE_SUBSCRIPTION_ID", "example": "00000000-0000-0000-0000-000000000000", "validator": "^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$", "conditional": { "param": "ManagementGroupId", "equals": "" } } ], "optionalParams": [ "OutputPath" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#1f2937", "phase": 4 }, "install": { "kind": "cli", "command": "prowler", "preferredManagers": [ "brew", "pipx" ], "windows": { "pipx": "prowler" }, "macos": { "brew": "prowler" }, "linux": { "pipx": "prowler" } }, "upstream": { "repo": "prowler-cloud/prowler", "releaseApi": "https://api.github.com/repos/prowler-cloud/prowler/releases/latest", "pinType": "cli-version", "currentPin": "5.36.0" }, "frameworks": [ "CIS Azure", "NIST 800-53", "ISO27001", "PCI-DSS", "HIPAA", "SOC2", "MITRE", "GDPR", "FedRAMP" ] }, { "name": "psrule", "displayName": "PSRule for Azure", "source": "psrule", "provider": "azure", "scope": "subscription", "normalizer": "Normalize-PSRule", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-PSRule.ps1", "requiredParams": [ "SubscriptionId" ], "optionalParams": [ "Path" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#6a1b9a", "phase": 1 }, "install": { "kind": "psmodule", "modules": [ "PSRule", "PSRule.Rules.Azure" ] }, "upstream": { "repo": "microsoft/PSRule.Rules.Azure", "releaseApi": "https://api.github.com/repos/microsoft/PSRule.Rules.Azure/releases/latest", "pinType": "psmodule-version", "currentPin": "1.47.0" }, "frameworks": [ "CIS Azure", "NIST 800-53", "Azure WAF", "Azure CAF" ] }, { "name": "roadrecon", "displayName": "ROADrecon (Dirk-jan Mollema OSS Entra graph)", "source": "roadrecon", "provider": "graph", "scope": "tenant", "normalizer": "Normalize-Roadrecon", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-Roadrecon.ps1", "requiredParams": [], "optionalParams": [], "requiredPermissionTier": 3, "platforms": [ "windows", "macos", "linux" ], "enabled": false, "report": { "color": "#311b92", "phase": 2 }, "install": { "kind": "cli", "command": "roadrecon", "preferredManagers": [ "pipx", "pip" ], "windows": { "pipx": "roadrecon" }, "macos": { "pipx": "roadrecon" }, "linux": { "pipx": "roadrecon" } }, "comment": "Graph mapping family. Pre-registered as enabled:false; wrapper ships in R2 (requires pre-warmed token cache for unattended runs).", "frameworks": [ "NIST 800-53" ] }, { "name": "scorecard", "displayName": "OpenSSF Scorecard", "source": "scorecard", "provider": "github", "scope": "repository", "normalizer": "Normalize-Scorecard", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-Scorecard.ps1", "requiredParams": [ "Repository" ], "optionalParams": [ "Threshold" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#ff6f00", "phase": 1 }, "install": { "kind": "cli", "command": "scorecard", "preferredManagers": [ "winget", "brew" ], "windows": { "winget": "ossf.scorecard" }, "macos": { "brew": "scorecard" }, "linux": { "url": "https://github.com/ossf/scorecard/releases/latest" } }, "upstream": { "repo": "ossf/scorecard", "releaseApi": "https://api.github.com/repos/ossf/scorecard/releases/latest", "pinType": "cli-version", "currentPin": "5.5.0" }, "frameworks": [ "NIST 800-53", "SOC2" ] }, { "name": "sentinel-coverage", "displayName": "Microsoft Sentinel (Coverage / Posture)", "source": "sentinel-coverage", "provider": "azure", "scope": "workspace", "normalizer": "Normalize-SentinelCoverage", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-SentinelCoverage.ps1", "requiredParams": [ "WorkspaceResourceId" ], "optionalParams": [ "LookbackDays", "OutputPath" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#3949ab", "phase": 4 }, "install": { "kind": "psmodule", "modules": [ "Az.Accounts" ] }, "comment": "Surfaces Sentinel detection posture (analytic rules, watchlists, connectors, hunting queries) via Microsoft.SecurityInsights REST. Read-only; pairs with sentinel-incidents.", "frameworks": [ "NIST 800-53", "SOC2", "PCI-DSS", "Azure WAF" ] }, { "name": "sentinel-incidents", "displayName": "Microsoft Sentinel (Active Incidents)", "source": "sentinel-incidents", "provider": "azure", "scope": "workspace", "normalizer": "Normalize-SentinelIncidents", "invokeMethod": "script", "type": "enrichment", "script": "modules/Invoke-SentinelIncidents.ps1", "requiredParams": [ "WorkspaceResourceId" ], "optionalParams": [ "LookbackDays", "OutputPath" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#0078d4", "phase": 4 }, "install": { "kind": "psmodule", "modules": [ "Az.Accounts" ] }, "frameworks": [ "NIST 800-53", "SOC2" ] }, { "name": "shodan", "displayName": "Shodan (internet-wide host/service scan)", "source": "shodan", "provider": "easm", "scope": "tenant", "normalizer": "Normalize-Shodan", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-Shodan.ps1", "requiredParams": [], "optionalParams": [ "SeedFile" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": false, "report": { "color": "#d32f2f", "phase": 4 }, "install": { "kind": "none" }, "comment": "EASM commercial: requires SHODAN_API_KEY env var. Wrapper ships in R3.", "frameworks": [ "NIST 