Skip to main content

157 posts tagged with "mondoo"

View All Tags

Mondoo 8.6 is out!

Β· 4 min read
Mondoo Core Team
Mondoo Core Team

πŸ₯³ Mondoo 8.6 is out! This release includes a new overview dashboard, policy previews, and property editing in the console!​

Get this release: Installation Docs | Package Downloads | Docker Container


πŸŽ‰ NEW FEATURES​

Organization overview dashboard​

We've added a new overview dashboard that lets you see the health of all your infrastructure at a glance.

Mondoo spaces are a great way to organize your scanned assets in Mondoo. You can group assets in ways that reflect how your company manages infrastructure, apply policies to all the assets in a space with a single action, and allow teams to concentrate on their area of responsibility.

Organization Dashboard

The new overview dashboard gives you a single view to see what's happening in every Mondoo space. See how asset scores are trending over time, track the vulnerabilities Mondoo detects wherever they appear in your infrastructure, and compare spaces to see how different business areas manage compliance and risk obligations.

Quickly see the most vulnerable assets in your infrastructure and tackle the most critical issues first.

Organization-wide Vulnerabilities

We have big plans here and we're eager for your feedback.

Policy preview​

We've added a way to preview policies in your spaces, so you can see the results of new checks and queries without impacting your scores.

Previewed policies still fully execute, but the results aren't counted into your scores until you decide they are. As a result, teams get visibility into their infrastructure without worrying about creating surprises or awkward conversations with management.

Preview Security Registry

Policy View

Policies can be previewed directly from the Security Registry by selecting the "Preview" icon. Previewed policies will appear on scanned assets with a blue light bulb.

Previewed Policy

Customize policy properties in the console​

We've added a way to configure the properties on a property directly from the Mondoo Console.

Policy properties let you customize policies in ways that make sense to you without creating a fork of the entire policy. For example, you can use properties to adjust a maximum password age, modify a list of recommended ciphers, or create an allowlist of packages to continue utilizing beyond vendor EOL. Edit the properties directly from the Mondoo Console Registry.

Edit Properties

🧹 IMPROVEMENTS​

Updated EOL data​

  • FreeBSD 12.2 EOL added
  • macOS 10.15 EOL added
  • Ubuntu 23.04 EOL added
  • Linux Mint 21 now detected
  • openSUSE 15.5 now detected

Support for EuroLinux 7/8/9​

cnspec and cnquery now detect the EuroLinux RHEL-derivative distribution.

cnquery> platform { name version family }
platform: {
name: "eurolinux"
family: [
0: "redhat"
1: "linux"
2: "unix"
3: "os"
]
version: "9.1"
}

πŸ› BUG FIXES AND UPDATES​

  • Fix VMware integration setup instructions to use cnspec.
  • Fix viewing queries on private policies.
  • Fix several links to the old Policy Hub instead of the new registry.
  • Fix CI scans now showing the Asset Resource Explorer
  • Remove incorrect pagination for policy checks in the registry.
  • Fix failures using the --api-proxy CLI flag.
  • Fix date parsing in the Asset Resource Explorer.
  • Add missing group names to Mondoo and CIS security policies.
  • Fix setting the Kubernetes operator to use OpenShift for certificate management.
  • Correctly categorize Red Hat Enterprise Linux CoreOS (RHCOS) scans as operating systems in the console.
  • Improve handling of nested arrays in the Asset Resource Explorer.
  • Improve identification of OpenShift clusters in the Mondoo Kubernetes Operator.
  • Prevent failures scanning OpenShift cluster nodes.
  • Fix cnspec scan host not correctly reporting the asset type as a host.

Mondoo 8.5 is out!

Β· 3 min read
Mondoo Core Team

πŸ₯³ Mondoo 8.5 is out! This release includes new security/CVE dashboards, a new policy management experience, S3 exports, and more!​

Get this release: Installation Docs | Package Downloads | Docker Container


πŸŽ‰ NEW FEATURES​

Vulnerabilities dashboard​

We've added a new vulnerabilities dashboard where you can quickly see the most vulnerable assets in your infrastructure and tackle the most critical issues first.

Vulnerabilities Dashboard

Security dashboard and policy view​

We've created a new section in the console navigation just for security concerns, with a new security dashboard and a policy view page. The security dashboard shows the most pressing policies and assets, exposing the top actions that should be remediated to secure your infrastructure.

Security Dashboard

With the new policies view, you can dive into scores by policy and see failing assets for each policy.

Policy View

Security Registry​

Say hello to the Mondoo Security Registry, your new space for managing policies in Mondoo. The all-new UI in the Security Registry makes finding the policies you need for your space easier and quicker. You can search and filter by policy type right on the main page, so there's no need to dive deeper to add or remove policies. It displays important information such as the policy author, number of checks, and policy description for each policy, so you quickly evaluate policies without multiple clicks. Want to enable or disable a policy? Just toggle the policy from the main page.

Security Registry

We've also redesigned the individual policy pages to help you better understand which checks are included in policies. Checks for particular technologies or subsystems are now bundled together in groups for easier browsing.

Policy Page

You can also view available properties in each check to see how you can customize policy behavior for your organization.

Policy Properties

Amazon S3 and S3-compatible exports​

You can now export your Mondoo data to S3 and S3-compatible storage systems automatically. Export data in JSONL or CSV formats. Mondoo runs each export daily.

S3 Export Setup

🧹 IMPROVEMENTS​

Scan with friendly policy names​

You can now run cnquery and cnspec scans by specifying the friendly, short name of the policy shown in the Security Registry.

cnspec scan okta --organization dev-12345.okta.com --token $OKTA_TOKEN --policy mondoohq/mondoo-okta-security

πŸ› BUG FIXES AND UPDATES​

  • Fix failures to apply local cnquery query packs.
  • Improve parsing of UNIX uptime on some systems.
  • Improve policy descriptions and add license information to policies.

Mondoo 8.4 is out!

Β· 4 min read
Mondoo Core Team

πŸ₯³ Mondoo 8.4 is out! This release includes a new way to explore asset resources, Snowflake data exports, and more!​

Get this release: Installation Docs | Package Downloads | Docker Container


πŸŽ‰ NEW FEATURES​

Asset resource explorer​

Use the new asset resource explorer to dive deep into the configuration of all your favorite assets in Mondoo. From the services running on Windows servers to container registries used in Kubernetes deployments, the asset resource explorer lets you navigate the critical configuration data that makes up your infrastructure.

Asset Resource Explorer

If the data output looks familiar, that's because this new feature is powered by the same MQL resources used by cnspec and cnquery on the command line. Data is automatically gathered with new-out-of-the-box inventory query packs in the Policy Hub.

Inventory Packs

Just like security policies, you can enable as many inventory packs as you'd like, and they'll run on the appropriate assets automatically. With inventory packs enabled, you'll see inventory data automatically in the new Resources tab for each asset. If you want to gather even more inventory data, you can create custom inventory packs using the hundreds of available MQL resources. See examples of inventory packs in the cnquery-packs repository.

Snowflake data exports​

With Mondoo 8.2 we shipped our first data export integration: Google BigQuery. This week we everyone not running in GCP has reason to celebrate: new support for Snowflake data export.

Configure data exports just like other integrations in Mondoo, without installing anything in your infrastructure. They automatically export your Mondoo data daily.

Snowflake Setup

You can combine your exported Mondoo data with any other data in Snowflake and analyze it using Snowflakes's machine learning and BI features.

Snowflake Data

Automatic Kubernetes Ingress scanning​

Both cnspec and the Mondoo Kubernetes Operator now automatically scan Kubernetes Ingress resources. With the Kubernetes Best Practices policy enabled, you can also now expose expiring TLS certificates in Ingress resources.

Ingress Asset

🧹 IMPROVEMENTS​

Scan container images in .tar format​

You can now use cnspec and cnquery to scan container images exported in .tar format with commands like docker save.

docker save luna-docs -o luna-docs.tar
cnspec scan container tar luna-docs.tar
β†’ discover related assets for 1 asset(s)
β†’ resolved assets resolved-assets=1

luna-docs.tar ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% score: F


Asset: luna-docs.tar
--------------------

...

Scanned 1 assets

Debian GNU/Linux 8 (jessie)
F luna-docs.tar

Expanded Okta MQL resources​

cnquery and cnspec now include more Okta resources so you can query and secure every aspect of your organization.

