Live Security Alerts

CRITICAL AZURE Storage Account Missing Encryption for PHI Data OPEN 2 min ago ▼

RESOURCE

pyxhealthprodstore01
Type: Microsoft.Storage/storageAccounts
ID: /subscriptions/7e5a...d3f1/resourceGroups/rg-pyx-prod/providers/Microsoft.Storage/storageAccounts/pyxhealthprodstore01

LOCATION

Cloud: Azure
Region: East US 2
Subscription: PYX-Health-Production

COMPLIANCE FRAMEWORKS

HIPAA §164.312(a)(2)(iv) HITRUST 09.x NIST SC-28

TIMESTAMP

2026-04-16T14:23:07Z

WHY FLAGGED

Storage account contains PHI (Protected Health Information) in HL7/FHIR blobs but does NOT have customer-managed key (CMK) encryption enabled. Data-at-rest encryption uses only Microsoft-managed keys, violating HIPAA encryption requirements for ePHI storage.

HOW TO FIX

1. Create a Key Vault key (RSA 2048+) in the same region
2. Enable CMK encryption: Storage Account → Encryption → Customer-managed keys
3. Select the Key Vault key and enable automatic key rotation
4. Verify encryption status in Azure Policy

CRITICAL AZURE NSG Allows SSH (Port 22) from Internet 0.0.0.0/0 OPEN 4 min ago ▼

RESOURCE

nsg-pyx-prod-001
Type: Microsoft.Network/networkSecurityGroups
ID: /subscriptions/7e5a...d3f1/resourceGroups/rg-pyx-prod/providers/Microsoft.Network/networkSecurityGroups/nsg-pyx-prod-001

LOCATION

Cloud: Azure
Region: East US 2
Subscription: PYX-Health-Production

COMPLIANCE FRAMEWORKS

HIPAA §164.312(e) NIST SC-7 PCI-DSS 1.3 SOC 2 CC6.6

TIMESTAMP

2026-04-16T14:22:45Z

WHY FLAGGED

Network Security Group has an inbound rule allowing SSH (TCP/22) from source 0.0.0.0/0 (any internet address). This exposes the production environment to brute-force attacks, credential stuffing, and unauthorized remote access from anywhere on the internet.

HOW TO FIX

1. Remove the Allow-SSH-Inbound rule from nsg-pyx-prod-001
2. Restrict SSH to specific IP ranges (corporate VPN CIDR blocks only)
3. Deploy Azure Bastion for secure jump-box access
4. Enable Just-In-Time VM Access in Microsoft Defender

HIGH AZURE SQL Server Public Network Access Enabled INVESTIGATING 7 min ago ▼

RESOURCE

sqlsrv-pyx-prod
Type: Microsoft.Sql/servers
ID: /subscriptions/7e5a...d3f1/resourceGroups/rg-pyx-prod/providers/Microsoft.Sql/servers/sqlsrv-pyx-prod

LOCATION

Cloud: Azure
Region: East US 2
Subscription: PYX-Health-Production

COMPLIANCE FRAMEWORKS

HIPAA §164.312(a)(1) SOC 2 CC6.1 NIST AC-4

TIMESTAMP

2026-04-16T14:20:31Z

WHY FLAGGED

SQL Server has public network access set to "Enabled" and a firewall rule allowing 0.0.0.0 - 255.255.255.255 (AllowAllWindowsAzureIps). The database stores PHI and is directly reachable from the public internet, bypassing network isolation controls.

HOW TO FIX

1. Disable public network access on sqlsrv-pyx-prod
2. Configure Private Endpoint for VNet-only access
3. Remove the AllowAllWindowsAzureIps firewall rule
4. Enable Advanced Threat Protection for SQL

HIGH AZURE Key Vault Soft Delete and Purge Protection Disabled OPEN 9 min ago ▼

RESOURCE

kv-pyx-prod-001
Type: Microsoft.KeyVault/vaults
ID: /subscriptions/7e5a...d3f1/resourceGroups/rg-pyx-prod/providers/Microsoft.KeyVault/vaults/kv-pyx-prod-001

LOCATION

Cloud: Azure
Region: East US 2
Subscription: PYX-Health-Production

COMPLIANCE FRAMEWORKS

HITRUST 09.l NIST SC-12 SOC 2 CC6.1

TIMESTAMP

2026-04-16T14:19:58Z

WHY FLAGGED

Key Vault does not have soft-delete or purge protection enabled. Accidental or malicious deletion of encryption keys, secrets, or certificates would be permanent and unrecoverable, potentially causing data loss for all resources depending on these keys.

