CSControlSpec
Menu
More

Prerequisites

What has to be switched on before a check can work.

A check can only find records that your systems are sending. This page lists the telemetry and evidence to prepare before running a pack.

Example: a Microsoft Sentinel check may need the IdentityInfo table. If that table is not enabled, the query returns zero rows even when the data is simply missing.

How this fits together

A working check has three parts:

  1. 1
    Provision

    Enable the resource and its data export. This page.

  2. 2
    Observe

    Records arrive in Microsoft Sentinel, AWS, or Splunk.

  3. 3
    Check

    The query reads the records and a person reviews the result. Browse checks →

If step 1 is skipped, step 3 may return nothing. This page lists the dependency; it does not deploy anything for you.

What this page tells you

  • Which records each check reads.
  • Where to enable them.
  • What you must supply and where it goes.
  • Which steps still need a person.

What it does not do

  • It does not change your systems or collect credentials.
  • The Terraform outline is optional and unapplied.
  • It does not prove the running system matches the configuration.

What to enable

Pick a check. See what has to be switched on.

Choose a check to see its data dependencies, setup location, and manual steps.

Provision → observe → check
Pick the check you intend to run. The list below is what has to exist first.
The same control depends on different things on each platform.
Doing this in code, with Terraform Optional. The same list as an infrastructure-as-code outline, for teams that provision cloud resources that way.

Terraform can create a resource and enable the recording it needs in the same change.

Nothing below has been applied. Add your own names, regions, retention, and provider settings before using it.

The provisioning outline

Reviewing the change

Use the result honestly

This is a dependency outline, not a ready-to-run module. Enabling telemetry lets a query find data; it does not make a finding true or establish compliance.

Terraform cannot prove that the running environment matches the code. Do not put credentials, secrets, private repository contents, or production evidence into this site.

Related pages