Access billing contact of Okta organizations

cnquery> okta.organization.billingContact
okta.organization.billingContact: okta.user id="12345678910" profile[email]="chris@example.com"

Access technical contact of Okta organizations

cnquery> okta.organization.technicalContact
okta.organization.technicalContact: okta.user id="12345678910" profile[email]="chris@example.com"

Gather the settings of security notification emails

cnquery> okta.organization.securityNotificationEmails
okta.organization.securityNotificationEmails: {
reportSuspiciousActivityEnabled: true
sendEmailForFactorEnrollmentEnabled: false
sendEmailForFactorResetEnabled: false
sendEmailForNewDeviceEnabled: false
sendEmailForPasswordChangedEnabled: false
}

Gather Okta ThreatInsight settings

cnquery> okta.organization.threatInsightSettings { * }
okta.organization.threatInsightSettings: {
excludeZones: [
0: okta.network name="LegacyIpZone" type="IP"
]
created: 2022-11-01 18:30:34 +0000 UTC
action: "audit"
lastUpdated: 2023-04-02 20:29:19 +0000 UTC
}

Gather Okta networks

okta.networks { * }
okta.networks: [
0: {
locations: []
lastUpdated: 2022-11-01 18:30:35 +0000 UTC
asns: []
created: 2022-11-01 18:30:35 +0000 UTC
id: "12345678910"
type: "IP"
gateways: []
status: "ACTIVE"
system: true
proxies: []
proxyType: ""
usage: "BLOCKLIST"
name: "BlockedIpZone"
}
1: {
locations: []
lastUpdated: 2022-11-01 18:30:35 +0000 UTC
asns: []
created: 2022-11-01 18:30:35 +0000 UTC
id: "12345678910"
type: "IP"
gateways: []
status: "ACTIVE"
system: true
proxies: []
proxyType: ""
usage: "POLICY"
name: "LegacyIpZone"
}
2: {
locations: [
0: {
country: "AF"
}
]
lastUpdated: 2023-04-02 18:58:13 +0000 UTC
asns: []
created: 2023-04-02 18:58:13 +0000 UTC
id: "12345678910"
type: "DYNAMIC"
gateways: []
status: "ACTIVE"
system: false
proxies: []
proxyType: "TorAnonymizer"
usage: "POLICY"
name: "Test"
}
]

πŸ› BUG FIXES AND UPDATES​

  • Add missing impact scores to policies.
  • Improve setup and remediation instructions in the Okta Organization Security by Mondoo policy
  • Fix failures in Linux Security by Mondoo policy's Ensure auditing for processes that start prior to auditd is enabled check. Thanks @micheelengronne!
  • Fix Linux Security by Mondoo policy's Ensure sudo logging is enabled check to support configs in the /etc/sudoers.d directory. Thanks @micheelengronne!
  • Fix failures in Linux Security by Mondoo policy's Ensure mail transfer agent is configured for local-only mode check.
  • Improve the reliability of multiple CIS policies.

Mondoo 8.3 is out!

Β· 6 min read
Mondoo Core Team

πŸ₯³ Mondoo 8.3 is out! This release includes a new vulnerabilities experience, updated CIS/Mondoo policies, and more!​

Get this release: Installation Docs | Package Downloads | Docker Container


πŸŽ‰ NEW FEATURES​

New vulnerabilities views​

We've reworked our Vulnerabilities page to make it quicker to find vulnerabilities in your environment, identify the worst offending assets, and investigate newly released CVEs. A new Vulnerabilities menu now includes individual options for Advisories, CVEs, Affected Assets, and Mondoo Vulnerability Database (VMD).

Vulnerability Menu

The Advisories and CVEs pages allow you to dive into specific vendor security advisories and CVEs that impact your environment. You can see when these issues were first discovered, progress towards patching them, and get more details on the advisory/CVEs, including impacted assets.

CVEs Page

The new Affected Assets page lets you quickly dive into assets with unpatched CVEs or vendor advisories in your space.

Affected Assets

The completely reworked Mondoo Vulnerability Database (MVD) gives you a single UI to research new vendor CVEs and advisories even if they don't apply to your assets. Curious about that new CVE you read about online? Look it up to learn more, including details on the CVSSv3 score and any impacted assets in your environment.

MVD

Slack Team Security by Mondoo policy​

Mondoo now includes a new Slack Team Security policy with seven checks to secure your Slack Team (Workspace):

  • Ensure that between 2 and 4 users have admin permissions
  • Ensure that admins use the most secure 2FA method
  • Ensure all users use 2FA
  • Use clear naming for external channels
  • Ensure there is at least one internal channel per workspace
  • Ensure there is at least one internal channel in the workspace and there are no external members
  • Ensure domain allowlisting is enforced on internal channels

Microsoft 365 assets grouped in console​

Problem Microsoft 365 assets weren't grouped together on the Fleet page, so finding them all could take a moment.

Solution We grouped Microsoft 365 assets together on the Fleet page so you can quickly find them.

Fleet Page

Set a proxy server for all Mondoo Platform communication​

Problem There was no way to isolate cnspec-to-Mondoo-Platform and cnquery-to-Mondoo-Platform communication from non-Mondoo traffic.

Solution A new --api-proxy config flag allows you to specify the proxy server for Mondoo Platform API calls when you register an asset with the cnspec login command. You can also manually add the api_proxy configuration option in your mondoo.yml config.

🧹 IMPROVEMENTS​

Updated CIS Microsoft Azure Foundations Benchmark 2.0 policy​

The CIS Microsoft Azure Foundations Benchmark policy has been updated from 1.5 to 2.0. This new release includes reworked audit and remediation steps that match Azure's latest UI and CLI experiences.

Expanded Microsoft Azure Security policy​

The Microsoft Azure Security by Mondoo policy has been expanded with new checks for database systems and network assets in your Azure subscription:

  • Ensure SSL connection is enabled for PostgreSQL Database Server
  • Ensure SSL connection is enabled for MariaDB Database Server with the latest version
  • Ensure Public Network access for MariaDB is disabled
  • Ensure SSL connection enabled for MySQL Database Server with the latest version
  • Ensure Public Network access for SQL Server is disabled or only possible through firewall rules
  • Ensure default Public Network access for Key Vault is disabled
  • Ensure that all activities on SQL Server are audited
  • Ensure that transparent data encryption is enabled on SQL Server
  • Ensure that diagnostic settings exist for the subscription
  • Ensure that Diagnostic Setting collects essential security categories
  • Ensure that direct UDP access to Azure Virtual Machines from the Internet is restricted

Expanded Windows Security policy​

The Windows Security by Mondoo policy now includes a new check to ensure that Local Security Authority (LSA) protection is enabled on Windows assets.

Fewer API calls in the AWS Lambda integration​

We've optimized our Lambda-based AWS integration to reduce the number of API calls made by the integration to reduce Lambda costs. Don't worry; you'll still get the same great AWS resource scans, but now with added efficiency.

etcd database encryption state in gcp.project.gke.cluster resource​

The gcp.project.gke.cluster resource now includes information on encryption of the etcd database.

cnquery> gcp.project.gke.clusters[0]{databaseEncryption}
gcp.project.gke.clusters[0]: {
databaseEncryption: {
keyName: "projects/***/locations/us-central1/keyRings/***/cryptoKeys/***"
state: "ENCRYPTED"
}

2FA type in slack.users resource​

The slack.users resource now includes the type of two-factor authentication (2FA) used by users. This lets you query which users are configured for insecure SMS vs. more secure app-based 2FA.

cnquery> slack.users.where( has2FA == true ){ has2FA twoFactorType }
slack.users.where.list: [
0: {
twoFactorType: "app"
has2FA: true
}
]

Updated and certified CIS Google Kubernetes Engine (GKE) Benchmark policy​

The CIS Google Kubernetes Engine (GKE) Benchmark policy has been enhanced with the following new checks and is now fully certified by CIS:

  • 5.1.1 Ensure Image Vulnerability Scanning using GCR Container Analysis or a third party provider
  • 5.6.4 Ensure clusters are created with Private Endpoint Enabled and Public Access Disabled

Smaller Mondoo package size​

We've further optimized the Mondoo package to reduce the installation size by another 10MB.

πŸ› BUG FIXES AND UPDATES​

  • Replace mondoo shell with cnspec shell in some policy audit instructions.
  • Improve remediation steps in Mondoo Azure, Google, and AWS policies.
  • Fix cnspec bundle fmt removing scoring_system from policies when converting between 7.x and 8.x formats.
  • Fix cnspec bundle fmt not properly parsing typed docs.
  • When scanning Kubernetes manifests containing resources without a namespace, don't create an unnamed namespace asset as the parent.
  • Fix failures querying Azure Cloud Defender security contacts when none exist.
  • Fix failure running github.organization {*} query.
  • Fix CVSS aggregated score calculation in the platform.advisories resource.
  • Fix some CIS Kubernetes policies not displaying in the Policy Hub.
  • Improve ad-hoc scan instructions in AWS/Azure/GCP policies.
  • Update CIS Azure AKS v.1.2 Pod Security Policy checks to only execute on Kubernetes < 1.25.
  • Update Linux Security by Mondoo policy's Ensure events that modify the system's Mandatory Access Controls are collected check to expect a trailing slash in directories. Thanks @micheelengronne!
  • Remove the running and unknown states shown in asset names in the console, which did not consistently or correctly show asset scan status.
  • Add missing impact scores to Windows Security by Mondoo policy.
  • Fix the Kubernetes Operator not immediately scanning newly deployed workloads in a cluster.
  • Update wording on the Azure and MS365 integration pages to make it more clear that the .pem file needs to include both the certificate and the private key.

Mondoo 8.2 is out!

Β· 4 min read
Mondoo Core Team

πŸ₯³ Mondoo 8.2 is out! This release includes GCP BigQuery exports, new Azure resources, and more!​

Get this release: Installation Docs | Package Downloads | Docker Container


πŸŽ‰ NEW FEATURES​

Google BigQuery data exports​

Love your security data, but need to analyze it more deeply? Now you can automatically export your Mondoo data directly to Google BigQuery.