800-53" ] }, { "name": "subfinder", "displayName": "Subfinder (ProjectDiscovery passive subdomain enum)", "source": "subfinder", "provider": "easm", "scope": "tenant", "normalizer": "Normalize-Subfinder", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-Subfinder.ps1", "requiredParams": [], "optionalParams": [ "SeedFile" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": false, "report": { "color": "#00695c", "phase": 4 }, "install": { "kind": "cli", "command": "subfinder", "preferredManagers": [ "brew" ], "windows": { "url": "https://github.com/projectdiscovery/subfinder/releases/latest" }, "macos": { "brew": "subfinder" }, "linux": { "url": "https://github.com/projectdiscovery/subfinder/releases/latest" } }, "upstream": { "repo": "projectdiscovery/subfinder", "releaseApi": "https://api.github.com/repos/projectdiscovery/subfinder/releases/latest", "pinType": "cli-version", "currentPin": "2.14.0" }, "comment": "EASM passive subdomain enumeration. Wrapper ships in R2.", "frameworks": [ "NIST 800-53" ] }, { "name": "terraform-iac", "displayName": "Terraform IaC Validation", "source": "terraform-iac", "provider": "cli", "scope": "repository", "normalizer": "Normalize-IaCTerraform", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-IaCTerraform.ps1", "requiredParams": [], "optionalParams": [ "RepoPath", "RemoteUrl" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#5c4ee5", "phase": 7 }, "install": { "kind": "cli", "command": "terraform", "windows": { "winget": "Hashicorp.Terraform" }, "macos": { "brew": "terraform" }, "linux": { "url": "https://developer.hashicorp.com/terraform/install" } }, "upstream": { "repo": "hashicorp/terraform", "releaseApi": "https://api.github.com/repos/hashicorp/terraform/releases/latest", "pinType": "cli-version", "currentPin": "1.15.8" }, "frameworks": [ "CIS Azure", "NIST 800-53", "Azure WAF", "Azure CAF" ] }, { "name": "trivy", "displayName": "Trivy Vulnerability Scanner", "source": "trivy", "provider": "cli", "scope": "repository", "normalizer": "Normalize-Trivy", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-Trivy.ps1", "requiredParams": [], "optionalParams": [ "ScanPath", "ScanType" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#00695c", "phase": 3 }, "install": { "kind": "cli", "command": "trivy", "preferredManagers": [ "winget", "brew" ], "windows": { "winget": "AquaSecurity.Trivy" }, "macos": { "brew": "trivy" }, "linux": { "url": "https://github.com/aquasecurity/trivy/releases/latest" } }, "upstream": { "repo": "aquasecurity/trivy", "releaseApi": "https://api.github.com/repos/aquasecurity/trivy/releases/latest", "pinType": "cli-version", "currentPin": "0.72.0" }, "frameworks": [ "CIS Azure", "NIST 800-53", "PCI-DSS" ] }, { "name": "wara", "displayName": "Well-Architected Reliability Assessment", "source": "wara", "provider": "azure", "scope": "subscription", "normalizer": "Normalize-WARA", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-WARA.ps1", "requiredParams": [ "SubscriptionId" ], "optionalParams": [ "TenantId", "OutputPath" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#2e7d32", "phase": 1 }, "install": { "kind": "psmodule", "modules": [ "WARA" ] }, "upstream": { "repo": "Azure/Azure-Proactive-Resiliency-Library-v2", "releaseApi": "https://api.github.com/repos/Azure/Azure-Proactive-Resiliency-Library-v2/releases/latest", "pinType": "psmodule-version", "currentPin": "latest" }, "frameworks": [ "Azure WAF", "Azure CAF" ] }, { "name": "zizmor", "displayName": "zizmor (Actions YAML Scanner)", "source": "zizmor", "provider": "cli", "scope": "repository", "normalizer": "Normalize-Zizmor", "invokeMethod": "script", "type": "collector", "script": "modules/Invoke-Zizmor.ps1", "requiredParams": [], "required_inputs": [], "optionalParams": [ "Repository", "WorkflowPath" ], "requiredPermissionTier": 0, "platforms": [ "windows", "macos", "linux" ], "enabled": true, "report": { "color": "#ad1457", "phase": 3 }, "install": { "kind": "cli", "command": "zizmor", "preferredManagers": [ "pipx", "brew" ], "windows": { "pipx": "zizmor" }, "macos": { "brew": "zizmor" }, "linux": { "pipx": "zizmor" } }, "upstream": { "repo": "woodruffw/zizmor", "releaseApi": "https://api.github.com/repos/woodruffw/zizmor/releases/latest", "pinType": "cli-version", "currentPin": "1.29.0" }, "frameworks": [ "NIST 800-53", "SOC2" ] } ], "prerequisites": [ { "name": "kubelogin", "displayName": "Azure kubelogin (AAD exec plugin)", "purpose": "Required by Invoke-Kubescape / Invoke-Falco / Invoke-KubeBench when -KubeAuthMode is 'Kubelogin' or 'WorkloadIdentity'. Converts kubeconfig exec plugin entries to use AAD tokens (azurecli / spn / msi / workloadidentity).", "consumedBy": [ "kubescape", "falco", "kube-bench" ], "install": { "kind": "cli", "command": "kubelogin", "preferredManagers": [ "winget", "brew" ], "windows": { "manager": "winget", "package": "Azure.Kubelogin" }, "macos": { "manager": "brew", "package": "Azure/kubelogin/kubelogin" }, "linux": { "manager": "script", "url": "https://github.com/Azure/kubelogin/releases" } }, "fallback": "az aks install-cli (also installs kubectl)" } ] } |