https://cybertoolchain.io/tools/kics New releases and features in KICS, tracked by The Cyber Toolchain. en Thu, 17 Sep 2026 10:33:31 GMT https://github.com/Checkmarx/kics/releases/tag/v2.2.0 https://github.com/Checkmarx/kics/releases/tag/v2.2.0 Thu, 17 Sep 2026 10:33:31 GMT KICS v2.2.0 adds Synapse managed VNet queries for Terraform and ARM, and removes the `--disable-full-descriptions` flag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds new `Synapse Workspace Managed Virtual Network Not Enabled` queries for Terraform (`azurerm_synapse_workspace` resource, `managed_virtual_network_enabled` field) and Azure Resource Manager (`Microsoft.Synapse/workspaces` resource, `managedVirtualResource` field) to detect when managed virtual network isolation is disabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Removes the `--disable-full-descriptions` CLI flag along with the `pkg/descriptions` package it backed. Breaking changes: • The `--disable-full-descriptions` flag has been removed; any scan command or script that passes this flag will now fail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v2.1.20 https://github.com/Checkmarx/kics/releases/tag/v2.1.20 Tue, 03 Mar 2026 17:59:23 GMT New beta queries for Azure ACR permissions, storage encryption, AKS auditing, GKE clusters and managed identity • Implements 'Beta - Azure Container Registry With Broad Permissions' query • Implements 'Beta - Storage Account Without CMK' query • Adds TLS 1.2+ verification for Terraform/Azure • Implements 'Beta - AKS Without Audit Logs' query • Adds alpha cluster detection for Google Kubernetes Engine clusters • Implements 'Beta - Cluster Without Network Policy Support' query • Ensures GKE version management uses release channels • Checks if managed identity is not enabled (Azure) • Enables integrity monitoring checks for Shielded GKE Nodes • Adds check for disabled Kubernetes Web UI Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v2.1.19 https://github.com/Checkmarx/kics/releases/tag/v2.1.19 Wed, 07 Jan 2026 16:25:44 GMT Adds private virtual network query for Azure container instances and new Beta queries for Terraform/Azure • `feat(query): new query that ensures that container instances are using private virtual networks for terraform/azure` • `feat(query): 6 new Beta queries and fixes for "Azure Instance Using Basic Authentication" - terraform/azure` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v2.1.18 https://github.com/Checkmarx/kics/releases/tag/v2.1.18 Thu, 18 Dec 2025 17:04:11 GMT KICS v2.1.18 adds ~30 new Terraform queries for Azure/GCP compliance and optimizes engine performance with directory caching. • Optimizes the Terraform parser with directory caching and LOC-based memory calculation to improve scan performance on large IaC repositories • Adds `Beta - Activity Log Alert For Create Policy Assignment Not Configured` query for Terraform/Azure • Adds `Beta - Activity Log Alert For Delete Policy Assignment Not Configured` query for Terraform/Azure • Adds `ensure critical contacts is configured for organization` query for Terraform/GCP • Adds `Beta - Activity Log Alert For Create Or Update Network Security Group Not Configured` query for Terraform/Azure • Adds `Beta - Activity Log Alert For Delete Network Security Group Not Configured` query for Terraform/Azure • Adds `Beta - Activity Log Alert For Create or Update Security Solution Not Configured` query for Terraform/Azure • Adds `Beta - Activity Log Alert For Delete Security Solution Not Configured` query for Terraform/Azure • Adds `Beta - Activity Log Alert For Create or Update SQL Server Firewall Rule Not Configured` query for Terraform/Azure • Adds `Beta - Activity Log Alert For Delete SQL Server Firewall Rule Not Configured` query for Terraform/Azure • Adds `Beta - Activity Log Alert For Create or Update Public IP Address Rule Not Configured` query for Terraform/Azure • Adds `Beta - Activity Log Alert For Delete Public IP Address Rule Not Configured` query for Terraform/Azure • Adds `Beta - File Share Without Soft Delete` query for Terraform/Azure • Adds `Beta - Storage Account Not Using Latest SMB Protocol Version` query for Terraform/Azure • Adds `Beta - Storage Account Using Unsafe SMB Channel Encryption` query for Terraform/Azure • Adds `Beta - Blob Storage Without Soft Delete` query for Terraform/Azure • Adds `Beta - Storage Account With Shared Access Key` query for Terraform/Azure • Adds `Beta - Containers Without Soft Delete` query for Terraform/Azure • Adds `Beta - Storage Account With Cross Tenant Replication Enabled` query for Terraform/Azure • Adds `Beta - Storage Account Without Delete Lock` query for Terraform/Azure • Adds `Beta - Activity Log Alert For Service Health Not Configured` query for Terraform/Azure • Adds `Beta - Service Without Resource Logging` query for Terraform/Azure • Adds `new query "Beta - Databricks Workspace Without CMK"` for Terraform/Azure • Adds `Beta - Logs And Alerts Missing Project Ownership Assignment And Changes` query for Terraform/Azure • Adds `Beta - Logs And Alerts Missing Audit Configuration Changes` query for Terraform/Azure • Adds `Beta - Logs And Alerts Missing Custom Role Changes` query for Terraform/GCP • Adds `Beta - Resource Without Diagnostic Settings` query for Terraform/Azure • Adds `Beta - Diagnostic Settings Without Appropriate Logging` query for Terraform/Azure • Adds `Beta - Databricks Diagnostic Logging Unconfigured` query for Terraform/Azure • Adds `Beta - Cloud Asset Inventory Disabled` query for Terraform/GCP • Adds `ensure Legacy Networks Do Not Exist For Older Project` query for Terraform/GCP • Adds `Beta - Backup Vault Without Soft Delete` query for Terraform/Azure • Adds `Beta - Backup Vault Without Immutability` query for Terraform/Azure • Adds `Beta - Recovery Services Vault Without Soft Delete` query for Terraform/Azure • Adds query checking `user access administrator is not restricted` for Terraform/Azure • Adds `Beta - Recovery Services Vault Without Immutability` query for Terraform/Azure • Adds `Beta - Recovery Services Vault With Public Network Access` query for Terraform/Azure • Adds `query Beta - Key Vault Purge Protection Is Enabled` for Terraform/Azure • Adds `Beta - VM Without Managed Disk` query for Terraform/Azure • Adds `Beta - SQL Database Without Data Encryption` query for Terraform/Azure Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v2.1.17 https://github.com/Checkmarx/kics/releases/tag/v2.1.17 Tue, 02 Dec 2025 18:17:13 GMT KICS v2.1.17 adds three Beta queries for SQL logging thresholds and Databricks networking • Adds `Beta - SQL DB Instance With Unrecommended Logging Threshold` query for detecting misconfigured database logging. • Adds `Beta - SQL DB Instance With Unrecommended Error Logging Threshold` query to identify databases with inappropriate error logging levels. • Adds `Beta - Databricks Workspace Using Default Virtual Network` query covering Terraform/Azure configurations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v2.1.15 https://github.com/Checkmarx/kics/releases/tag/v2.1.15 Fri, 24 Oct 2025 15:44:53 GMT Adds risk score values to queries and results summaries in logs • Adds a `riskScore` field to all query objects for prioritization • Adds results and queries summaries to the log output Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v2.1.14 https://github.com/Checkmarx/kics/releases/tag/v2.1.14 Tue, 23 Sep 2025 14:30:59 GMT KICS v2.1.14 adds over 15 new detection queries for AWS, Azure, and Kubernetes • Adds `ElasticSearch Without Audit Logs` query detection (CloudFormation/AWS) • Adds `iam policy allows for data exfiltration` query detection (Terraform/AWS, CloudFormation/AWS) • Adds `ecr_repository_not_encrypted_with_CMK` query detection (CloudFormation/AWS) • Adds `Redshift_Cluster_Without_VPC` query detection (CloudFormation/AWS) • Adds `EKS Cluster Encryption Disabled` query detection (CloudFormation/AWS) • Adds `lambda function without dead letter queue` query detection (Terraform/AWS) • Adds `ECS Services assigned with public IP address` query detection (Ansible/AWS, Terraform/AWS, CloudFormation/AWS) • Adds `Instance Uses Metadata Service IMDSv1` query detection (Terraform/AWS, Ansible/AWS, CloudFormation/AWS) • Adds `elasticsearch domain encryption should be enabled node to node` query detection (CloudFormation/AWS) • Adds `DAX_Cluster_Not_Encrypted` query detection (CloudFormation/AWS) • Adds `aws eip not attached to any ec2 instance` query detection (Terraform/AWS) • Adds `S3_Bucket_Notifications_Disabled` query detection (Terraform/AWS) • Adds `Neptune_Logging_Is_Disabled` query detection (CloudFormation/AWS) • Adds `tags not copied to rds cluster snapshot` query detection (Terraform/AWS, CloudFormation/AWS) • Adds `Postgres_RDS_Logging_Disabled` query detection (Terraform/AWS) • Adds `ELBv2_LB_Access_Log_Disabled` query detection (Terraform/AWS) • Adds `Secretmanager Secret Without KMS` query detection (CloudFormation/AWS) • Adds `IAM DB Cluster Auth Not Enabled` query detection (Terraform/AWS, CloudFormation/AWS) • Adds support for folder-based query test cases via the new test structure Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v2.1.9 https://github.com/Checkmarx/kics/releases/tag/v2.1.9 Tue, 27 May 2025 10:36:16 GMT KICS v2.1.9 adds a blacklist to the Analyzer to exclude FHIR files. • Adds `blacklist` support in the Analyzer to exclude specific file types, such as FHIR files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v2.1.7 https://github.com/Checkmarx/kics/releases/tag/v2.1.7 Mon, 21 Apr 2025 13:08:10 GMT KICS v2.1.7 adds support for nested HCL identifier parsing in Terraform queries. • Adds support for nested HCL identifier parsing by grouping variable paths and preserving relative subpaths Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v2.1.4 https://github.com/Checkmarx/kics/releases/tag/v2.1.4 Wed, 22 Jan 2025 14:15:24 GMT Adds a new QueryID pattern to the engine. • Adds new QueryID pattern to `engine`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v2.1.3 https://github.com/Checkmarx/kics/releases/tag/v2.1.3 Tue, 01 Oct 2024 10:03:34 GMT KICS v2.1.3 adds CWE information to SARIF reports and updates query metadata for multiple platforms. • Adds `CWE` information field to SARIF report output generated by the scanner • Updates Nifcloud query metadata and functionality in the scanning engine Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v2.1.1 https://github.com/Checkmarx/kics/releases/tag/v2.1.1 Mon, 01 Jul 2024 15:26:35 GMT Adds new detection queries for TencentCloud CVM, VPC, TKE, CDB, and CLB resources. • Adds `tencentcloud` query support for CVM (Compute Virtual Machine) resources • Adds `tencentcloud` query support for VPC (Virtual Private Cloud) resources • Adds `tencentcloud` query support for TKE (Tencent Kubernetes Engine) resources • Adds `tencentcloud` query support for CDB (Cloud Database) resources • Adds `tencentcloud` query support for CLB (Cloud Load Balancer) resources Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v2.1.0 https://github.com/Checkmarx/kics/releases/tag/v2.1.0 Wed, 12 Jun 2024 14:03:54 GMT KICS v2.1.0 adds Bicep support, --max-resolver-depth flag, and improves similarity IDs • Adds `bicep` language support for infrastructure-as-code scanning • Adds `--max-resolver-depth` CLI flag to control template resolution depth • Improves similarity ID generation for better duplicate detection Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v2.0.1 https://github.com/Checkmarx/kics/releases/tag/v2.0.1 Thu, 02 May 2024 21:09:10 GMT Adds govulncheck and grype integration to the GitHub Actions cyber tool • feat(githubactions): adding govulncheck and grype Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v2.0.0 https://github.com/Checkmarx/kics/releases/tag/v2.0.0 Wed, 17 Apr 2024 22:15:43 GMT KICS v2.0.0 adds a critical severity level to scans and all report formats. • `critical` added as a new severity level in the KICS CLI engine • `critical` severity