Exports are configured just like other integrations in Mondoo, and run daily without the need to install anything into your infrastructure.

BigQuery Setup

Once the data is exported it can be combined with other data in BigQuery and analyzed with BigQuery's machine learning and BI features.

BigQuery Data

New Azure resources​

cnspec and cnquery now ship with additional Azure resources so you can inventory and secure all aspects of your Azure infrastructure:

azure.subscription.monitor.applicationinsights​

This new Azure resource lets you query each instance of Application Insights:

cnquery> azure.subscription.monitor.applicationInsights
azure.subscription.monitor.applicationInsights: [
0: azure.subscription.monitorService.applicationinsight id = /subscriptions/f1a2873a-6b27-4097-aa7c-3df51f103e96/resourceGroups/cloud-shell-storage-westeurope/providers/microsoft.insights/components/app-insight-test
]
cnquery> azure.subscription.monitor.applicationInsights {name kind location}
azure.subscription.monitor.applicationInsights: [
0: {
name: "app-insight-test"
location: "centralus"
kind: "web"
}
]

azure.subscription.network.bastionHost​

This new Azure resource lets you query all bastion hosts, including their names, locations, and product SKUs:

cnquery> azure.subscription.network.bastionHosts
azure.subscription.network.bastionHosts: [
0: azure.subscription.networkService.bastionHost id="/subscriptions/f1a2873a-6b27-4097-aa7c-3df51f103e96/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Network/bastionHosts/test-bastion-host" name="test-bastion-host" location="uksouth"
]
cnquery> azure.subscription.network.bastionHosts{name location sku}
azure.subscription.network.bastionHosts: [
0: {
name: "test-bastion-host"
sku: {
name: "Standard"
}
location: "uksouth"
}
]

azure.subscription.sql.virtualNetworkRule​

This new Azure resource lets you query the virtual network rules on an SQL server and is similar to firewall rules resources:

cnquery> azure.sql.servers[1].virtualNetworkRules{*}
azure.sql.servers[1].virtualNetworkRules: [
0: {
id: "/subscriptions/f1a2873a-6b27-4097-aa7c-3df51f103e96/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Sql/servers/sql-server-mondoo-test/virtualNetworkRules/newVnetRule1"
properties: {
id: "/subscriptions/f1a2873a-6b27-4097-aa7c-3df51f103e96/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Sql/servers/sql-server-mondoo-test/virtualNetworkRules/newVnetRule1"
name: "newVnetRule1"
properties: {
ignoreMissingVnetServiceEndpoint: false
state: "Ready"
virtualNetworkSubnetId: "/subscriptions/f1a2873a-6b27-4097-aa7c-3df51f103e96/resourceGroups/DefaultResourceGroup-CUS/providers/Microsoft.Network/virtualNetworks/prelav-test-VN/subnets/default"
}
type: "Microsoft.Sql/servers/virtualNetworkRules"
}
virtualNetworkSubnetId: "/subscriptions/f1a2873a-6b27-4097-aa7c-3df51f103e96/resourceGroups/DefaultResourceGroup-CUS/providers/Microsoft.Network/virtualNetworks/prelav-test-VN/subnets/default"
type: "Microsoft.Sql/servers/virtualNetworkRules"
name: "newVnetRule1"
}
]

azure.subscription.cosmosdb​

This new Azure resource lets you query the Azure Cosmos DB service.

Query databases:

cnquery> azure.subscription.cosmosDb.accounts
azure.subscription.cosmosDb.accounts: [
0: azure.subscription.cosmosdbService.account name="test-cosmosdb-mondoo" location="West US"
1: azure.subscription.cosmosdbService.account name="test-mondoo-cassandra" location="West US"
]

Write assertions to secure configuration:

cnquery> azure.cosmosDb.accounts{properties['isVirtualNetworkFilterEnabled'] name}
azure.cosmosDb.accounts: [
0: {
properties[isVirtualNetworkFilterEnabled]: true
name: "test-cosmosdb-mondoo"
}
1: {
properties[isVirtualNetworkFilterEnabled]: true
name: "test-mondoo-cassandra"
}
]

🧹 IMPROVEMENTS​

Kubernetes namespace scoped scanning​

You can now scan a single namespace in a Kubernetes cluster even if you don't have access to resources outside that namespace. This allows you to scan all workloads in your namespace and browse asset relationships under the namespace in the Mondoo Console.

Example cnquery query against a single namespace:

./cnquery run k8s --namespaces default -c "k8s.pods" --discover namespaces
β†’ loaded configuration from /Users/ivanmilchev/.config/mondoo/mondoo.yml using source default
β†’ discover related assets for 1 asset(s)
β†’ resolved assets resolved-assets=1
k8s.pods: [
0: k8s.pod namespace="default" name="nginx" created=2023-03-14 16:59:07 +0100 CET
]

Homebrew now installs cnspec/cnquery along with Mondoo​

The Mondoo Homebrew tap now installs both cnquery and cnspec as dependencies, giving you the complete power of Mondoo in one installation.

Homebrew install

All macOS binaries are now signed and notarized​

We now sign and notarize all binaries for macOS, not just those installed with the Mondoo .pkg file. This means no matter where you consume Mondoo packages, you will always have a fully secured binary that passes all of Apple's security requirements.

πŸ› BUG FIXES AND UPDATES​

  • Fix failure if the ps command column has no data and warn if data otherwise can't be parsed correctly.
  • Fix failures setting the AWS integration.
  • Fix parsing of policies with arrays of remediations instead of simple strings.
  • Improve the audit/remediation steps in Mondoo security policies.
  • Update cnspec bundle lint and cnspec bundle fmt commands to support the Mondoo version 8.0+ policy structure.
  • Update the Ensure events that modify the system's Mandatory Access Controls are collected query in the Linux Security by Mondoo policy to support either SELinux or AppArmor. Thanks @micheelengronne!
  • Improve reliability of queries in the Okta Organization Security by Mondoo policy.

Mondoo 8.1 is out!

Β· 6 min read
Mondoo Core Team

πŸ₯³ Mondoo 8.1 is out! This release includes policy variants, new security policies, and more!​

Get this release: Installation Docs | Package Downloads | Docker Container


πŸŽ‰ NEW FEATURES​

Policy variants​

Sometimes queries differ slightly when executed in different environments. This can happen with:

  • Highly related queries, like OS checks that run differently on physical servers than they do on containers

  • Queries that test for similar things on entirely different targets

Let's take a look at the latter example:

queries:
- uid: no-public-ip
title: No public IPs are allowed on internal instances
variants:
- uid: no-public-ip-aws
- uid: no-public-ip-terraform-aws
- uid: no-public-ip-aws
mql: |
aws.ec2.instances.all( publicIp == "" )
filters: |
asset.platform == "aws"
- uid: no-public-ip-terraform-aws
mql: |
terraform.resources.
where( nameLabel == "aws_instance" ).
all( arguments['associate_public_ip_address'] != true )
filters: |
asset.platform == "terraform-hcl"

This query ensures that β€œNo public IPs are allowed on internal instances.” This query is implemented in two different ways: one for the AWS API (no-public-ip-aws) and one for Terraform (no-public-ip-terraform-aws). You can run this check against both AWS accounts and Terraform files and get consistent reporting.

Additionally, this addresses a common use case where there's a split between things that happen in development and things that run in production. If you have separate tools in different environments, or even separate policies, you previously had to manage exceptions to certain checks across both ends of the lifecycle. Now with variants, you can instead define exceptions on the combined check, making sure that they are treated consistently between development and production.

New Okta Security policy + MQL enhancements​

Last week we shipped continuous Okta scanning integration in the Mondoo Console. This week we have a new Mondoo security policy and improvements to Okta MQL resources so you can secure your Okta environment in just minutes.

Our new Okta Security Policy by Mondoo includes 11 checks to keep your Okta environment secure out of the box:

  • Ensure MFA is active for everybody accessing Okta platform
  • Ensure a limited session lifetime has been enforced
  • Ensure OpenID or SAML authentication is used for app access
  • Ensure normal users cannot unlock themselves
  • Ensure Secure Web Authentication (SWA) is disabled for critical apps
  • Ensure the option "at every sign-in" is enabled for MFA
  • Ensure "Persist session cookies across browser sessions" is disabled
  • Ensure the users with Super Admin rights are limited to 3
  • Ensure the strong factor is used for MFA
  • Ensure that MFA is configured to use password/IdP plus another authentication factor
  • Ensure the "Password/IdP plus Another" factor is chosen for MFA

If you want to define your own business policies for Okta, you're in luck. We've improved our Okta MQL policies, giving your access to more information on your environment:

  • Gather okta.role and user.roles, allowing you to query which roles are assigned to a user
  • Gather access policy rules
  • Fix okta.trustedOrigin.scopes parsing

New Microsoft Workstation Security policy​

Our all-new Microsoft Workstation Security policy provides security guidance for workstations running Windows 10 and 11.

