Custom KICS query with external data

[gabrielvachon]

I'm working on a query that compares configurations between the input and the data stored in a data.json file. Everything works fine as i'm editing the REGO query in VSCode. The problem comes when I execute the query with KICS, the output doesn't show up.

The directory looks like this :

rego_tests
| -- test
       | -- negative1.json
       | -- positive_expected_result.json
       | -- positive1.json
| -- data.json
| -- input.json
| -- metadata.json
| -- query.json

query.rego

package Cx

import data.securityRules

CxPolicy[result] {

    secRules := input.document[i].resources[j].properties.securityRules
    q = {secRules[k].name: {res | data.securityRules[k].properties[l] != secRules[k].properties[l]; res = secRules[k].properties[l]}}
    r = {secRules[k].name: {res | data.securityRules[k].properties[l] != secRules[k].properties[l]; res = data.securityRules[k].properties[l]}}

    result := {
        "documentId": input.document[i].id,
        "searchKey": "",
        "issueType": "Configurations not corresponding",
        "keyExpectedValue": r,
        "keyActualValue": q
    }
}

The output doesn't show

{
	"kics_version": "development",
	"files_scanned": 79,
	"lines_scanned": 71365,
	"files_parsed": 79,
	"lines_parsed": 71365,
	"files_failed_to_scan": 0,
	"queries_total": 1,
	"queries_failed_to_execute": 0,
	"queries_failed_to_compute_similarity_id": 0,
	"scan_id": "console",
	"severity_counters": {
		"HIGH": 0,
		"INFO": 79,
		"LOW": 0,
		"MEDIUM": 0,
		"TRACE": 0
	},
	"total_counter": 79,
	"total_bom_resources": 0,
	"start": "2023-07-05T15:45:20.9128077-04:00",
	"end": "2023-07-05T15:45:47.3749821-04:00",
	"paths": [
		"..[\\automation_test\\templates\\](file://automation_test/templates/)",
		"..[\\..\\rego_tests\\](file://../rego_tests/)"
	],
	"queries": [
		{
			"query_name": "Configuration check",
			"query_id": "69b6a051-d5da-4908-8e66-ffd21e55d799",
			"query_url": "N/A",
			"severity": "INFO",
			"platform": "AzureResourceManager",
			"category": "Observability",
			"description": "Configuration check",
			"description_id": "69b6a051",
			"files": [
				{
					"file_name": "..[\\automation_test\\templates\\something.json](file://automation_test/templates/something.json)",
					"similarity_id": "48e709f404d9dd64719aaf98baa6ee16cb5a45654c1d6d3b8572210f68ae3158",
					"line": 1,
					"issue_type": "Configurations not corresponding",
					"search_key": "",
					"search_line": 0,
					"search_value": "",
					"expected_value": "",
					"actual_value": ""
				},
                                ...

This is the output.json when I'm developing my query in REGO :

[
  [
    {
      "CxPolicy": [
        {
          "documentId": "e1de3e26-71c1-4d0d-8b26-032f8cba80ee",
          "issueType": "Configurations not corresponding",
          "keyActualValue": {
            "AllowInternet-Outbound": []
          },
          "keyExpectedValue": {
            "AllowInternet-Outbound": []
          },
          "searchKey": ""
        },
        {
          "documentId": "e1de3e26-71c1-4d0d-8b26-032f8cba80ee",
          "issueType": "Configurations not corresponding",
          "keyActualValue": {
            "BlockInternet-Inbound": []
          },
          "keyExpectedValue": {
            "BlockInternet-Inbound": []
          },
          "searchKey": ""
        },
        {
          "documentId": "e1de3e26-71c1-4d0d-8b26-032f8cba80ee",
          "issueType": "Configurations not corresponding",
          "keyActualValue": {
            "Directory": [
              "10.9.XXX.XXX/27"
            ]
          },
          "keyExpectedValue": {
            "Directory": [
              "10.9.YYY.YYY/27"
            ]
          },
          "searchKey": ""
        },
        {
          "documentId": "e1de3e26-71c1-4d0d-8b26-032f8cba80ee",
          "issueType": "Configurations not corresponding",
          "keyActualValue": {
            "LPMProtocol": [
              "10.9.XXX.XXX/27"
            ]
          },
          "keyExpectedValue": {
            "LPMProtocol": [
              "10.9.YYY.YYY/27"
            ]
          },
          "searchKey": ""
        },
        {
          "documentId": "e1de3e26-71c1-4d0d-8b26-032f8cba80ee",
          "issueType": "Configurations not corresponding",
          "keyActualValue": {
            "LPRManager": [
              "10.9.XXX.XXX/27"
            ]
          },
          "keyExpectedValue": {
            "LPRManager": [
              "10.9.YYY.YYY/27"
            ]
          },
          "searchKey": ""
        },

The keyActualValue and the keyExpectedValue fields are not showing when executing the query with KICS.

Why isn't it working in KICS but works while editing the query? Could it be the data file wrongly used in that case?

Thanks