Skip to content

Overview

Monkey365 helps streamline the process of performing not only Microsoft 365, but also Azure subscriptions and Microsoft Entra ID Security Reviews.

200+ checks covering industry defined security best practices for Microsoft 365, Azure and Microsoft Entra ID.

All rulesets are located at $monkey365_DIR/rules/ruleset directory.

Monkey365 will help consultants to assess cloud environment and to analyze the risk factors according to controls and best practices. The report will contain structured data for quick checking and verification of the results.

Rules

A Monkey365 rule consists of instructions designed to query cloud data to identify misconfigurations. The Monkey365 core analyzer processes user-defined rules, assesses them against cloud data, and generates violations for any matched rules. A set of one or more rules forms a Ruleset, which helps organize multiple rules that work towards a common objective.

Rule

A Rule, written in JSON, includes metadata, conditions, and actions. It directs the core analyzer to execute specific actions when the defined conditions are met.

Rule Metadata

Rule metadata contains general information about a rule:

1.- serviceType: This is the friendly name of the application/service that is checked, displayed on the HTML dashboard.

2.- serviceName: This is the friendly name of the provider, which is displayed on the HTML sidebar.

3.- displayName: The rule name.

4.- description: The rule description. Rule description supports Markdown. That way you can add links and apply minor text styles.

5.- references: This parameter is optional. You can add external links in order to help consultants find more information about findings. Result output will sometimes be more than enough to explain what the issue is, but it can also be beneficial to explain why an issue exists, and this is a great place to do that. Additional elements such as remediation or rationale can be added to existing JSON rule. Both of them supports Markdown.

6.- The query property determines the checks Monkey365 will use to search for misconfigurations.

7.- idSuffix: UniqueID for the rule.

Rule Levels

The rule's severity is specified in the metadata using the level field. The severity can be one of the following values:

  • informational
  • low
  • medium
  • high
  • critical

Rule Status

If the rule is executed correctly (error-free), the core analyzer will assign a status property based on the following criteria:

  • Pass: If the rule's query meets the configured value.
  • Fail: If the rule's query does not meet the configured value.
  • Manual: If the query is empty, the analyzer will flag the rule as manual, indicating that manual intervention is needed.

Rule Condition

Every rule should have a query block that contains exactly one or more conditions. A condition defines a search query to be evaluated against the input data.

"query": [
  {
    "operator": "and",
    "filter": [
      {
        "conditions": [
          [
            "isEnabled",
            "eq",
            "True"
          ],
          [
            "policyName",
            "match",
            "Built-In"
          ]
        ],
        "operator": "and"
      },
      {
        "conditions": [
          [
            "Policy.ScanUrls",
            "eq",
            "False"
          ],
          [
            "Policy.AllowClickThrough",
            "eq",
            "True"
          ],
          [
            "Policy.EnableSafeLinksForEmail",
            "eq",
            "False"
          ]
        ],
        "operator": "or"
      }
    ]
  }
]

Multiple PowerShell comparison operators are supported. The following link is a list of comparison operators supported by PowerShell.

Ruleset

A set of one or more rules forms Ruleset, which helps organize multiple rules that work towards a common objective.

A ruleset is formed by placing one or more JSON rule files in a directory and creating a ruleset.json within it.

The ruleset file stores metadata of the Ruleset, as described here

Supported standards

By default, the HTML report displays the CIS (Center for Internet Security) Benchmarks. The CIS Benchmarks for Azure and Microsoft 365 provide security and compliance best-practice recommendations.

The following CIS standards are supported by Monkey365:

  • CIS Microsoft Azure Foundations Benchmark v6.0.0
  • CIS Microsoft Azure Database Services Benchmark v2.0.0
  • CIS Microsoft Azure Compute Services Benchmark v2.0.0
  • CIS Microsoft 365 Foundations Benchmark v7.0.0

Microsoft Entra ruleset

Monkey365 also includes a dedicated security ruleset for Microsoft Entra. This is a Monkey365-specific ruleset and is not part of the CIS Benchmarks.

The Microsoft Entra ruleset is decoupled from the Azure and Microsoft 365 benchmark rulesets and is maintained independently. This allows it to evolve separately from CIS benchmark releases and provides expanded coverage through a comprehensive set of security checks focused exclusively on Microsoft Entra environments.

Additional standards and compliance frameworks, including NIST, HIPAA, GDPR, and PCI DSS, are planned for future releases as they become available.

Notes about security controls

For each standard, and depending on the environment, there is a list of applicable controls. Depending on the standard, some checks may be procedure, or process related best-practices, so this can't be verified by Monkey365. Some of them don't have any rule implemented yet, but will have in the future.