HOW TO FIX

1. Enable soft-delete: az keyvault update --name kv-pyx-prod-001 --enable-soft-delete true
2. Enable purge protection: az keyvault update --name kv-pyx-prod-001 --enable-purge-protection true
3. Set retention to 90 days (default)
4. Verify in Azure Policy compliance

HIGH AZURE AKS Cluster Kubernetes RBAC Not Enabled OPEN 11 min ago ▼

RESOURCE

aks-pyx-prod
Type: Microsoft.ContainerService/managedClusters
ID: /subscriptions/7e5a...d3f1/resourceGroups/rg-pyx-prod/providers/Microsoft.ContainerService/managedClusters/aks-pyx-prod

LOCATION

Cloud: Azure
Region: East US 2
Subscription: PYX-Health-Production

COMPLIANCE FRAMEWORKS

SOC 2 CC6.1 NIST AC-6 HIPAA §164.312(a)(1)

TIMESTAMP

2026-04-16T14:18:42Z

WHY FLAGGED

AKS cluster does not have Kubernetes RBAC enabled. All authenticated users have full cluster-admin privileges. Containers running in the cluster can access any namespace, secret, or config map without restriction, violating least-privilege access controls.

HOW TO FIX

1. Enable Azure AD integration + Kubernetes RBAC on the cluster
2. Create namespace-scoped Roles and RoleBindings
3. Remove default cluster-admin binding for all users
4. Enable Azure Policy for AKS to enforce pod security standards

MEDIUM AZURE TLS 1.0 Enabled on App Service (Deprecated Protocol) INVESTIGATING 14 min ago ▼

RESOURCE

app-pyx-portal
Type: Microsoft.Web/sites
ID: /subscriptions/7e5a...d3f1/resourceGroups/rg-pyx-prod/providers/Microsoft.Web/sites/app-pyx-portal

LOCATION

Cloud: Azure
Region: East US 2
Subscription: PYX-Health-Production

COMPLIANCE FRAMEWORKS

PCI-DSS 4.1 NIST SC-8 HIPAA §164.312(e)(1)

TIMESTAMP

2026-04-16T14:17:14Z

WHY FLAGGED

App Service has minimum TLS version set to 1.0. TLS 1.0 has known vulnerabilities (BEAST, POODLE) and is deprecated by all major standards bodies. Patient portal traffic may be intercepted using protocol downgrade attacks.

HOW TO FIX

1. Set minimum TLS version to 1.2: App Service → TLS/SSL Settings → Minimum TLS Version → 1.2
2. Test client compatibility (all modern browsers support TLS 1.2+)
3. Update Azure Policy to enforce TLS 1.2 minimum across all App Services

MEDIUM AZURE Storage Account Allows Anonymous Public Blob Access OPEN 16 min ago ▼

RESOURCE

pyxhealthdevstore
Type: Microsoft.Storage/storageAccounts
ID: /subscriptions/7e5a...d3f1/resourceGroups/rg-pyx-dev/providers/Microsoft.Storage/storageAccounts/pyxhealthdevstore

LOCATION

Cloud: Azure
Region: East US 2
Subscription: PYX-Health-Production

COMPLIANCE FRAMEWORKS

HIPAA §164.312(a)(1) NIST AC-3

TIMESTAMP

2026-04-16T14:16:03Z

WHY FLAGGED

Storage account has "Allow Blob public access" set to Enabled. Any container set to public access level will expose blobs to the entire internet without authentication. Dev environments often contain copies of production data including PHI.

HOW TO FIX

1. Disable public blob access: Storage Account → Configuration → Allow Blob public access → Disabled
2. Audit all containers for public access level settings
3. Use SAS tokens or Azure AD for authorized access only
4. Deploy Azure Policy to prevent re-enabling

CRITICAL AWS Root Account MFA Not Enabled OPEN 3 min ago ▼

RESOURCE

IAM Root Account
Type: AWS::IAM::Root
Account: 012517218447

LOCATION

Cloud: AWS
Region: Global (IAM)
Account: 012517218447

COMPLIANCE FRAMEWORKS

HIPAA §164.312(d) NIST AC-2 NIST IA-2 CIS AWS 1.5

TIMESTAMP

2026-04-16T14:22:55Z

WHY FLAGGED

AWS root account does not have Multi-Factor Authentication (MFA) enabled. The root account has unrestricted access to all resources and billing. Compromised root credentials without MFA would give an attacker full control of the entire AWS environment.

