Example rules

import "infrawatch"

rule Exposed_Redis_Without_Authentication {
  meta:
    description = "Redis accepted a probe without requiring authentication"

  condition:
    defined infrawatch.scan.redis.authentication_required and
    infrawatch.scan.port == 6379 and
    not infrawatch.scan.redis.authentication_required
}

import "infrawatch"

rule Anonymous_MQTT_System_Topics {
  meta:
    description = "MQTT accepted an anonymous connection and exposed system topics"

  condition:
    defined infrawatch.scan.mqtt.anonymous_connect_allowed and
    infrawatch.scan.mqtt.anonymous_connect_allowed and
    infrawatch.scan.mqtt.sys_subscribe_allowed
}

import "infrawatch"

rule Public_HTTP_Admin_Panel {
  meta:
    description = "A successful HTTP response identifies an administration surface"

  condition:
    defined infrawatch.scan.http.response.status_code and
    infrawatch.scan.http.response.status_code == 200 and
    infrawatch.scan.http.response.body.html.title icontains "admin"
}