Security services and scanners

Per-type reference · From docs/INVENTORY_CATALOG.md on GitHub

WAF_WEB_ACL

Catalog entries that classify native resources as this type:

• AWS ARN: wafv2:webacl
• Azure ARM: microsoft.cdn/cdnwebapplicationfirewallpolicies, microsoft.network/applicationgatewaywebapplicationfirewallpolicies, microsoft.network/frontdoorwebapplicationfirewallpolicies

• GCP Cloud Asset Inventory: compute.googleapis.com/NetworkEdgeSecurityService, compute.googleapis.com/RegionSecurityPolicy, compute.googleapis.com/SecurityPolicy

• Providers: AWS, AZURE, GCP

• Metadata keys: adaptive_protection (bool), collected_via (str), create_time (null), description (null), folders (list), gcp_asset_type (str), kind (null), location (str), network_tags (list), organization (str), parent_asset_type (null), parent_full_resource_name (str), project (str), project_id (str), project_number (str), properties (object), resource_group (str), resource_type (str), rule_count (int), sku (null), state (null)
• Carries aliases: yes
• Declared relations: CONTAINS ←
• Edges out:
  PROTECTS / PROTECTED_BY_WAF → LOAD_BALANCER
• Edges in:
  CONTAINS ← CLOUD_ACCOUNT, RESOURCE_GROUP

NETWORK_FIREWALL

Catalog entries that classify native resources as this type:

• AWS ARN: network-firewall:firewall

• Azure ARM: microsoft.network/azurefirewalls, microsoft.network/firewallpolicies

• Providers: AWS, AZURE

• Can be internet-exposed: yes (is_internet_exposed observed true)
• Metadata keys: associations (list), collected_via (str), kind (null), owner_id (str), private_ip (str), properties (object), resource_group (str), resource_kind (str), resource_type (str), share_status (null), sku (null)
• Carries aliases: yes
• Declared relations: ATTACHED_TO ←, CONTAINS ←, CONTAINS / SUBNET_CONTAINS_INSTANCE ←, PROTECTS / PROTECTED_BY_NACL
• Edges out:
  PROTECTS / PROTECTED_BY_NACL → VPC
• Edges in:
  ATTACHED_TO ← ELASTIC_IP
CONTAINS ← RESOURCE_GROUP
CONTAINS / SUBNET_CONTAINS_INSTANCE ← SUBNET
LOAD_BALANCER_TARGET / LB_TARGETS_INSTANCE ← LOAD_BALANCER
ROUTE / TRANSIT_ROUTED ← ROUTE_TABLE

DDOS_PROTECTION

Catalog entries that classify native resources as this type:

• Azure ARM: microsoft.network/ddosprotectionplans

• Providers: AWS

• Metadata keys: auto_renew (str), enabled (bool), proactive_engagement (str), protections (int), security_service (str)

THREAT_DETECTOR

GuardDuty, Detective.

Catalog entries that classify native resources as this type:

• AWS ARN: guardduty:detector

• Azure ARM: microsoft.security/pricings, microsoft.securityinsights/settings

• Providers: AWS, AZURE

• Metadata keys: administrator_account (null), enabled (bool), features (object), finding_frequency (str), pricing_tier (str), resource_type (str), security_service (str), status (str), sub_plan (null | str)
• Carries aliases: yes
• Declared relations: MONITORS / MONITORED_BY
• Edges out:
  MONITORS / MONITORED_BY → CLOUD_ACCOUNT

SECURITY_HUB

Catalog entries that classify native resources as this type:

• AWS ARN: securityhub:hub

• Providers: AWS

• Metadata keys: enabled (bool), security_service (str), status (str)
• Carries aliases: yes

VULNERABILITY_SCANNER

Inspector.

• Providers: AWS
• Metadata keys: enabled (bool), security_service (str), status (str)
• Carries aliases: yes

DATA_SECURITY_SCANNER

Macie.

• Providers: AWS
• Metadata keys: enabled (bool), finding_frequency (str), security_service (str), service_role (str)
• Carries aliases: yes
• Declared relations: ASSUMES_ROLE / RUNS_ON, MONITORS / MONITORED_BY
• Edges out:
  MONITORS / MONITORED_BY → CLOUD_ACCOUNT

CONFIG_RECORDER

• Providers: AWS
• Metadata keys: enabled (bool), security_service (str), status (str)
• Carries aliases: yes

ACCESS_ANALYZER

Catalog entries that classify native resources as this type:

• AWS ARN: access-analyzer:analyzer

Not exercised by the fixtures. Produced by collectors or catalogs for resources the test estates do not contain; carries the common keys above plus collector-specific fields.