HOW TO FIX

1. Sign in as root → IAM → Security Credentials → Assign MFA Device
2. Use hardware MFA (YubiKey) or virtual MFA (Google Authenticator)
3. Store root credentials in a physical safe, never use for daily operations
4. Enable AWS Organizations SCP to restrict root usage

CRITICAL AWS Security Group Allows SSH from 0.0.0.0/0 OPEN 5 min ago ▼

RESOURCE

sg-089f96faf07a0ceef
Type: AWS::EC2::SecurityGroup
Group Name: launch-wizard-1

LOCATION

Cloud: AWS
Region: us-east-2 (Ohio)
Account: 012517218447

COMPLIANCE FRAMEWORKS

HIPAA §164.312(e) PCI-DSS 1.3 NIST SC-7 CIS AWS 5.2

TIMESTAMP

2026-04-16T14:21:38Z

WHY FLAGGED

Security group sg-089f96faf07a0ceef has an inbound rule allowing TCP port 22 (SSH) from 0.0.0.0/0. Any internet host can attempt SSH connections to instances in this security group. Launch-wizard security groups are often left with overly permissive defaults.

HOW TO FIX

1. Restrict SSH source to corporate CIDR: aws ec2 revoke-security-group-ingress --group-id sg-089f96faf07a0ceef --protocol tcp --port 22 --cidr 0.0.0.0/0
2. Add specific IP allowlist for SSH access
3. Use AWS Systems Manager Session Manager instead of direct SSH
4. Delete unused launch-wizard security groups

CRITICAL AWS CloudTrail Logging Not Enabled in All Regions OPEN 6 min ago ▼

RESOURCE

CloudTrail
Type: AWS::CloudTrail::Trail
Account: 012517218447

LOCATION

Cloud: AWS
Region: All Regions
Account: 012517218447

COMPLIANCE FRAMEWORKS

HIPAA §164.312(b) SOC 2 CC7.2 NIST AU-2 PCI-DSS 10.1

TIMESTAMP

2026-04-16T14:21:02Z

WHY FLAGGED

No multi-region CloudTrail trail is configured. API activity, console sign-ins, and resource changes are not being recorded. Without audit logs, security incidents cannot be investigated, and compliance audit evidence cannot be produced.

HOW TO FIX

1. Create a multi-region trail: aws cloudtrail create-trail --name titan-audit-trail --s3-bucket-name titan-cloudtrail-logs --is-multi-region-trail
2. Enable log file validation: --enable-log-file-validation
3. Enable CloudWatch Logs integration for real-time alerting
4. Set S3 lifecycle policy for log retention (minimum 365 days)

HIGH AWS Security Group Allows RDP (3389) from Internet OPEN 8 min ago ▼

RESOURCE

sg-089f96faf07a0ceef
Type: AWS::EC2::SecurityGroup
Group Name: launch-wizard-1

LOCATION

Cloud: AWS
Region: us-east-2 (Ohio)
Account: 012517218447

COMPLIANCE FRAMEWORKS

NIST AC-17 PCI-DSS 1.3 CIS AWS 5.3

TIMESTAMP

2026-04-16T14:19:47Z

WHY FLAGGED

Security group allows inbound RDP (TCP/3389) from 0.0.0.0/0. Remote Desktop Protocol exposed to the internet is a primary ransomware attack vector. Brute-force and BlueKeep-style exploits target open RDP ports within minutes of exposure.

HOW TO FIX

1. Remove RDP 0.0.0.0/0 rule from sg-089f96faf07a0ceef
2. Restrict RDP to VPN/bastion host CIDR only
3. Use AWS Systems Manager Fleet Manager for remote access
4. Enable GuardDuty to detect brute-force RDP attempts

HIGH AWS IAM Password Policy Not Configured INVESTIGATING 12 min ago ▼

RESOURCE

IAM Account Settings
Type: AWS::IAM::AccountPasswordPolicy
Account: 012517218447

LOCATION

Cloud: AWS
Region: Global (IAM)
Account: 012517218447

COMPLIANCE FRAMEWORKS

NIST IA-5 HIPAA §164.312(d) CIS AWS 1.8

TIMESTAMP

2026-04-16T14:18:15Z

WHY FLAGGED

No custom IAM password policy is configured. Users can create weak passwords (no minimum length, no complexity, no rotation). Default AWS settings allow single-character passwords with no expiration, making credential compromise trivial.