output supported in all report formats Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.7.13 https://github.com/Checkmarx/kics/releases/tag/v1.7.13 Thu, 29 Feb 2024 19:09:46 GMT KICS v1.7.13 adds parallel scanning via `--parallel` flag and CWE data in SARIF/report output. • Adds `--parallel` flag to enable parallel scanning capability • Includes CWE information in the `--output-format sarif` output and KICS CLI results • Updates CycloneDX report format support to version 1.5 • Adds new Terraform queries for NifCloud, Tencent Cloud CBS encrypted disks, CloudFormation DynamoDB/Table Point In Time Recovery/ECS Container Insights/API Gateway access logging, Pulumi ECS Container Insights, Docker Compose shared volumes/networks, Crossplane ECS Container Insights, and fixes several query definitions • Ignores Terraform cache folders during engine scanning Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.7.12 https://github.com/Checkmarx/kics/releases/tag/v1.7.12 Wed, 20 Dec 2023 13:41:55 GMT KICS v1.7.12 adds `--max-file-size` flag, NifCloud engine support, and `platform` field to SARIF output. • Adds the `--max-file-size` CLI flag to control the maximum file size scanned • Adds NifCloud engine support for scanning NifCloud infrastructure as code • Adds a `platform` field to SARIF format results output • Adds file reference resolution between files during analysis Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.7.11 https://github.com/Checkmarx/kics/releases/tag/v1.7.11 Wed, 08 Nov 2023 15:27:58 GMT KICS v1.7.11 introduces experimental queries feature flag and improves Ansible detection • Improves detection accuracy for Ansible files in the scan engine • Automatically creates a `kics-queries-repo` branch during release builds Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.7.8 https://github.com/Checkmarx/kics/releases/tag/v1.7.8 Thu, 14 Sep 2023 09:01:30 GMT KICS v1.7.8 adds GitHub Actions workflow scanning and unpins SHA references in queries • feat(engine): Added native scan support for GitHub Workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.7.6 https://github.com/Checkmarx/kics/releases/tag/v1.7.6 Mon, 21 Aug 2023 15:38:15 GMT Adds `kics analyze` CLI command and parsers for Ansible inventory/configuration. • Introduces the `kics analyze` subcommand for running scans • Adds parser support for Ansible inventory files • Adds parser support for Ansible configuration files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.7.5 https://github.com/Checkmarx/kics/releases/tag/v1.7.5 Thu, 03 Aug 2023 10:49:09 GMT KICS v1.7.5 adds GitHub workflows for PR title validation and issue labeling • Adds `github workflow to validate pr title` via `.github/workflows/validate-pr-title.yml` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.7.3 https://github.com/Checkmarx/kics/releases/tag/v1.7.3 Tue, 04 Jul 2023 17:11:22 GMT KICS v1.7.3 adds Terraform vars path support and Ignored Lines in logs • Add terraform vars path feature • feature(logs): Add Ignored Lines Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.7.2 https://github.com/Checkmarx/kics/releases/tag/v1.7.2 Thu, 22 Jun 2023 16:55:51 GMT Adds new IaC detection queries for Aurora, DynamoDB, EFS, Elasticsearch, GKE, and DMS across Terraform, CloudFormation, Pulumi, and Ansible. • Adds `Aurora With Disabled at Rest Encryption` query for Terraform • Adds `DynamoDB Table not Encrypted` query • Adds `EFS Volume With Disabled Transit Encryption` query • Adds `Elasticsearch with HTTPS disabled` queries for Ansible, CloudFormation, Pulumi, and Terraform • Adds `ec2 instance monitoring disabled` query for CloudFormation • Adds `GKE Shielded Nodes is Disabled` query for Terraform • Adds `Elasticsearch Log Disabled` query • Adds `Publicly Accessible Amazon DMS` query Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.6.14 https://github.com/Checkmarx/kics/releases/tag/v1.6.14 Tue, 11 Apr 2023 14:43:48 GMT Adds `--exclude-type` flag for query filtering; improves security_group_rules_without_description