feat(scanner): add enterprise security operations rules

[TFT444]

Summary

Implements issue #262 as a policy-driven Azure security-operations rule pack covering subscription logging, critical-resource diagnostics, retention, Defender for Cloud operational coverage, and Microsoft Sentinel detection and response readiness.

What changed

• Added AZ-SECOPS-001 through AZ-SECOPS-010 with explicit fail-closed collection behavior.
• Added read-only collectors for Azure Monitor, Defender for Cloud, Log Analytics, and Microsoft Sentinel.
• Added organisation-owned policy configuration with no automatic production defaults.
• Added one CLI remediation playbook per rule.
• Added CIS Azure, NIST CSF, ISO 27001, and SOC 2 mappings without inventing unsupported CIS control IDs.
• Added documentation covering scope, permissions, outcomes, limitations, and evidence behavior.
• Added regression coverage ensuring incomplete Sentinel evidence returns UNKNOWN rather than a false FAIL.

Validation

• Security-operations tests: 84 passed.
• Ruff: passed.
• Ruff formatting check: 261 files formatted.
• Full local suite: 639 passed, 3 skipped, 1 unrelated local failure caused by a pre-existing Chroma package mismatch in the shared virtual environment.
• Preliminary live, read-only Azure validation completed against an Azure student subscription:
  • Defender plans: 18 collected.
  • Defender assessments: 17 collected.
  • Log Analytics workspaces: 1 collected.
  • Sentinel onboarding: 1 workspace confirmed.
  • Sentinel analytics rules: 1 collected.
  • Sentinel data connectors and automation rules: successfully queried.
  • All ten rules executed with zero execution errors and zero Azure write operations.

Validation limits

The student subscription contained no in-scope Key Vault, SQL, or Storage resources, so controls 003-005 still require representative enterprise-resource validation. Control 007 also requires a high-severity unhealthy Defender assessment with usable age evidence to validate the complete SLA path. This preliminary test is integration evidence, not final enterprise acceptance certification.

Closes #262

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/azure-mgmt-loganalytics	14.0.0	Unknown	Unknown
pip/azure-mgmt-security	7.0.0	🟢 6.9	Details Check Score Reason Code-Review 🟢 9 Found 21/22 approved changesets -- score normalized to 9 Maintained 🟢 10 30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 CII-Best-Practices 🟢 5 badge detected: Passing Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Binary-Artifacts 🟢 8 binaries present in source code Pinned-Dependencies 🟢 4 dependency not pinned by hash detected -- score normalized to 4 Fuzzing 🟢 10 project is fuzzed
pip/azure-mgmt-securityinsight	1.0.0	🟢 6.9	Details Check Score Reason Code-Review 🟢 9 Found 21/22 approved changesets -- score normalized to 9 Maintained 🟢 10 30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 CII-Best-Practices 🟢 5 badge detected: Passing Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Binary-Artifacts 🟢 8 binaries present in source code Pinned-Dependencies 🟢 4 dependency not pinned by hash detected -- score normalized to 4 Fuzzing 🟢 10 project is fuzzed

Scanned Files

• requirements.txt

[TFT444]

10 security operations rules in one PR, including Sentinel, three Azure SDK integrations, Defender for Cloud and live read-only Azure testing.

real environment test passed

[m-khan-97]

Large PR, reviewed thoroughly — fetched the branch, installed the missing azure-mgmt-monitor dependency, and ran all 84 tests (pass). This is genuinely strong engineering, worth calling out specifically:

• Fail-safe policy loading is correctly threaded end-to-end. load_policy_from_env never raises — unset env var, missing file, or failed strict validation all collapse to None, and every rule treats None as UNKNOWN (empty list, no finding) rather than silently claiming compliance. Traced this through AZ-SECOPS-001 to confirm the contract actually holds in a real rule, not just in the docstring.
• CollectionResult's PARTIAL status is a genuinely useful addition for the Sentinel per-workspace collectors — distinguishing "workspace confirmed not onboarded" from "workspace onboarding state unknown" is exactly the right nuance for a security tool, and failed_scopes is threaded through so callers can't accidentally conflate the two.
• Compliance JSON completeness is correct this time — verified all 10 AZ-SECOPS rules present in all 4 framework JSONs with matching keys, learning from the gap in the earlier resilience-rules round.
• load_security_operations_policy's strict validation (exact field-set match, positive-integer checks, non-empty-string list validation) means a malformed policy file fails loudly at load time rather than silently producing wrong results downstream.
• Good honesty in the module docstring about the engine's real limitation (no side-channel for PASS/UNKNOWN/NOT_APPLICABLE) rather than hacking around it — and reusing the existing az_dl_00x/az_kv_003 convention instead of inventing a fourth pattern.

One minor, non-blocking gap: OPENSHIELD_SECURITY_OPERATIONS_POLICY is documented in docs/security-operations-rules.md but not mentioned in .env.example. Since all 10 rules are silently inert (always UNKNOWN) until this is set, someone skimming .env.example for what to configure could miss that this whole rule pack needs activating. Worth a one-line addition in a follow-up.

Approving.