New Windows Workstation Policy

New and updated Kubernetes policies​

Kubernetes moves fast, so ensuring your security policy matches the latest and greatest security recommendations is essential. Mondoo now includes the latest CIS benchmarks for Kubernetes distributions with updated auditing and remediation steps as well as new checks for the control plane in cloud distributions:

  • New: CIS Kubernetes V1.24 Benchmark 1.0
  • Updated: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark 1.2
  • Updated: CIS Google Kubernetes Engine (GKE) Benchmark 1.3
  • Updated: CIS Azure Kubernetes Service (AKS) Benchmark 1.2
  • Updated: CIS Red Hat OpenShift Container Platform v4 Benchmark 1.1

🧹 IMPROVEMENTS​

Smaller installation size​

The Mondoo package has been optimized to reduce the space on disk consumed by Mondoo, cnquery, and cnspec commands. The legacy Mondoo CLI is now 200MB smaller on all platforms. Additionally, the cnquery and cnspec CLIs are each ~150MB smaller on Windows systems.

More AWS ElasticCache data in MQL​

We've deprecated aws.elasticache.clusters in favor of a new aws.elasticache.cacheClusters resource that presents cluster data in an easier to consume format.

cnquery> aws.elasticache.cacheClusters { * }
aws.elasticache.cacheClusters: [
0: {
arn: "arn:aws:elasticache:us-east-1:ID:cluster:vjtest-001"
notificationConfiguration: ""
cacheSubnetGroupName: "vjtest"
atRestEncryptionEnabled: false
logDeliveryConfigurations: []
ipDiscovery: "ipv4"
authTokenLastModifiedDate: null
numCacheNodes: 1
engine: "redis"
networkType: "ipv4"
region: "us-east-1"
securityGroups: []
transitEncryptionMode: ""
cacheNodeType: "cache.t3.medium"
engineVersion: "7.0.7"
preferredAvailabilityZone: "us-east-1c"
transitEncryptionEnabled: false
cacheClusterId: "vjtest-001"
authTokenEnabled: false
snapshotRetentionLimit: 0

Expanded Azure Security policy​

We've updated the Microsoft Azure Security by Mondoo policy with seven new checks to keep your Azure environment secure out of the box:

  • Ensure that App services can authenticate with Active Directory
  • Ensure that Web App takes advantage of latest version of TLS encryption
  • Ensure that the expiration date is set for all keys and secrets in key vaults
  • Ensure it is possible to recover key vaults
  • Ensure all operations on key vault are logged
  • Ensure that activity log alerts exist for the commands Create, Update, and Delete Network Security Group
  • Ensure that "Notify about alerts with high severity" is enabled

Expanded Google Workspace policy​

We've updated our Google Workspace Security by Mondoo policy with three new checks:

  • Ensure more than one user has Super Admin permissions
  • Users should not be allowed less secure app access
  • Super users should use hardware-based security keys

Remove v7 deprecations​

Now that v8 is out, we've cleaned up several old flags and options that were deprecated during v7.

Deprecated GCP flags​

We removed the deprecated cnspec and cnquery flags for GCP --project and --organization. We also marked the --project-id and --organization-id flags as deprecated. Use cnspec scan gcp organization MY_ORG or cnspec scan gcp project MY_PROJECT instead.

Deprecated K8s flag​

We removed the deprecated cnspec and cnquery Kubernetes --namespace flag. Use --namespaces instead.

Deprecated Azure/Microsoft 365 inventory options​

We removed the deprecated tenantId, clientId, and subscriptionId Azure/Microsoft 365 inventory file configuration options. Use tenant-id, client-id, and subscription-id instead.

Deprecated azure.subscription.sqlService.database fields​

We removed the deprecated containmentState, currentServiceObjectiveId, requestedServiceObjectiveId, and serviceTierAdvisors fields from the azure.subscription.sqlService.database resource.

πŸ› BUG FIXES AND UPDATES​

  • Don't fail an entire AWS account scan when a single service has a region restriction set.
  • Fail better when a Kubernetes namespace cannot be scanned due to permissions failures.
  • Fix cnspec bundle format failure introduced in 8.0.
  • Update the scanning progress bar to make it more clear when an asset was not scored.
  • Fix console login page text field text color to be black.
  • Fix console login page links to user agreement and privacy policy to load in new windows.
  • Don't display 0 Others for Azure assets in the fleet page.
  • Fix off-center spinner loaders on the integration pages.
  • Rename "Latest Advisories" on the overview page to be "Top Advisories" to better match what the widget shows.
  • Show accurate billing plan data in the console.
  • Improve rendering on the welcome page on small displays.

Mondoo 8.0 is out!

Β· 15 min read
Mondoo Core Team

πŸ₯³ Mondoo 8.0 is out! This release includes a whole new policy experience, new SaaS integrations, and much more!​

Get this release: Installation Docs | Package Downloads | Docker Container


We are excited to announce Mondoo v8, the new major release of cnspec, cnquery, and Mondoo Platform.

πŸš€ NEW POLICY EXPERIENCE​

This release significantly improves policies and query packs by simplifying their structure and adding major new features like properties, variants, and embedded queries. We continue to keep the Mondoo upgrade process incredibly simple, so you don’t have to worry about moving to v8.

Policies and query packs​

Problem: Some of our old fields were confusing to use. For example: query defined the MQL query inside of the query with metadata. (Why use it twice?) The scoring_queries and data_queries inside policies were unnecessarily convoluted. And what were specs?

policies
- specs:
- scoring_queries:
sshd-01:
- data_queries:
sshd-02:
queries:
- uid: sshd-01:
query: sshd.config.params["StrictModes"] == "yes"
- uid: sshd-02:
query: sshd.config.params

Solution: We have overhauled a lot of commonly used terms in policies and query packs. Queries now contain an mql field to store the MQL snippet. Policies are now built around groups that can generate chapters and contain checks (which are scored) and queries (which are not scored). Additionally, we have removed all instances of key-value maps (see sshd-01: above) and replaced them with named fields (see - uid: sshd-01 below).

policies:
- groups:
- checks:
- uid: sshd-01
- queries:
- uid: sshd-02
queries:
- uid: sshd-01
mql: sshd.config.params["StrictModes"] == "yes"
- uid: sshd-02
mql: sshd.config.params

Problem: The old YAML files we used in cnspec and cnquery required users to create references for queries and checks to use them. This forced people to write policies and separately reference all queries they wanted to use. See the example above.

Solution: We have introduced embedded queries. It’s now much easier to write policies that stand on their own. You don’t have to explicitly reference queries and checks anymore. Instead, you can embed queries and checks directly into the policy that describes them.

policies:
- groups:
- checks: # embedded query vv
- uid: sshd-01
mql: sshd.config.params["StrictModes"] == "yes"
- queries:
- uid: sshd-02
mql: sshd.config.params

If you want to re-use queries, you can continue to use them globally as well, as seen above. If you prefer not to set a uid for any of these embedded queries and checks, cnspec generates one for you: Just run cnspec bundle format FILENAME. Stable UIDs (and, in turn, MRNs) are still important for anyone who uses your policy and defines overrides, exceptions, or processes policy results.

Problem: The ability to override queries and checks was very limiting. You could only affect a limited number of fields and had to understand how these were referenced. (We will skip the example to avoid even more confusion.)

Solution: Making changes to individual queries is now simple and intuitive. For example, here is a globally shared query that is modified in a policy:

policies:
- groups:
- checks:
# reference the shared query and change its title and impact
- uid: sshd-01
title: Make sure to enforce StrictMode
impact: 80

queries:
- uid: sshd-01
mql: sshd.config.params["StrictModes"] == "yes"
impact: 50

Problem: Policies containing a lot of queries flooded users with an unstructured list of all of their contents. However, most policy documents aren’t written this way. Instead, they contain chapters and sections that group together checks and controls.

Solution: Policy groups now have a type to specify their function. For example, the most common type in a policy is a chapter:

policies:
- uid: policy1
groups:
- type: chapter
title: Kernel checks
docs:
desc: |
Long description about what kernel checks do...
checks:
- uid: kernel-check-01
...

Other types include import (for referencing imported policies) and override (for making changes to any policies, queries, and checks).

Properties​

Properties are a way to make adjustments to existing queries in pre-defined ways. For example, you can change the list of allowed TLS ciphers to include ciphers you need or you can change the location of files that are tested.

Properties existed before v8, but weren’t exposed to users. With this release we make properties configurable in the CLI, with configuration in the UI to follow in the coming weeks.

Configuration

Policy authors can add properties to their queries in YAML using props:

- uid: home-info
mql: file(props.home) { * }
title: Gather info about the user's home
props:
- uid: home
mql: |
"/home"

The uid is required. It provides the name for accessing properties in MQL. These follow standards for identifiers (such as no spaces or control characters allowed).

CLI usage

By default, the query uses the configured property. If you want to adjust it, such as for the above example, you can use the --props CLI argument:

cnspec scan -f examples/example.mql.yaml --props "home='/home/zero'"

Note: This example overwrites a string property. Doing this properly requires escaping the CLI arguments so they retain the quotation (’) characters in MQL. Properties can be any MQL snippet, but must adhere to the expected type. For example: You can't overwrite a string property into a number.