HOW TO FIX

1. Set password policy: aws iam update-account-password-policy --minimum-password-length 14 --require-symbols --require-numbers --require-uppercase-characters --require-lowercase-characters --max-password-age 90 --password-reuse-prevention 24
2. Enforce MFA for all IAM users
3. Audit existing users for weak passwords

MEDIUM AWS EBS Default Encryption Not Enabled OPEN 18 min ago ▼

RESOURCE

EC2 EBS Settings
Type: AWS::EC2::EBSEncryptionByDefault
Account: 012517218447

LOCATION

Cloud: AWS
Region: us-east-2 (Ohio)
Account: 012517218447

COMPLIANCE FRAMEWORKS

HIPAA §164.312(a)(2)(iv) NIST SC-28 CIS AWS 2.2.1

TIMESTAMP

2026-04-16T14:15:22Z

WHY FLAGGED

EBS default encryption is not enabled in us-east-2. New EBS volumes will be created unencrypted unless explicitly specified. This creates risk of unencrypted data at rest when developers forget to enable encryption during instance launches.

HOW TO FIX

1. Enable EBS default encryption: aws ec2 enable-ebs-encryption-by-default --region us-east-2
2. Set default KMS key to a customer-managed key
3. Audit existing unencrypted volumes and create encrypted snapshots
4. Enable in all regions where EC2 instances may be launched

MEDIUM AWS No Customer-Managed KMS Keys Configured OPEN 20 min ago ▼

RESOURCE

KMS Key Management
Type: AWS::KMS::Key
Account: 012517218447

LOCATION

Cloud: AWS
Region: us-east-2 (Ohio)
Account: 012517218447

COMPLIANCE FRAMEWORKS

HITRUST 09.x NIST SC-12 SOC 2 CC6.1

TIMESTAMP

2026-04-16T14:14:50Z

WHY FLAGGED

No customer-managed KMS keys exist in the account. All encryption relies on AWS-managed keys, giving the organization no control over key rotation, access policies, or cross-account sharing. Required for HITRUST and SOC 2 key management controls.

HOW TO FIX

1. Create CMK: aws kms create-key --description "TITAN-prod-data-key" --key-usage ENCRYPT_DECRYPT
2. Enable automatic rotation: aws kms enable-key-rotation --key-id <key-id>
3. Apply key policy restricting access to specific IAM roles
4. Migrate EBS, S3, and RDS to use the new CMK

CRITICAL GCP Firewall Rule Allows SSH from 0.0.0.0/0 OPEN 1 min ago ▼

RESOURCE

default-allow-ssh
Type: compute.googleapis.com/Firewall
ID: projects/adroit-terminus-234522/global/firewalls/default-allow-ssh

LOCATION

Cloud: GCP
Region: us-east1 (Global rule)
Project: adroit-terminus-234522

COMPLIANCE FRAMEWORKS

HIPAA §164.312(e) NIST SC-7 PCI-DSS 1.3 CIS GCP 3.6

TIMESTAMP

2026-04-16T14:24:01Z

WHY FLAGGED

Default VPC firewall rule "default-allow-ssh" permits TCP/22 from 0.0.0.0/0 to all instances with the "default-allow-ssh" network tag. Every VM in the default network is reachable via SSH from any internet address. This is the #1 GCP misconfiguration.

HOW TO FIX

1. Delete the default rule: gcloud compute firewall-rules delete default-allow-ssh
2. Create restrictive SSH rule with source ranges limited to IAP (35.235.240.0/20)
3. Use Identity-Aware Proxy (IAP) for all SSH access
4. Enable VPC Flow Logs to monitor connections

CRITICAL GCP Firewall Rule Allows RDP from 0.0.0.0/0 OPEN 1 min ago ▼

RESOURCE

default-allow-rdp
Type: compute.googleapis.com/Firewall
ID: projects/adroit-terminus-234522/global/firewalls/default-allow-rdp

LOCATION

Cloud: GCP
Region: us-east1 (Global rule)
Project: adroit-terminus-234522

COMPLIANCE FRAMEWORKS

PCI-DSS 1.3 NIST AC-17 HIPAA §164.312(e) CIS GCP 3.7

TIMESTAMP

2026-04-16T14:24:01Z

WHY FLAGGED

Default VPC firewall rule "default-allow-rdp" permits TCP/3389 from 0.0.0.0/0 to all instances. RDP open to the internet is the #1 ransomware entry point. Windows VMs in the default network are immediately exposed upon creation.