detection coverage • Adds `--exclude-type` flag to CLI commands to filter out specific query result types during scans • Enables `security_group_rules_without_description` detection on `security_group_rule` resources Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.6.13 https://github.com/Checkmarx/kics/releases/tag/v1.6.13 Tue, 28 Mar 2023 11:56:27 GMT KICS v1.6.13 adds LOC metrics to analyzer output and supports case-insensitive policy effects • Adds expected lines of code in analyzer output Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.6.12 https://github.com/Checkmarx/kics/releases/tag/v1.6.12 Tue, 14 Mar 2023 14:45:37 GMT KICS v1.6.12 adds checks for legacy GCP auth in Terraform and new Azure storage and auth queries. • Adds detection of legacy authentication in Google Cloud Platform Terraform configurations via the `tf-gcp-auth` feature. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.6.11 https://github.com/Checkmarx/kics/releases/tag/v1.6.11 Tue, 28 Feb 2023 13:53:33 GMT KICS v1.6.11 adds detection for outdated GKE versions and extracts query metadata for automation • Adds a new Terraform security query that detects outdated Google Kubernetes Engine (GKE) cluster versions • Extracts categories, frameworks, and queries as structured data to enable automated catalog generation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.6.10 https://github.com/Checkmarx/kics/releases/tag/v1.6.10 Mon, 13 Feb 2023 17:25:11 GMT KICS v1.6.10 adds a resolver for serverless file references • Adds a resolver for serverless file references to support more complex IaC patterns Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.6.9 https://github.com/Checkmarx/kics/releases/tag/v1.6.9 Tue, 31 Jan 2023 11:08:28 GMT Adds AWS SSO security queries and SendGrid API key secrets detection • Adds AWS SSO security queries support to the query engine • Adds password and secrets detection for SendGrid API keys Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.6.8 https://github.com/Checkmarx/kics/releases/tag/v1.6.8 Tue, 17 Jan 2023 13:32:10 GMT Adds ingress IPv6 security group checks for Terraform AWS queries • feat(terraform/aws): ingress ipv6 security group Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.6.7 https://github.com/Checkmarx/kics/releases/tag/v1.6.7 Tue, 03 Jan 2023 17:25:53 GMT KICS v1.6.7 adds default value checks for ARM parameters and RDS backup_retention_period • Adds checks for ARM parameters with default values to detect misconfigurations where defaults might bypass security policies • Adds a check for the `backup_retention_period` default value in AWS RDS instances Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.6.6 https://github.com/Checkmarx/kics/releases/tag/v1.6.6 Wed, 07 Dec 2022 20:30:53 GMT Adds Bill of Materials support for multiple GCP resources including Dataflow, Redis, Filestore, Storage Bucket, Pub/Sub, and general GCP infra in Terraform. • Adds Bill of Materials (BOM) data extraction for GCP Dataflow jobs defined in Terraform configurations • Adds BOM support for GCP Redis instances in Terraform • Adds BOM coverage for GCP Filestore instances in Terraform • Adds BOM coverage for GCP Storage Buckets • Adds BOM support for GCP Pub/Sub topics in both Terraform and Google Deployment Manager (GDM) • Extends general Bill of Materials capability to broader GCP infrastructure resources Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.6.4 https://github.com/Checkmarx/kics/releases/tag/v1.6.4 Wed, 09 Nov 2022 12:27:41 GMT KICS v1.6.4 adds CVE detection for vulnerable OpenSSL in Dockerfiles, plus Cassandra and Kinesis BOM support for CloudFormation and Terraform. • Adds a new query that detects "Vulnerable OpenSSL Version" in Dockerfile assets • Extends the Bill of Materials (BOM) feature to include Apache Cassandra for CloudFormation templates • Adds Amazon Kinesis support to the BOM generator for both CloudFormation and Terraform resources Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.6.2 