Add 2 more examples (microsoft#36)

bryan-lipinski · Jun 19, 2023 · c43f0ee · c43f0ee
1 parent 4073da3
commit c43f0ee
Show file tree

Hide file tree

Showing 2 changed files with 143 additions and 0 deletions.
diff --git a/...vable Storage Access Control Samples/macOS/policy/examples/audit_all_removable_media.json b/...vable Storage Access Control Samples/macOS/policy/examples/audit_all_removable_media.json
@@ -0,0 +1,71 @@
+{
+    "groups": [
+        {
+            "$type": "device",
+            "id": "94b5df10-bd2f-4b19-8a9f-539520b9d6ff",
+            "name": "All Removable Media Devices",
+            "query": {
+                "$type": "all",
+                "clauses": [
+                    {
+                        "$type": "primaryId",
+                        "value": "removable_media_devices"
+                    }
+                ]
+            }
+        }
+    ],
+    "rules": [
+        {
+            "id": "2e18a6b9-eb30-440a-a6aa-1f930b443baf",
+            "name": "Audit RWX to all Removable Media Devices",
+            "includeGroups": [
+                "94b5df10-bd2f-4b19-8a9f-539520b9d6ff"
+            ],
+            "entries": [
+                {
+                    "__comments": "Allow all Read, Write, and Execute operations.  Note: This entry is optional as global/defaultEnforcement is 'allow'.",
+                    "$type": "removableMedia",
+                    "id": "2566d326-d8e9-49be-9b8e-2fd0853e6641",
+                    "enforcement": {
+                        "$type": "allow"
+                    },
+                    "access": [
+                        "read",
+                        "write",
+                        "execute"
+                    ]
+                },
+                {
+                    "__comments": "Send events for all allowed operations.  Note: This may result in a significant volume of events.  Adjust or remove this entry as desired.",
+                    "$type": "removableMedia",
+                    "id": "ea3ccfe9-ec04-4fa2-a6bb-06941c7b051a",
+                    "enforcement": {
+                        "$type": "auditAllow",
+                        "options": [
+                            "send_event"
+                        ]
+                    },
+                    "access": [
+                        "read",
+                        "write",
+                        "execute"
+                    ]
+                }
+            ]
+        }
+    ],
+    "settings": {
+        "features": {
+            "removableMedia": {
+                "disable": false
+            }
+        },
+        "global": {
+            "defaultEnforcement": "allow"
+        },
+        "ux": {
+            "navigationTarget": "http://www.microsoft.com"
+        }
+    }
+}
diff --git a/Removable Storage Access Control Samples/macOS/policy/examples/deny_all_removable_media.json b/Removable Storage Access Control Samples/macOS/policy/examples/deny_all_removable_media.json
@@ -0,0 +1,72 @@
+{
+    "groups": [
+        {
+            "$type": "device",
+            "id": "519a2e50-3bb7-49b7-9ae0-6feb415d58ca",
+            "name": "All Removable Media Devices",
+            "query": {
+                "$type": "all",
+                "clauses": [
+                    {
+                        "$type": "primaryId",
+                        "value": "removable_media_devices"
+                    }
+                ]
+            }
+        }
+    ],
+    "rules": [
+        {
+            "id": "69a4a010-acb1-4573-8a58-50cf4ee7bc7f",
+            "name": "Deny RWX to all Removable Media Devices",
+            "includeGroups": [
+                "519a2e50-3bb7-49b7-9ae0-6feb415d58ca"
+            ],
+            "entries": [
+                {
+                    "__comments": "Deny Read, Write, and Execute.",
+                    "$type": "removableMedia",
+                    "id": "c7a13940-5c14-49f6-b0fb-b0978bf0f8cc",
+                    "enforcement": {
+                        "$type": "deny"
+                    },
+                    "access": [
+                        "read",
+                        "write",
+                        "execute"
+                    ]
+                },
+                {
+                    "__comments": "Show UX and send events for all blocked operations.",
+                    "$type": "removableMedia",
+                    "id": "ae5672a9-0746-41e7-8c21-63222f1aa304",
+                    "enforcement": {
+                        "$type": "auditDeny",
+                        "options": [
+                            "send_event",
+                            "show_notification"
+                        ]
+                    },
+                    "access": [
+                        "read",
+                        "write",
+                        "execute"
+                    ]
+                }
+            ]
+        }
+    ],
+    "settings": {
+        "features": {
+            "removableMedia": {
+                "disable": false
+            }
+        },
+        "global": {
+            "defaultEnforcement": "allow"
+        },
+        "ux": {
+            "navigationTarget": "http://www.microsoft.com"
+        }
+    }
+}