Rules configuration

Configurations

• Disable rule
• Assign rule severity
• Time to live (TTL)
• Set up rule exceptions

Disable rule

Assign rule severity

• Extreme
• Very high
• High
• Medium
• Low

Time to live

1. A user signs in without MFA. The rule AWS IAM user has signed in without MFA run against the resources associated with your cloud account to create an event on RTPM and a check on the All Checks Report
2. This Check will be seen on the All Checks Report for the period specified in the Time to live (TTL) configuration for the rule
3. After the TTL expires, the Check will be removed. Next time the user signs into their account without MFA, a new Check will be created
4. However, the entire event history will still show in the Real Time Posture Monitoring dashboard

Note TTL is designed in such a way that prevents Cloud Risk Management's notifications service sending too many notifications for the same Check in a short period of time. After the first notification is sent for a Check, the following Checks that are identical to the one that has already been sent will be discarded during the TTL period. Once the period expires, the Check is eligible to be notified again. When exceptions are saved to an account’s Rule configuration, matching resources will be immediately excluded from checks.

Set up rule exceptions

Note When exceptions are saved to an account’s Rule configuration, matching resources will be immediately excluded from checks. Rules that require data from multiple resources do not support exceptions. Service level rules do not support exceptions.

1. Tags - Either the tag key, the tag value or a combination in the format tag_key::tag_value can be provided as input
2. Resource Id - Unique resource identifier determined by the cloud provider. You could also use regex expressions to configure exceptions.

• Note: The format of a Resource Id varies depending on the resource type. To check a Resource ID, use the List Checks API.
  Resource Id Examples:
  • For most AWS resource types, the Resource Id is the ARN.
  • For AWS IAM or S3, the Resource Id matches the resource name.
  • For AWS EC2 and VPC, the Resource Id usually matches the randomly generated Id, e.g. sg-001234d891234abcd.
  • For most Azure resource types, the Resource Id is the full path, e.g. /subscriptions/1234-1234-1234/resourceGroups/myResourceGroup/providers/microsoft.resource/resourceType/my-resource-name.

Note Please Note: Cloud Risk Management will apply exceptions immediately once you save them. You do not need to run Compliance scan to exclude the desired resources.

Apply rule changes to multiple accounts

1. Make changes in any or all of the rule configurations available - Disable rule, Assign rule severity, or Set up rule exceptions
2. Click Select other accounts
   
3. From the list, select the accounts to which rule changes should be applied and Select accounts

Note For audit purposes, adding a note is mandatory for every change made to the rule configuration. The changes will take effect after the subsequent bot run. Disabled rules are greyed out and identified by a 'Disabled' text highlight Rules with exception configured (resource id or tag) are identified by a warning icon Rules that need configuration prior to running are identified by a red cross icon.