https://github.com/Checkmarx/kics/releases/tag/v1.6.2 Wed, 12 Oct 2022 14:24:06 GMT KICS v1.6.2 adds Bill of Materials (BOM) generation for AWS RDS (CloudFormation/Terraform) and DynamoDB. • Adds `bom` support for AWS RDS resources in CloudFormation templates • Adds `bom` support for AWS RDS resources in Terraform configurations • Adds `bom` support for AWS DynamoDB resources Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.6.1 https://github.com/Checkmarx/kics/releases/tag/v1.6.1 Wed, 28 Sep 2022 14:40:55 GMT Adds `--ci` flag to gitlab examples and a workflow to check latest software versions • Adds `--ci` flag to GitLab CI example configurations • Adds a new GitHub Actions workflow to check for the latest software versions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.5.15 https://github.com/Checkmarx/kics/releases/tag/v1.5.15 Wed, 31 Aug 2022 14:36:58 GMT KICS v1.5.15 adds AWS IAM privilege escalation detection and an Azure App Service Python version query for Terraform. • Adds `aws iam privilege escalation` queries to detect identity and access management misuse in AWS environments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.5.13 https://github.com/Checkmarx/kics/releases/tag/v1.5.13 Wed, 03 Aug 2022 15:05:24 GMT KICS v1.5.13 adds 4 new CloudFormation queries to detect additional infrastructure misconfigurations. • `added 4 queries for CloudFormation` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.5.12 https://github.com/Checkmarx/kics/releases/tag/v1.5.12 Fri, 15 Jul 2022 15:24:48 GMT New KICS queries for Kubernetes RBAC attach permissions and Lambda invocation policies • Adds a new query to detect Kubernetes RBAC attach permissions in scanned infrastructure-as-code files. • Adds a new query to check IAM policies that allow invoking Lambda functions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.5.10 https://github.com/Checkmarx/kics/releases/tag/v1.5.10 Wed, 08 Jun 2022 15:08:47 GMT KICS v1.5.10 adds filesystem double-star exclusion support and includes resourceType/name in CloudFormation/Terraform results • Adds `**` double-star support to exclude folders in the filesystem feature • Adds `resourceType` and `resourceName` fields to CloudFormation queries results • Adds `resourceType` and `resourceName` fields to Terraform queries results Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.5.9 https://github.com/Checkmarx/kics/releases/tag/v1.5.9 Wed, 25 May 2022 17:16:32 GMT KICS v1.5.9 adds resourceType and resourceName fields to query results and an OpenAPI file resolver. • `resourceType` and `resourceName` fields are now included in Kubernetes query results. • `resourceType` and `resourceName` fields are now included in Azure Resource Management query results. • `resourceType` and `resourceName` fields are now included in Google Deployment Management query results. • `resourceType` and `resourceName` fields are now included in Ansible query results. • OpenAPI file resolver for JSON and YAML parsers is added (feat(resolver)). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.5.8 https://github.com/Checkmarx/kics/releases/tag/v1.5.8 Wed, 11 May 2022 17:21:11 GMT KICS v1.5.8 adds four new Kubernetes RBAC detection queries for port-forwarding, impersonation, privilege escalation, and exec permissions. • Adds a query to detect port-forwarding into containers via RBAC • Adds a query to detect account impersonation via RBAC • Adds a query to detect bind or escalate permissions via RBAC • Adds a query to detect exec permissions via RBAC Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.5.7 https://github.com/Checkmarx/kics/releases/tag/v1.5.7 Mon, 02 May 2022 14:07:36 GMT KICS v1.5.7 adds Code Climate report format and 19 new queries • `--report-format codeclimate` now generates reports in Code Climate format • Adds 19 new detection queries for Terraform and Kubernetes Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.5.6 https://github.com/Checkmarx/kics/releases/tag/v1.5.6 Mon, 18 Apr 