HOW TO FIX

1. Delete the default rule: gcloud compute firewall-rules delete default-allow-rdp
2. Create restrictive RDP rule with IAP source range only (35.235.240.0/20)
3. Use IAP Desktop for Windows remote access
4. Enable Cloud Armor DDoS protection on remaining rules

HIGH GCP Service Account Has Owner Role (Over-Privileged) INVESTIGATING 10 min ago ▼

RESOURCE

infotecttitainai Service Account
Type: iam.googleapis.com/ServiceAccount
Email: infotecttitainai@adroit-terminus-234522.iam.gserviceaccount.com

LOCATION

Cloud: GCP
Region: Global (IAM)
Project: adroit-terminus-234522

COMPLIANCE FRAMEWORKS

NIST AC-6 SOC 2 CC6.3 CIS GCP 1.6

TIMESTAMP

2026-04-16T14:19:33Z

WHY FLAGGED

Service account has the roles/owner binding at project level. Owner role grants full administrative control including IAM policy modification and billing access. A compromised service account key would give an attacker complete control of the entire GCP project.

HOW TO FIX

1. Remove Owner role: gcloud projects remove-iam-policy-binding adroit-terminus-234522 --member=serviceAccount:infotecttitainai@adroit-terminus-234522.iam.gserviceaccount.com --role=roles/owner
2. Grant least-privilege roles (e.g., roles/viewer, roles/compute.admin as needed)
3. Enable service account key rotation
4. Audit with IAM Recommender for right-sizing

HIGH GCP Cloud Storage Bucket Missing CMEK Encryption OPEN 13 min ago ▼

RESOURCE

adroit-terminus-234522-storage
Type: storage.googleapis.com/Bucket
ID: projects/adroit-terminus-234522/buckets/adroit-terminus-234522-storage

LOCATION

Cloud: GCP
Region: US-EAST1
Project: adroit-terminus-234522

COMPLIANCE FRAMEWORKS

HIPAA §164.312(a)(2)(iv) NIST SC-28 HITRUST 09.x

TIMESTAMP

2026-04-16T14:17:48Z

WHY FLAGGED

Cloud Storage bucket uses Google-managed encryption keys only. No Customer-Managed Encryption Keys (CMEK) are configured. The organization has no control over key lifecycle, rotation schedule, or access to the encryption keys protecting stored data.

HOW TO FIX

1. Create a Cloud KMS keyring and key in the same region (US-EAST1)
2. Grant the GCS service agent the cloudkms.cryptoKeyEncrypterDecrypter role
3. Set bucket default encryption: gsutil kms encryption -k projects/adroit-terminus-234522/locations/us-east1/keyRings/<ring>/cryptoKeys/<key> gs://bucket-name
4. Enable automatic key rotation (90 days)

MEDIUM GCP Uniform Bucket-Level Access Not Enabled OPEN 15 min ago ▼

RESOURCE

adroit-terminus-234522-storage
Type: storage.googleapis.com/Bucket
ID: projects/adroit-terminus-234522/buckets/adroit-terminus-234522-storage

LOCATION

Cloud: GCP
Region: US-EAST1
Project: adroit-terminus-234522

COMPLIANCE FRAMEWORKS

NIST AC-3 SOC 2 CC6.1 CIS GCP 5.2

TIMESTAMP

2026-04-16T14:16:55Z

WHY FLAGGED

Bucket does not have Uniform bucket-level access enabled. ACLs (Access Control Lists) are active alongside IAM, creating a dual-permission model that is harder to audit and more prone to accidental over-permission. Individual objects may have different access settings than the bucket.

HOW TO FIX

1. Enable uniform access: gsutil uniformbucketlevelaccess set on gs://adroit-terminus-234522-storage
2. Verify IAM policies cover all required access patterns
3. Note: This is irreversible after 90 days
4. Audit with Organization Policy constraint: storage.uniformBucketLevelAccess

ALERT FEED

ALERT SUMMARY

STOP THREATS BEFORE THEY BECOME BREACHES

FRAMEWORK	FINDINGS	CRITICAL	HIGH
HIPAA	14	6	4
NIST 800-53	13	5	5
PCI-DSS	6	4	1
SOC 2	7	1	4
HITRUST	4	1	2
CIS Benchmarks	8	4	3