ScubaGear Files

Major Changes

• Support policy check toggling via config file https://github.com/cisagov/ScubaGear/pull/1200 See configuration file documentation about omitting policies for further details.
• Make ScubaResults.json the default result output https://github.com/cisagov/ScubaGear/pull/1316 See documentation for -KeepIndividualJSON parameter to revert to previous version behavior.
• Improve AAD assessment check performance https://github.com/cisagov/ScubaGear/pull/1196
• Modify MS.AAD.6.1v1 to account for federated domains https://github.com/cisagov/ScubaGear/pull/1185
• Remove deprecated MS.SHAREPOINT.4.1v1 policy, references, and assessment checks https://github.com/cisagov/ScubaGear/pull/1244
• Change MS.SHAREPOINT.1.4v1 check to not-implemented due to deprecated field https://github.com/cisagov/ScubaGear/pull/1270
• Add policy check for MS.SHAREPOINT.3.2v1 when using service principal and update MS.SHAREPOINT.4.2v1 check for deprecation https://github.com/cisagov/ScubaGear/pull/1309
• Add assessment check for MS.DEFENDER.6.2v1 https://github.com/cisagov/ScubaGear/pull/1241
• Add policy check for MS.AAD.3.7v1 to support exclusions https://github.com/cisagov/ScubaGear/pull/1190
• Realign MS.EXO.2.1v1 and MS.EXO.2.2v2 SPF assessment checks with updated policies https://github.com/cisagov/ScubaGear/pull/1130
• Add a backup path to look for the OPA executable in the current directory https://github.com/cisagov/ScubaGear/pull/1092
• Enhance CSV output to be consistent with data in HTML reports https://github.com/cisagov/ScubaGear/pull/1281
• Bump acceptable OPA version to v0.69.0 and set new accepted minimum to v0.69.0 https://github.com/cisagov/ScubaGear/pull/1348
• Add -OutActionPlanFileName for action plan remediation CSV output https://github.com/cisagov/ScubaGear/pull/1351
• Add report UUID to the ScubaResults.json filename https://github.com/cisagov/ScubaGear/pull/1426
• See full list of enhancements here

Bugs Fixed

• Correct bug with Connect-IPPSSession error handling https://github.com/cisagov/ScubaGear/pull/1199
• Extend Microsoft.Graph.* dependency max version from 2.19.x -> 2.x.x https://github.com/cisagov/ScubaGear/pull/1122
• Fix AAD 401 authentication errors against GCC high tenants https://github.com/cisagov/ScubaGear/pull/1266
• Fix encoding issue by removing BOM from provider output files https://github.com/cisagov/ScubaGear/pull/1302
• Fix AAD provider to handle nested PIM groups and refactor Get-PrivilegedUser https://github.com/cisagov/ScubaGear/pull/1310
• Pin PowerApps module dependency to last tested working version https://github.com/cisagov/ScubaGear/pull/1346
• Fix broken import path in Initialize-SCuBA https://github.com/cisagov/ScubaGear/pull/1363
• See full list of bug fixes here

Baselines

• Add MITRE ATT&CK Mappings to all M365 secure configuration baselines https://github.com/cisagov/ScubaGear/pull/1106
• Change Azure Active Directory namings in baselines to use Entra ID equivalent https://github.com/cisagov/ScubaGear/pull/1176
• Remove MS.SHAREPOINT.4.1v1 policy and references https://github.com/cisagov/ScubaGear/pull/1244
• Fix circular reference between MS.EXO.16.1v1 and MS.DEFENDER.5.1v1 implementation instructions https://github.com/cisagov/ScubaGear/pull/1198
• Revise MS.EXO.2.1v1 and MS.EXO.2.2v2 SPF requirements https://github.com/cisagov/ScubaGear/pull/1130
• Decouple the remaining EXO Shall/Should policies https://github.com/cisagov/ScubaGear/pull/1095
• Added notes about applicability to MS.TEAMS.2.2v1 and MS.TEAMS.3.1v1 https://github.com/cisagov/ScubaGear/pull/1219
• Updated MS.AAD.5.2v1 instructions to match updated UI buttonology https://github.com/cisagov/ScubaGear/pull/1117
• Update front matter and specific language in the Defender SCB to clarify licensing information https://github.com/cisagov/ScubaGear/pull/1398
• See full list of baseline updates here

Documentation

• Cleaning up and streamlining example config files https://github.com/cisagov/ScubaGear/pull/1137
• Minor documentation fixes and updates https://github.com/cisagov/ScubaGear/pull/1157
• Add additional shields.io badges to README https://github.com/cisagov/ScubaGear/pull/1167
• See full list of documentation changes here

Full Changelog: https://github.com/cisagov/ScubaGear/compare/v1.3.0...v1.4.0