From fce04e85de4bd10da17007fb04818effc4257b24 Mon Sep 17 00:00:00 2001 From: ezzeddinemtar Date: Fri, 17 Oct 2025 17:31:58 +0200 Subject: [PATCH 1/3] added SEF-01 --- .../SIEMEnabled/SIEMEnabled.yml | 11 +++++ .../LoggingMonitoring/SIEMEnabled/data.json | 4 ++ .../LoggingMonitoring/SIEMEnabled/metric.rego | 26 +++++++++++ ontology/1.0/core/security.owx | 35 +++++++++++++++ ontology/1.0/ontology-merged.owx | 43 ++++++++++++++++++- ontology/1.0/ontology.proto | 12 ++++++ ontology/1.0/resource/infrastructure.owx | 10 +++++ 7 files changed, 140 insertions(+), 1 deletion(-) create mode 100644 metrics/LoggingMonitoring/SIEMEnabled/SIEMEnabled.yml create mode 100644 metrics/LoggingMonitoring/SIEMEnabled/data.json create mode 100644 metrics/LoggingMonitoring/SIEMEnabled/metric.rego diff --git a/metrics/LoggingMonitoring/SIEMEnabled/SIEMEnabled.yml b/metrics/LoggingMonitoring/SIEMEnabled/SIEMEnabled.yml new file mode 100644 index 00000000..c79c9d0e --- /dev/null +++ b/metrics/LoggingMonitoring/SIEMEnabled/SIEMEnabled.yml @@ -0,0 +1,11 @@ +# ====== Metadata ====== +id: SIEMEnabled +description: This rule assesses whether a [LoggingService] offers [SecurityInformationEventManagement] with its [p1:enabled] property set correctly. +category: LoggingMonitoring +version: "1.0" +comments: Security Incident and Event Management solutions aggregate security telemetry to detect and manage incidents. Enabling the SIEM capability ensures analysts can collect, correlate, and investigate events, supporting security incident response and forensic workflows. +# ====== Configuration ====== +configuration: + p1: + operator: "==" + targetValue: True diff --git a/metrics/LoggingMonitoring/SIEMEnabled/data.json b/metrics/LoggingMonitoring/SIEMEnabled/data.json new file mode 100644 index 00000000..5d2b55a1 --- /dev/null +++ b/metrics/LoggingMonitoring/SIEMEnabled/data.json @@ -0,0 +1,4 @@ +{ + "operator" : "==", + "target_value" : true +} diff --git a/metrics/LoggingMonitoring/SIEMEnabled/metric.rego b/metrics/LoggingMonitoring/SIEMEnabled/metric.rego new file mode 100644 index 00000000..2ab3a0b6 --- /dev/null +++ b/metrics/LoggingMonitoring/SIEMEnabled/metric.rego @@ -0,0 +1,26 @@ +package cch.metrics.siem_enabled + +import data.cch.compare +import rego.v1 + +default applicable = false + +default compliant = false + +siem := input.securityInformationEventManagement { + input.securityInformationEventManagement +} + +siem := input.loggingService.securityInformationEventManagement { + input.loggingService.securityInformationEventManagement +} + +enabled := siem.enabled + +applicable if { + enabled != null +} + +compliant if { + compare(data.operator, data.target_value, enabled) +} diff --git a/ontology/1.0/core/security.owx b/ontology/1.0/core/security.owx index 131b325b..7b1f7a43 100644 --- a/ontology/1.0/core/security.owx +++ b/ontology/1.0/core/security.owx @@ -152,6 +152,9 @@ + + + @@ -639,6 +642,28 @@ xsd:java.time.Duration + + + + + + + + + + + + + + + + + + + + + + @@ -1126,6 +1151,16 @@ core:SecurityFeature SecurityFeature + + + core:SecurityInformationEventManagement + Aggregates and correlates security telemetry across connected sources to support security incident detection and response (SIEM), e.g., Azure Security Insights (https://learn.microsoft.com/en-us/rest/api/securityinsights/). + + + + core:SecurityInformationEventManagement + SecurityInformationEventManagement + core:Signature diff --git a/ontology/1.0/ontology-merged.owx b/ontology/1.0/ontology-merged.owx index 52fd7ab5..e64dba54 100644 --- a/ontology/1.0/ontology-merged.owx +++ b/ontology/1.0/ontology-merged.owx @@ -419,6 +419,9 @@ + + + @@ -2348,6 +2351,28 @@ xsd:java.time.Duration + + + + + + + + + + + + + + + + + + + + + + @@ -2359,6 +2384,13 @@ + + + + + + + @@ -4375,6 +4407,16 @@ name = metadata.name /classes/SecurityFeature SecurityFeature + + + /classes/SecurityInformationEventManagement + Aggregates and correlates security telemetry across connected sources to support security incident detection and response (SIEM), e.g., Azure Security Insights (https://learn.microsoft.com/en-us/rest/api/securityinsights/). + + + + /classes/SecurityInformationEventManagement + SecurityInformationEventManagement + /classes/ServiceMetadataDocument @@ -5445,4 +5487,3 @@ name = metadata.name - diff --git a/ontology/1.0/ontology.proto b/ontology/1.0/ontology.proto index 16a459bf..a8c26248 100644 --- a/ontology/1.0/ontology.proto +++ b/ontology/1.0/ontology.proto @@ -104,6 +104,16 @@ message AnomalyDetection { ApplicationLogging application_logging = 11132; } +message SecurityInformationEventManagement { + option (resource_type_names) = "SecurityInformationEventManagement"; + option (resource_type_names) = "Auditing"; + option (resource_type_names) = "SecurityFeature"; + + bool enabled = 21162; + optional string workspace_id = 21163; + repeated string logging_service_ids = 21164; +} + // Application is an entity class in our ontology. It can be instantiated and contains all of its properties as well of its implemented interfaces. // This encapsulates the whole (source) code of an application. message Application { @@ -1531,6 +1541,7 @@ message LoggingService { repeated string compute_ids = 10285; GeoLocation geo_location = 4238; repeated Logging loggings = 5453; + SecurityInformationEventManagement