Deprecations​

All deprecations will be supported throughout the lifetime of Mondoo v8. We will remove them when we release Mondoo v9.

  • With the new policy format established in this release, we are deprecating the old policy format. If you only use existing policies created and maintained by Mondoo, you don’t need to take any action. We are serving both v7 and v8 clients and will keep things compatible.

  • If you have written your own policies, these will automatically work with v7 and v8 clients after you upload them to the Policy Hub. To take advantage of the many simplifications and features we have added, we encourage you to convert your policies to v8 with this simple command:

    cnspec bundle format FILE

    The formatter in cnspec always store files in the latest format.

  • All public policies in our community repo will remain in the v7 format for a little longer. This is to support users who are still using v7 and manually downloading policy files. We will transition these policies throughout the v8 lifespan to allow some new capabilities, like configurable properties, context, and variants.

πŸŽ‰ OTHER NEW FEATURES​

Continuous scanning of Google Workspace and Okta​

You can now continuously scan your Google Workspace and Okta SaaS environments directly from the Mondoo Console. There's nothing to download or install in order to get started. Set up integrations with service accounts or tokens for these SaaS services, and they will securely scan every 8 hours.

New Integrations

Scan GCP orgs, projects, and folders​

No matter what you want to inspect in your GCP infrastructure, Mondoo has your back with new scanning support from your whole organizationβ€”down to a single folder:

cnquery scan gcp org 342423 # <-- scan GCP organization
cnquery scan gcp project mondoo-dev # <-- scan GCP project
cnquery scan gcp folder 3421423 # <-- scan GCP folder

Secure your GKE control plane​

There's more to Cloud Kubernetes security than just the kubelet and cluster workloads, so we've added new data-gathering capabilities for the GKE control plan. Use this new data to take inventory of your GKE configuration or to write custom security policies for your organization.

Cluster addonsConfig​

cnquery> gcp.project.gke.clusters{ addonsConfig{*} }
gcp.project.gke.clusters: [
0: {
addonsConfig: {
horizontalPodAutoscaling: {
disabled: false
}
id: "gcp.project.gkeService.cluster/12345/addonsConfig"
gkeBackupAgentConfig: {}
gcePersistentDiskCsiDriverConfig: {
enabled: true
}
networkPolicyConfig: {
disabled: false
}
gcpFilestoreCsiDriverConfig: {
enabled: false
}
dnsCacheConfig: {
enabled: false
}
httpLoadBalancing: {
disabled: false
}
kubernetesDashboard: {
disabled: true
}
configConnectorConfig: {}
cloudRunConfig: {}
}
}
]

Cluster nodePools management​

cnquery> gcp.project.gke.clusters{ nodePools{ management } }
gcp.project.gke.clusters: [
0: {
nodePools: [
0: {
management: {
autoRepair: true
autoUpgrade: true
upgradeOptions: {}
}
}
1: {
management: {
autoRepair: true
autoUpgrade: true
upgradeOptions: {}
}
}
]
}
]

Cluster networkConfig​

cnquery> gcp.project.gke.clusters{ networkConfig{*} }
gcp.project.gke.clusters: [
0: {
networkConfig: {
enableL4IlbSubsetting: false
id: "gcp.project.gkeService.cluster/12345/networkConfig"
dnsConfig: {}
serviceExternalIpsConfig: {
enabled: false
}
subnetworkPath: "projects/project-1/regions/us-central1/subnetworks/mondoo-gke-cluster-2-subnet"
privateIpv6GoogleAccess: "PRIVATE_IPV6_GOOGLE_ACCESS_UNSPECIFIED"
datapathProvider: "DATAPATH_PROVIDER_UNSPECIFIED"
networkPath: "projects/project-1/global/networks/mondoo-gke-cluster-2"
subnetwork: gcp.project.computeService.subnetwork name="mondoo-gke-cluster-2-subnet"
enableIntraNodeVisibility: false
defaultSnatStatus: {
disabled: false
}
network: gcp.project.computeService.network name="mondoo-gke-cluster-2"
}
}
]

Cluster workloadIdentityConfig​

cnquery> gcp.project.gke.clusters{ workloadIdentityConfig }
gcp.project.gke.clusters: [
0: {
workloadIdentityConfig: {
workloadPool: "mondoo-edge.svc.id.goog"
}
}
]

Cluster ipAllocationPolicy​

cnquery> gcp.project.gke.clusters{ ipAllocationPolicy{*} }
gcp.project.gke.clusters: [
0: {
ipAllocationPolicy: {
id: "gcp.project.gkeService.cluster/12345/ipAllocationPolicy"
stackType: "IPV4"
tpuIpv4CidrBlock: ""
useRoutes: false
createSubnetwork: false
nodeIpv4CidrBlock: ""
subnetworkName: ""
servicesSecondaryRangeName: "cluster-2-ip-range-svc"
useIpAliases: true
clusterSecondaryRangeName: "cluster-ip-range-pods"
clusterIpv4CidrBlock: "10.20.0.0/16"
ipv6AccessType: "IPV6_ACCESS_TYPE_UNSPECIFIED"
servicesIpv4CidrBlock: "10.30.0.0/16"
}
}
]

Cluster binaryAuthorization​

cnquery> gcp.project.gke.clusters{ binaryAuthorization }
gcp.project.gke.clusters: [
0: {
binaryAuthorization: {
enabled: false
evaluationMode: "EVALUATION_MODE_UNSPECIFIED"
}
}
]

Cluster legacyAbac​

cnquery> gcp.project.gke.clusters{ legacyAbac }
gcp.project.gke.clusters: [
0: {
legacyAbac: {
enabled: false
}
}
]

Cluster masterAuth​

cnquery> gcp.project.gke.clusters{ masterAuth }
gcp.project.gke.clusters: [
0: {
masterAuth: {
clientCertificate: ""
clientCertificateConfig: {}
clientKey: ""
clusterCaCertificate: "***"
password: ""
username: ""
}
}
]

Identify public IPs in Azure​

Identifying publicly exposed assets is critical to securing your cloud infrastructure. Use the new publicIpAddresses data available in the azure.subscription.computeservice.vm and azure.subscription.networkservice to quickly identify assets that may be incorrectly publicly exposed.

Identify all public IP addresses in a subscription:

cnquery> azure.subscription.network.publicIpAddresses{*}
azure.subscription.network.publicIpAddresses: [
0: {
name: "super-cool-public-ip"
id: "/subscriptions/<redacted>/resourceGroups/<redacted>/providers/Microsoft.Network/publicIPAddresses/<redacted>"
location: "uksouth"
tags: {}
ipAddress: "255.255.255.255"
}
]

Identify public IP addresses on specific VMs:

cnquery> azure.subscription.compute.vms{publicIpAddresses{*}}
azure.subscription.compute.vms: [
0: {
publicIpAddresses: [
0: {
name: "super-cool-public-ip"
id: "/subscriptions/<redacted>/resourceGroups/<redacted>/providers/Microsoft.Network/publicIPAddresses/<redacted>"
location: "uksouth"
tags: {}
ipAddress: "255.255.255.255"
}
]
name: "vm-name"
}
]

Query Google Workspace connected apps​

You can now fetch Google Workspace connected apps with a new googleworkspace.connectedApps MQL resource:

googleworkspace.connectedApps { name clientid }
googleworkspace.connectedApps: [
0: {
clientId: "11234434534-abcdefg.apps.googleusercontent.com"
name: "Slack"
}
...
]

You can also filter this data to return specific connected apps:

googleworkspace.connectedApps.where( name == /Slack/) { * }
googleworkspace.connectedApps.where: [
0: {
users: [
0: googleworkspace.user primaryEmail="user1@example.com"
]
tokens: [
0: googleworkspace.token displayText="Slack"
]
scopes: [
0: "https://www.googleapis.com/auth/activity"
1: "https://www.googleapis.com/auth/drive.activity"
2: "https://www.googleapis.com/auth/userinfo.profile"
3: "https://www.googleapis.com/auth/userinfo.email"
4: "openid"
5: "https://www.googleapis.com/auth/calendar.readonly"
6: "https://www.googleapis.com/auth/drive"
7: "https://www.googleapis.com/auth/calendar.events"
]
name: "Slack"
clientId: "11234434534-abcdefg.apps.googleusercontent.com"
}
1: {
users: [
0: googleworkspace.user primaryEmail="user1@example.com"
1: googleworkspace.user primaryEmail="user2@example.com"
2: googleworkspace.user primaryEmail="user3@example.com"
3: googleworkspace.user primaryEmail="user4@example.com"
]
tokens: [
0: googleworkspace.token displayText="Slack"
1: googleworkspace.token displayText="Slack"
2: googleworkspace.token displayText="Slack"
3: googleworkspace.token displayText="Slack"
]
scopes: [
0: "https://www.googleapis.com/auth/userinfo.profile"
1: "https://www.googleapis.com/auth/userinfo.email"
2: "openid"
]
name: "Slack"
clientId: "3321342421-abcdefg.apps.googleusercontent.com"
}
2: {
users: [
0: googleworkspace.user primaryEmail="user1@example.com"
1: googleworkspace.user primaryEmail="user2@example.com"
2: googleworkspace.user primaryEmail="user3@example.com"
3: googleworkspace.user primaryEmail="user4@example.com"
]
tokens: [
0: googleworkspace.token displayText="Slack"
1: googleworkspace.token displayText="Slack"
2: googleworkspace.token displayText="Slack"
3: googleworkspace.token displayText="Slack"
]
scopes: [
0: "https://www.googleapis.com/auth/userinfo.profile"
1: "https://www.googleapis.com/auth/userinfo.email"
2: "openid"
]
name: "Slack"
clientId: "6060606090-abcdefg.apps.googleusercontent.com"
}
]

