Control: 2.1.13 Ensure That Microsoft Defender for Resource Manager Is Set To 'On'
Description
Microsoft Defender for Resource Manager scans incoming administrative requests to change your infrastructure from both CLI and the Azure portal.
Scanning resource requests lets you be alerted every time there is suspicious activity in order to prevent a security threat from being introduced.
Remediation
From Azure Portal
- Go to
Microsoft Defender for Cloud - Select
Environment Settingsblade - Click on the subscription name
- Select the
Defender plansblade - On the line in the table for
Resource ManagerSelectOnunderPlan. - Select
Save
From Azure CLI
Use the below command to enable Standard pricing tier for Defender for Resource Manager
az security pricing create -n 'Arm' --tier 'Standard'
From Powershell
Use the below command to enable Standard pricing tier for Defender for Resource Manager
Set-AzSecurityPricing -Name 'Arm' -PricingTier 'Standard'
Default Value
By default, Microsoft Defender for Resource Manager is not enabled.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v150_2_1_13Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v150_2_1_13 --shareSQL
This control uses a named query:
securitycenter_azure_defender_on_for_resource_manager