security_information_event_management = 21165; repeated Redundancy redundancies = 1550; optional string parent_id = 258; optional string service_metadata_document_id = 16013; @@ -2392,6 +2403,7 @@ message SecurityFeature { LocalAttestation local_attestation = 4296; RemoteAttestation remote_attestation = 13640; AutomaticUpdates automatic_updates = 9990; + SecurityInformationEventManagement security_information_event_management = 21165; DocumentChecksum document_checksum = 16099; Immutability immutability = 2008; DocumentSignature document_signature = 7943; diff --git a/ontology/1.0/resource/infrastructure.owx b/ontology/1.0/resource/infrastructure.owx index f11f201f..4f4c9909 100644 --- a/ontology/1.0/resource/infrastructure.owx +++ b/ontology/1.0/resource/infrastructure.owx @@ -116,6 +116,9 @@ + + + @@ -763,6 +766,13 @@ + + + + + + + From 45d3d4f152429c5c3d009ad6b7ec4e64ab55d3ec Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 17 Oct 2025 15:34:27 +0000 Subject: [PATCH 2/3] Add merged ontology file [skip ci] --- ontology/1.0/ontology-merged.owx | 45 ++++++++++++++++---------------- 1 file changed, 23 insertions(+), 22 deletions(-) diff --git a/ontology/1.0/ontology-merged.owx b/ontology/1.0/ontology-merged.owx index e64dba54..ba8fe07a 100644 --- a/ontology/1.0/ontology-merged.owx +++ b/ontology/1.0/ontology-merged.owx @@ -2351,28 +2351,6 @@ xsd:java.time.Duration - - - - - - - - - - - - - - - - - - - - - - @@ -2951,6 +2929,28 @@ + + + + + + + + + + + + + + + + + + + + + + @@ -5487,3 +5487,4 @@ name = metadata.name + From b93849495882242329157bf214041cf41b2f2fc1 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 17 Oct 2025 15:34:28 +0000 Subject: [PATCH 3/3] Add generated proto file [skip ci] --- ontology/1.0/ontology.proto | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/ontology/1.0/ontology.proto b/ontology/1.0/ontology.proto index a8c26248..aa8d2fa2 100644 --- a/ontology/1.0/ontology.proto +++ b/ontology/1.0/ontology.proto @@ -104,16 +104,6 @@ message AnomalyDetection { ApplicationLogging application_logging = 11132; } -message SecurityInformationEventManagement { - option (resource_type_names) = "SecurityInformationEventManagement"; - option (resource_type_names) = "Auditing"; - option (resource_type_names) = "SecurityFeature"; - - bool enabled = 21162; - optional string workspace_id = 21163; - repeated string logging_service_ids = 21164; -} - // Application is an entity class in our ontology. It can be instantiated and contains all of its properties as well of its implemented interfaces. // This encapsulates the whole (source) code of an application. message Application { @@ -184,6 +174,7 @@ message Auditing { OSLogging os_logging = 2926; ResourceLogging resource_logging = 17563; MalwareProtection malware_protection = 7265; + SecurityInformationEventManagement security_information_event_management = 15645; UsageStatistics usage_statistics = 15242; } } @@ -1541,9 +1532,9 @@ message LoggingService { repeated string compute_ids = 10285; GeoLocation geo_location = 4238; repeated Logging loggings = 5453; - SecurityInformationEventManagement security_information_event_management = 21165; repeated Redundancy redundancies = 1550; optional string parent_id = 258; + SecurityInformationEventManagement security_information_event_management = 4922; optional string service_metadata_document_id = 16013; repeated string storage_ids = 7044; TransportEncryption transport_encryption = 17323; @@ -2378,6 +2369,7 @@ message SecurityFeature { OSLogging os_logging = 2926; ResourceLogging resource_logging = 17563; MalwareProtection malware_protection = 7265; + SecurityInformationEventManagement security_information_event_management = 15645; UsageStatistics usage_statistics = 15242; CertificateBasedAuthentication certificate_based_authentication = 560; TokenBasedAuthentication token_based_authentication = 3684; @@ -2403,15 +2395,25 @@ message SecurityFeature { LocalAttestation local_attestation = 4296; RemoteAttestation remote_attestation = 13640; AutomaticUpdates automatic_updates = 9990; - SecurityInformationEventManagement security_information_event_management = 21165; DocumentChecksum document_checksum = 16099; Immutability immutability = 2008; DocumentSignature document_signature = 7943; ExplainableResults explainable_results = 6217; RobustnessScore robustness_score = 12988; + SecurityInformationEventManagement security_information_event_management = 15645; } } +// SecurityInformationEventManagement is an entity class in our ontology. It can be instantiated and contains all of its properties as well of its implemented interfaces. +// Aggregates and correlates security telemetry across connected sources to support security incident detection and response (SIEM), e.g., Azure Security Insights (https://learn.microsoft.com/en-us/rest/api/securityinsights/). +message SecurityInformationEventManagement { + option (resource_type_names) = "SecurityInformationEventManagement"; + option (resource_type_names) = "SecurityFeature"; + + bool enabled = 14252; + repeated string logging_service_ids = 3352; +} + // SecurityTraining is an entity class in our ontology. It can be instantiated and contains all of its properties as well of its implemented interfaces. message SecurityTraining { option (resource_type_names) = "SecurityTraining";