Python packages inspection​

Outdated packages don't end at the operating system, so we've introduced our first application package resource with the python.packages MQL resource. This new resource discovers packages automatically on macOS, Windows, and Linux in the following locations:

  • /usr/local/lib/python/*
  • /usr/local/lib64/python/*
  • /usr/lib/python/*
  • /usr/lib64/python/*
  • /opt/homebrew/lib/python/*
  • C:/Python/*
  • /System/Library/Frameworks/Python.framework/Versions
  • /Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions

Each package returns data similar to this pytz package:

cnquery> python.packages[0]{ * }
python.packages[0]: {
author: "Armin Ronacher"
name: "Babel"
dependencies: [
0: python.package name="pytz" version="2022.7.1"
]
summary: "Internationalization utilities"
id: "/usr/lib/python3.11/site-packages/Babel-2.10.3-py3.11.egg-info/PKG-INFO"
file: file path="/usr/lib/python3.11/site-packages/Babel-2.10.3-py3.11.egg-info/PKG-INFO" size=1283 permissions.string="-rw-r--r--"
license: "BSD"
version: "2.10.3"
}

To query a specific package on disk you can provide the path to the METADATA file:

cnquery> python.package("/home/jdiaz/.local/lib/python3.11/site-packages/python_ftp_server-1.3.17.dist-info/METADATA"){ * }
python.package: {
version: "1.3.17"
summary: "Command line FTP server tool designed for performance and ease of use."
file: file path="/home/jdiaz/.local/lib/python3.11/site-packages/python_ftp_server-1.3.17.dist-info/METADATA" size=1186 permissions.string="-rw-r--r--"
author: "Vadym Stupakov"
dependencies: data is not a map to auto-expand
id: "/home/jdiaz/.local/lib/python3.11/site-packages/python_ftp_server-1.3.17.dist-info/METADATA"
license: "MIT"
name: "python-ftp-server"
}

This is the first of many new application package resources we plan to introduce, allowing you to audit and secure your application dependencies. If you have particular application packaging systems you want to see in cnquery and cnspec, be sure to let us know on our GitHub Discussions page.

🧹 IMPROVEMENTS​

Support for connecting to IPv6 hosts​

Some day we'll all take the leap and migrate to IPv6. When you do, Mondoo will be there for you. We've updated both cnquery and cnspec to connect to IPv6 hosts directly over SSH or using Ansible inventory files.

cnquery shell ssh chris@fd00::20c:30ff:fe8a:9da0 --ask-pass
Enter password:
β†’ discover related assets for 1 asset(s)
β†’ resolved assets resolved-assets=1
___ _ __ __ _ _ _ ___ _ __ _ _
/ __| '_ \ / _` | | | |/ _ \ '__| | | |
| (__| | | | (_| | |_| | __/ | | |_| |
\___|_| |_|\__, |\__,_|\___|_| \__, |
mondooβ„’ |_| |___/ interactive shell

cnquery>

Expanded support for AWS ECS in MQL​

In this release we've greatly expanded MQL's AWS ECS support with new data and resources:

  • aws.ecs.task now includes platformVersion data.
  • aws.ecs.container now includes platformVersion, runtimeId, and containerName data.
  • aws.ecs.cluster now includes containerInstances data.
  • aws.ecs.image now includes uri data exposing the URI of the image repository.
  • New aws.ecs.instance resource.

New and improved policies​

  • New Microsoft 365 Security by Mondoo

    This all-new policy by Mondoo helps you to secure your Microsoft 365 configuration.

  • New Microsoft Vulnerability Policy by Mondoo

    This all-new policy helps you find critical vulnerabilities in Microsoft Office and SharePoint.

  • New VMware vCenter Incident Response Pack

    Gather critical information on your vSphere and ESXi systems in the event of a security incident with this new incident response pack.

  • Updated CIS Microsoft 365 Foundations Benchmark from 1.2 to 1.5

    This updated policy is nearly entirely rewritten with dozens of new controls, more reliable queries, and updated remediation steps.

  • Updated CIS Google Kubernetes Engine (GKE) Benchmark to 1.3.0

    This updated policy includes new policies for securing not just the Kubelets, but now also the Kubernetes control plane.

  • Updated CIS Google Cloud Platform Foundation Benchmark policy

    Ten updated controls in the CIS Google Cloud Platform Foundation Benchmark policy improve the reliability of results.

  • Updated Microsoft Azure Security

    We added nine new queries to the Microsoft Azure Security to help you better secure the base directory configuration.

  • Updated Linux Workstation Security

    We expanded boot loader security to include permissions on /boot/loader/loader.conf so you can rest assured your boot sequence hasn't been tampered with.

  • Updated Linux Security Policy

    We improved the reliability of auditd package checks on some SUSE releases.

Specify GCP and Google Workspace credential path​

You can now specify the path to your GCP or Google Workspace credentials using a new --credentials-path flag. Shell environmental variables will continue to take precedence when defining the path, but this is a great method of setting the path if you don't have shell ENV vars set.

With env var:

GOOGLE_APPLICATION_CREDENTIALS=~/mondoo-dev-1111111.json cnquery shell gcp

With --credentials-path:

cnquery shell gcp --credentials-path ~/mondoo-dev-1111111.json

Find spaces more easily in large organizations​

It was hard to find a particular asset when you had a large number of organizations or spaces. We've made things easier to track down with new links to open individual organizations and alphabetical sorting of all spaces.

New Sorting of Spaces

Login with a splash​

Our old login page didn't feel fancy enough, so we redesigned it with splashes of Mondoo purple and orange to spruce up your login experience.

New Login Screen

Red Hat Universal Base Image cnspec containers on Docker Hub​

We are now publishing Red Hat Universal Base Image-based cnspec and cnquery containers to Docker Hub. These containers are perfect for running cnspec and cnquery in OpenShift clusters. You can find these images along with our standard Alpine-based images in our cnspec and cnquery repositories.

Improved scan error output​

Gone are cryptic asset connection error messages when scanning multiple assets! In their place you now see better formatted and parsed error messages that make it easier to track down exactly why assets can't be scanned.

Better error output

πŸ› BUG FIXES AND UPDATES​

  • We now correctly detect services on Kali Linux.
  • Mondoo EOL policy now executes on FreeBSD hosts.
  • cnquery run and cnspec run now properly load Mondoo Platform config to support EOL and package vulnerability queries.
  • Fix parsing of timestamps in Google Workspace.
  • Fix setup instructions for Windows on the Integrations page to copy/paste correctly.
  • Add missing breadcrumbs to the Vulnerabilities page.
  • Add form validation to the GCP and Okta Integration setup pages.
  • Don't report successful vulnerability scanning on an asset when zero packages were discovered.
  • Fix incorrect quoting in the GitLab Docker scanning example
  • Don't show the hour when reporting an EOL date for an asset.
  • Fix incorrect GCP project ID validation in the GCP integration setup page.
  • If an integration has never scanned, then display Never instead of Jan 01, 0001.
  • Update links on integration pages to go to specific documentation.
  • Use the latest Microsoft 365 logo on the integrations page.
  • Improve performance of container image scanning in the Mondoo Kubernetes Operator.
  • Update tabs on asset pages to match the new navigation UX.
  • Add the missing Okta token field to the Okta integration setup page.
  • Link to new CloudShell documentation in the AWS integration setup wizard.
  • Fix GCP console links in the GCP integration setup page to load properly when logged out of GCP.
  • Specify UDP or TCP in the ports.listening resource so specific protocols can be queried instead of just ipv4/ipv6.
  • Resolve failures scanning container registries.
  • Label container image assets with all discovered tags when scanning container registries.

Mondoo 7.18 is out!