2022 16:41:26 GMT KICS v1.5.6 adds BoM support for CloudFormation and a new query metadata validation script • Adds feat(bom) to generate Bills of Materials for CloudFormation stacks • Adds feat(scripts) with a new query metadata validation script (PR #5167) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.5.5 https://github.com/Checkmarx/kics/releases/tag/v1.5.5 Wed, 30 Mar 2022 16:36:42 GMT KICS v1.5.5 adds Docker Compose analysis, Kubelet Configuration support, and CSV report output. • `feat(analyzer): added Docker Compose initial support` enables scanning of Docker Compose files • `feat(logs): added lines scanned and lines parsed` exposes metrics on scan volume in logs • `feat(report): added CSV report` allows exporting findings to CSV format • `feat(analyzer & parser): added Kubeblet Configuration support` adds analysis for Kubernetes kubelet configuration files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.5.4 https://github.com/Checkmarx/kics/releases/tag/v1.5.4 Wed, 16 Mar 2022 17:09:24 GMT KICS v1.5.4 adds Alicloud Terraform support and on-the-fly Ansible Vault decryption • Adds `alicloud` provider support for Terraform scanning • Adds on-the-fly decryption of Ansible Vault files via the analyzer and parser Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.5.2 https://github.com/Checkmarx/kics/releases/tag/v1.5.2 Wed, 16 Feb 2022 17:44:42 GMT KICS v1.5.2 adds Azure/GCP Terraformer, Bamboo/CodeBuild integrations, and multiple query paths CLI support • Adds `terraformer` integration with Azure • Adds `terraformer` integration with GCP • Adds Bamboo integration for documentation/scanning workflows • Adds AWS CodeBuild integration for documentation/scanning workflows • Enables scanning from multiple paths via the CLI • Improves IAM Policy evaluation and adds basic terraform resource relationship querying Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.5.1 https://github.com/Checkmarx/kics/releases/tag/v1.5.1 Wed, 02 Feb 2022 15:51:18 GMT Adds Cloud Development Kit for Terraform (CDKTF) and Buildah support to KICS queries • feat(analyzer): Adds support to Cloud Development Kit for Terraform (CDKTF) • feat(buildah): Adds initial Buildah support Breaking changes: • Binaries are being deprecated in GitHub releases assets; KICS 1.5.2 will stop publishing binaries, requiring migration to Docker Images. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.4.9 https://github.com/Checkmarx/kics/releases/tag/v1.4.9 Mon, 20 Dec 2021 16:46:15 GMT KICS v1.4.9 adds CycloneDX and JUnit report formats, plus GDM and gRPC query support • Adds `--report-types` value `cyclonedx` to generate CycloneDX SBOM reports in JSON format • Adds `--report-types` value `junit` to output scan results as JUnit XML • Adds Google Deployment Manager query support via the new `gdm` language key • Adds gRPC query support via the new `grpc` language key Breaking changes: • Reports now use `1` instead of `-1` to indicate a failure to find the line containing the vulnerability Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.4.8 https://github.com/Checkmarx/kics/releases/tag/v1.4.8 Wed, 24 Nov 2021 11:59:08 GMT Adds SonarQube report output, expected values in PDF reports, and a pre-commit hook. • Adds SonarQube format support for scan results to integrate with SonarQube dashboards • Adds the expected value field to PDF export reports for better compliance context • Adds a `kics-scan` pre-commit hook to block commits containing infrastructure-as-code vulnerabilities Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics https://github.com/Checkmarx/kics/releases/tag/v1.4.7 https://github.com/Checkmarx/kics/releases/tag/v1.4.7 Wed, 10 Nov 2021 15:56:44 GMT KICS v1.4.7 adds 11 Terraform queries, `include-query`/`exclude-query` flags for secrets scanning, and parser line-ignore support. • Added 11 new Terraform queries to expand detection coverage. • Added MegaLinter to the list of supported integrations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kics