fix(scanner): improve AZ-NET-008 with SOC2 mapping and azure_client abstraction

scanner/azure_client.py

@@ -270,6 +270,14 @@ def get_vnet_peerings(self, resource_group: str, vnet_name: str) -> List[Any]:
         except Exception as exc:
             logger.error("get_vnet_peerings(%s) failed: %s", vnet_name, exc)
             return []
+    def get_load_balancers(self) -> List[Any]:
+        """List all load balancers in the subscription."""
+        try:
+            client = NetworkManagementClient(self.credential, self.subscription_id)
+            return list(client.load_balancers.list_all())
+        except Exception as exc:
+            logger.error("get_load_balancers failed: %s", exc)
+            return []
 
     def get_dns_zones(self) -> List[Any]:
         """List all DNS zones in the subscription."""

scanner/rules/az_net_008.py

@@ -7,7 +7,7 @@
 RULE_NAME = "Load balancer with no backend pool configured"
 SEVERITY = "LOW"
 CATEGORY = "Network"
-FRAMEWORKS = {"CIS": "9.1", "NIST": "CM-7", "ISO27001": "A.13.1.1"}
+FRAMEWORKS = {"CIS": "9.1", "NIST": "CM-7", "ISO27001": "A.13.1.1", "SOC2": "CC8.1"}
 DESCRIPTION = (
     "A load balancer exists in the subscription but has no backend pool "
     "configured. A load balancer with no backend pool is either misconfigured "
@@ -28,19 +28,11 @@ def scan(azure_client: Any, subscription_id: str) -> List[Dict[str, Any]]:
     """Detect load balancers with no backend pool configured."""
     findings: List[Dict[str, Any]] = []
 
-    try:
-        from azure.mgmt.network import NetworkManagementClient
-        client = NetworkManagementClient(
-            azure_client.credential, azure_client.subscription_id
-        )
-        load_balancers = list(client.load_balancers.list_all())
-    except Exception as exc:
-        logger.error("Failed to list load balancers: %s", exc)
-        return findings
-
-    for lb in load_balancers:
+    for lb in azure_client.get_load_balancers():
         backend_pools = getattr(lb, "backend_address_pools", []) or []
         if len(backend_pools) == 0:
+            parsed = azure_client.parse_resource_id(getattr(lb, "id", ""))
+            resource_group = parsed.get("resource_group", "")
             findings.append({
                 "rule_id": RULE_ID,
                 "rule_name": RULE_NAME,
@@ -56,7 +48,8 @@ def scan(azure_client: Any, subscription_id: str) -> List[Dict[str, Any]]:
                 "metadata": {
                     "location": getattr(lb, "location", ""),
                     "backend_pool_count": len(backend_pools),
+                    "resource_group": resource_group,
                 },
             })
 
-    return findings
+    return findings