Β· 3 min read
Mondoo Core Team

πŸ₯³ Mondoo 7.18 is out! This release includes updated GCP resources, expanded EOL detection, and more!​

Get this release: Installation Docs | Package Downloads | Docker Container


🧹 IMPROVEMENTS​

GCP resource updates​

We've continued to expand the data you can query using MQL in your GCP projects to make asset inventory and security easier:

  • Add new gcp.project.compute.addresses resource

    gcp.project.compute.addresses[0]: {
    ipv6EndpointType: ""
    created: 2022-12-15 12:45:25.62 -0800 -0800
    address: "10.10.0.2"
    network: data is not a map to auto-expand
    networkTier: "PREMIUM"
    id: "2700460578865297802"
    userUrls: [
    0: "https://www.googleapis.com/compute/v1/projects/mondoo-edge/regions/us-central1/forwardingRules/gke-mondoo-gke-cluster-2-c255f8bc-73b71c8f-pe"
    ]
    ipVersion: ""
    name: "gke-mondoo-gke-cluster-2-c255f8bc-73b71c8f-pe"
    status: "IN_USE"
    subnetworkUrl: "https://www.googleapis.com/compute/v1/projects/mondoo-edge/regions/us-central1/subnetworks/mondoo-gke-cluster-2-subnet"
    prefixLength: 0
    networkUrl: ""
    regionUrl: "https://www.googleapis.com/compute/v1/projects/mondoo-edge/regions/us-central1"
    addressType: "INTERNAL"
    purpose: "GCE_ENDPOINT"
    description: ""
    subnetwork: gcp.project.computeService.subnetwork name="mondoo-gke-cluster-2-subnet"
    }
  • Add new gcp.project.compute.forwardingRules resource

    gcp.project.compute.forwardingRules: [
    0: {
    description: ""
    ipProtocol: "TCP"
    serviceDirectoryRegistrations: []
    id: "1374403102344"
    labels: {}
    name: "front-lb-1-test"
    serviceName: ""
    network: gcp.project.computeService.network name="test-vpc-3"
    networkUrl: "https://www.googleapis.com/compute/v1/projects/manuel-development-2/global/networks/test-vpc-3"
    allPorts: false
    targetUrl: "https://www.googleapis.com/compute/v1/projects/manuel-development-2/regions/us-central1/targetHttpProxies/lb-1-test-target-proxy"
    ipAddress: "35.209.226.183"
    allowGlobalAccess: false
    networkTier: "STANDARD"
    backendService: ""
    isMirroringCollector: false
    subnetwork: data is not a map to auto-expand
    noAutomateDnsZone: false
    serviceLabel: ""
    ports: []
    loadBalancingScheme: "EXTERNAL_MANAGED"
    ipVersion: ""
    created: 2023-01-19 10:56:30.873 -0800 -0800
    metadataFilters: []
    regionUrl: "https://www.googleapis.com/compute/v1/projects/manuel-development-2/regions/us-central1"
    portRange: "80-80"
    subnetworkUrl: ""
    }
    ]
  • gcp.project.dataproc.clusters data is now only gathered if if the DataProc Cloud service is enabled in the project.

  • Improve reliability of parsing GCP alert policies conditions.

New and improved EOL detection​

We've improved support for detecting end of life (EOL) platforms with new and updates EOL detection support:

  • Added EOL detection support for FreeBSD.
  • Added EOL detection support for Linux Mint.
  • Added EOL date for Alpine 3.17.
  • Added EOL date for Fedora 36 and 37.
  • Updated Debian EOL dates to use the end of LTS dates.
  • Updated Photon 2.0 EOL date for the revised date of Dec 31, 2022.
  • Updated Amazon 2022 EOL date for the revised date of Nov 1, 2027.

Support storing Okta token in OKTA_CLIENT_TOKEN env var​

If you don't want to pass your Okta token on the CLI with the --token flag, cnquery and cnspec now support fetching the token from the OKTA_CLIENT_TOKEN env var in your shell.

πŸ› BUG FIXES AND UPDATES​

  • Improve consistency of the icons in each integrations page and ensure they are all using the latest vendor logos.
  • Allow opening assets in the fleet view in new windows.
  • Don't show advisories with 0 impacted assets on the space overview page if there are no advisories for any assets in the space.

Mondoo 7.17 is out!

Β· 5 min read
Mondoo Core Team

πŸ₯³ Mondoo 7.17 is out! This release includes Amazon ECR/ECS scanning, new Amazon and Azure resources, and more!​

Get this release: Installation Docs | Package Downloads | Docker Container


πŸŽ‰ NEW FEATURES​

Continuous Amazon ECR and ECS scanning​

Problem: You want to continuously scan Amazon Elastic Container Registry (ECR) registries and Amazon Elastic Container Service (ECS) containers using the Mondoo AWS integration.

Solution: You can now configure the Mondoo AWS integration to continuously scan your ECR and ECS infrastructure, providing security insight to your critical container infrastructure.

ECR &amp; ECS Scanning

New azure.subscription.aks.cluster resource​

Problem: You want to write policies to secure your Azure Kubernetes Service (AKS) clusters

Solution: A new azure.subscription.aks.cluster resource allows you to explore and secure the settings in your Kubernetes control plane.

To list all AKS clusters:

cnquery> azure.subscription.aks.clusters
azure.subscription.aks.clusters: [
0: azure.subscription.aksService.cluster name="aks-dev-cluster" location="westeurope"
]

To select particular fields for each cluster:

cnquery> azure.subscription.aks.clusters{name rbacEnabled kubernetesVersion powerState}
azure.subscription.aks.clusters: [
0: {
rbacEnabled: true
powerState: "Running"
kubernetesVersion: "1.24.9"
name: "aks-dev-cluster"
}
]

Detect and secure PLCnext programmable logic controllers​

Problem: You need to secure Phoenix PLCnext programmable logic controllers to protect your physical infrastructure.

Solution: cnspec and cnquery now detect Phoenix PLCnext PLCs, and we've introduced a new community Phoenix PLCnext Security Policy that includes 22 security guidelines based on recommendations from PLCnext community.

cnquery PLCnext platform output:

platform: {
name: "plcnext"
build: "d755854b5b21ecb8dca26b0a560e6842a0c638d7"
title: "PLCnext"
version: "23.0.0.65"
}

New aws.ssm resource​

Problem: You want to write policies to secure your AWS Systems Manager (SSM) instances.

Solution: A new aws.ssm resource allows you to explore and secure the settings in your AWS Systems Manager (SSM) infrastructure.

To query SSM data using cnquery:

cnquery> aws.ssm.instances { * }
aws.ssm.instances: [
0: {
arn: "arn:aws:ssm:us-east-1:185972261234:instance/i-0f58c727dc7ca1337"
platformName: "Microsoft Windows Server 2022 Datacenter"
ipAddress: "172.1.89.50"
instanceId: "i-0f58c727dc7ca1337"
region: "us-west-2"
pingStatus: "Online"
tags: {
Name: "test-win"
}
}
1: {
arn: "arn:aws:ssm:us-east-1:185972261234:instance/i-04680e19801302600"
platformName: "Amazon Linux"
ipAddress: "172.1.80.30"
instanceId: "i-04680e19801302600"
region: "us-west-2"
pingStatus: "Online"
tags: {
Name: "badssm"
}
}
...

Or write a query for a policy:

cnquery> aws.ssm.instances.all(pingStatus == "Online")
[ok] value: true

🧹 IMPROVEMENTS​

Better integrations navigation menu​

We received tons of great feedback on the new navigation menu we released last week with Mondoo 7.16. Many of you asked for a simpler integrations menu that better represented the integrations in your spaces. This week we reworked the integrations menu to only show the integrations you've already set up and to always include a link to add new integrations. Thank you, everyone, for all the great feedback.

Integrations

Input validation when setting up Azure and Microsoft 365 integrations​

Securing your cloud can be difficult, but Mondoo shouldn't be. We've added example text and input validation to the Azure and Microsoft 365 integration setup pages to ensure you set up integrations with the correct values.

Integration Validation

Immediately scan GCP, Azure, and Microsoft 365 after setup​

Our GCP, Azure, and Microsoft 365 integrations now start scanning your infrastructure after setup so you can see results in minutes.

Improved platform names and grouping for cloud & SaaS assets​

To make it easier to find your assets, we've renamed several platforms and added new groups in the fleet view. azure, slack, and okta assets are now azure-subscription, slack-team, and okta-org to better represent what they contain. The fleet view includes new Okta, Google Workspace, and Slack groups for filtering assets by SaaS service.

Fleet

Show asset advisory counts in CVE views​

CVE pages now show information on the asset score for each affected asset as well as the total number of advisories for each asset so you can better prioritize which assets to patch first.

CVE View

Deploy cnspec with Chef Infra​

The mondoo cookbook 0.5.0 is now available on Chef Supermarket. This updated release now configures systems to use the cnspec service. If your system was configured with the existing cookbook release, don't worry; this release will automatically update systems from the mondoo service to the cnspec service.

Improve Google Workspace command​

googleworkspace is a tricky one to read so we renamed the Google Workspace provider to google-workspace. Now you can scan Google Workspace with the cnspec scan google-workspace command. Don't worry though; the old command still works to maintain backwards compatibility for automation.

Identify scratch containers​

cnspec now detects the platform and architecture of containers built from scratch. Many projects, including Kubernetes, use scratch-built containers.

Scratch container

πŸ› BUG FIXES AND UPDATES​

  • Allow showing asset utilization even if billing is not configured.
  • Improve the reliability of CIS GCP Foundation benchmark results.
  • Update help and errors for cnspec and cnquery Azure commands to make it more clear you can use both a .pfx and a .pem certificate file.
  • Fix parsing of certificate data on Linux with ports.listening resource.
  • Fix parsing of IPv6 data with the ports.listening resource.
  • Fix discovery of Google Workspace assets.
  • Fix a remediation step typo in the AWS Security by Mondoo policy.
  • Add a tooltip to the Get Support link in the navigation menu.
  • Fix links to ChatOps integrations in the navigation menu.
  • Fix errors running some Google Workspace resources.
  • Improve help for GitHub resources.
  • Improve the error message when Okta API requests fail.
  • Fix a cnspec panic when using the -o output reporter when all results produce an error.
  • Show errors when scanning systems with cnspec.
  • Show asset names with cnspec when using the -o report reporter.

