-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Open
Labels
Description
Describe the bug
When azurerm_monitor_activity_log_alert
is used to create a new alert, the following spelling is used:
{
"id": "/subscriptions/[...]/resourceGroups/[...]/providers/Microsoft.Insights/activityLogAlerts/Alert for Create Policy Assignment",
"name": "Alert for Create Policy Assignment",
"type": "Microsoft.Insights/ActivityLogAlerts",
"location": "global",
[...]
When such an alert is created, ScoutSuite does not find it, because it checks for region Global
(see DisplayName
and Name
spelling of region names):
ScoutSuite/ScoutSuite/providers/azure/resources/loggingmonitoring/activity_log_alerts.py
Lines 44 to 47 in 7909f2f
def ensure_alert_exist(self, log_alerts, equals_value: str): | |
for log_alert in log_alerts: | |
if log_alert.location == 'Global' and log_alert.enabled: | |
if '/subscriptions/' + self.subscription_id in log_alert.scopes: |
Proposed fix
Make the string comparison case insensitive.