Mondoo 7.16 is out!

Β· 6 min read
Mondoo Core Team

πŸ₯³ Mondoo 7.16 is out! This release includes new Azure, GCP, and Microsoft 365 integrations plus a whole new UI experience!​

Get this release: Installation Docs | Package Downloads | Docker Container


πŸŽ‰ NEW FEATURES​

New UI navigation experience​

Problem: There are many things you can do in the Mondoo Console, but sometimes it's hard to find what you need.

Solution: We rebuilt the navigation in the Mondoo Console from the ground up to make finding information and navigating your infrastructure easier. We replaced the top navigation tabs with a new navigation menu on the left side of the page. This menu includes frequently accessed sections of the UI that were previously tabs, such as Fleet, CI/CD, Integrations, and Policy Hub.

New UI

Sub-items in the menu make it easier to find what you're looking for without having to navigate through multiple pages. For example to view Kubernetes integrations you can select Integrations -> Kubernetes in the menu instead of loading the Integrations page and then selecting Kubernetes. This new menu also includes quick access to the Mondoo Vulnerability Database, which was previously buried deep in the Policy Hub. If you're thinking "I didn't know there was a Mondoo Vulnerability Database," well, that's why we have new menu.

Mondoo Vulnerability Database

We have plenty more planned to fill out this new navigation menu, so stay tuned for new releases.

New GCP, Azure, and Microsoft 365 integrations​

Problem: You need to continuously assess the security of all your cloud and SaaS resources.

Solution: You can now configure continuous scanning of GCP, Azure, and even Microsoft 365 services through the Mondoo Console. There's no need to download an agent or deploy any code into your infrastructure. Configure ready-only service credentials in the Mondoo Console and let Mondoo do the rest.

New Integrations Page

Manage vault secrets data with cnspec and cnquery​

Problem: You want to use a Mondoo inventory file to scan multiple assets, but you also need to securely store any required secrets.

Solution: cnspec and cnquery now include the ability to manage secrets data in vaults directly using the command line.

Given an existing Mondoo inventory file:

kind: Inventory
spec:
assets:
- id: 34.122.119.102
connections:
- host: 34.122.119.102
backend: ssh
credentials:
- type: password
user: chris
password: mypwd

You can use this inventory file to scan all defined assets:

cnspec scan --inventory-file inventory.yml

To securely store the secrets in this vault, you can define a keychain vault:

cnspec vault set mondoo-client-vault --type keyring
β†’ set new vault configuration name=mondoo-client-vault
β†’ stored vault configuration successfully

Then confirm that the vault is configured with the vault list command:

cnspec vault list
vault : mondoo-client-vault (keyring)

Next, add your secret to the keychain vault with the vault add-secret command:

cnspec vault add-secret mondoo-client-vault my-linux-user-secret '{ "user": "chris", "type": "password", "password: mypwd" }'

Now, you can reference the secret from the vault in your inventory:

kind: Inventory
spec:
assets:
- id: 34.122.119.102
connections:
- host: 34.122.119.102
backend: ssh
credentials:
- secret_id: my-linux-user-secret
vault:
name: mondoo-client-vault
type: keyring

Re-run the scan, and you will see that the secret was picked up:

cnspec scan --inventory-file inventory.yml

New AWS MQL resources​

Problem: You want to write policies to secure your Amazon ECR images and Amazon CloudFront distributions.

Solution: Mondoo now includes new resources for Amazon ECR and CloudFront so you can explore and secure even more of your Amazon infrastructure using MQL.

Querying ECR images:

cnquery> aws.ecr.images { * }
aws.ecr.images: [
0: {
registryId: "172746783610"
tags: [
0: "latest"
]
digest: "sha256:0c78b32ef7f3b41e3ed3115488d64a6faf7a3cdade2a5eb720092b6e8e0a88ca"
repoName: "vjtestpriv"
mediaType: "application/vnd.docker.distribution.manifest.v2+json"
}
]
cnquery> aws.ecr.publicRepositories { * }
aws.ecr.publicRepositories: []
cnquery> aws.ecr.privateRepositories { * }
aws.ecr.privateRepositories: [
0: {
uri: "172746783610.dkr.ecr.us-east-1.amazonaws.com/vjtestpriv"
public: false
region: "us-east-1"
registryId: "172746783610"
name: "vjtestpriv"
arn: "arn:aws:ecr:us-east-1:172746783610:repository/vjtestpriv"
images: [
0: aws.ecr.image id = vjtestpriv/sha256:0c78b32ef7f3b41e3ed3115488d64a6faf7a3cdade2a5eb720092b6e8e0a88ca
]
}
]

Querying CloudFront distributions and functions:

cnquery> aws.cloudfront { distributions { *} functions { * } }
aws.cloudfront: {
distributions: [
0: {
origins: [
0: aws.cloudfront.distribution.origin id = 185972265011/test-1be01d1424077260.elb.us-east-1.amazonaws.com
]
status: "Deployed"
cacheBehaviors: []
domainName: "d1w4eig1i8et92.cloudfront.net"
arn: "arn:aws:cloudfront::185972265011:distribution/E3J92HBG5Z8S6Q"
defaultCacheBehavior: {
AllowedMethods: {
CachedMethods: {
Items: [
0: "HEAD"
1: "GET"
]
Quantity: 2.000000
}
Items: [
0: "HEAD"
1: "GET"
]
Quantity: 2.000000
}
CachePolicyId: "658327ea-f89d-4fab-a63d-7e88639e58f6"
Compress: true
DefaultTTL: null
FieldLevelEncryptionId: ""
ForwardedValues: null
FunctionAssociations: {
Items: null
Quantity: 0.000000
}
LambdaFunctionAssociations: {
Items: null
Quantity: 0.000000
}
MaxTTL: null
MinTTL: null
OriginRequestPolicyId: null
RealtimeLogConfigArn: null
ResponseHeadersPolicyId: null
SmoothStreaming: false
TargetOriginId: "test-1be01d1424077260.elb.us-east-1.amazonaws.com"
TrustedKeyGroups: {
Enabled: false
Items: null
Quantity: 0.000000
}
TrustedSigners: {
Enabled: false
Items: null
Quantity: 0.000000
}
ViewerProtocolPolicy: "allow-all"
}
}
]
functions: [
0: {
status: ""
arn: "arn:aws:cloudfront:global:185972265011::/functions/vjtest"
comment: ""
stage: "DEVELOPMENT"
name: "vjtest"
runtime: "cloudfront-js-1.0"
lastModifiedTime: "2023-01-29T21:07:01Z"
createdTime: "2023-01-29T21:07:01Z"
}
]
}

GitHub Repository Best Practices policy​

Problem: You want to see the state of your GitHub repositories, including both security and best practices violations.

Solution: We split out non-security checks in the GitHub Repository Security by Mondoo policy into a new policy, GitHub Repository Best Practices by Mondoo, so you can report security and best practices issues independently from one another. We've also added a new query to the GitHub Repository Security by Mondoo policy to ensure repositories are configured to use Dependabot to report available updates for package management lock files, GitHub Actions, or Docker base images.

New Policy

🧹 IMPROVEMENTS​

Terraform configs now scan as terraform-hcl platform​

It isn't always clear that the terraform platform in fleet view was Terraform HCL configuration files, so we've renamed the terraform platform to terraform-hcl. Existing assets will continue to scan and display as terraform until scanned with an updated client.

Add publicAccessPrevention to gcp.storage.buckets resource​

The gcp.storage.buckets resource now includes publicAccessPrevention data. Here's an example of querying this data out for all buckets in a project:

gcp.storage.buckets { iamConfiguration['publicAccessPrevention'] }
gcp.storage.buckets: [
0: {
iamConfiguration[publicAccessPrevention]: "inherited"
}
1: {
iamConfiguration[publicAccessPrevention]: "inherited"
}
2: {
iamConfiguration[publicAccessPrevention]: "inherited"
}
3: {
iamConfiguration[publicAccessPrevention]: "inherited"
}
]

πŸ› BUG FIXES AND UPDATES​

  • The + button on the Managed Clients page now properly links to "Server & Endpoint Security" integrations.
  • The platform column in the Managed Clients page now displays platform values
  • Notification bell now indicates the number of unread notifications.
  • Update several integration logos to use high-resolution logos for retina displays.
  • Update integration pages with more consistent headers.
  • Handle errors when setting up integrations.
  • Add back the missing link to documentation on the Kubernetes integration page.
  • Change all references to Amazon AWS to be just AWS. No ATM machines here!
  • Fix the AWS Integration counts on the overview page not always matching actual counts.
  • Improve reliability of results in the CIS Microsoft Azure Foundations and CIS GCP Foundations policies
  • Don't mention the legacy Library name in the Mondoo Vulnerability Database
  • Update VMware examples in the console to use cnspec