Control: 2.1.7 Ensure That Microsoft Defender for Storage Is Set To 'On'
Description
Turning on Microsoft Defender for Storage enables threat detection for Storage, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.
Enabling Microsoft Defender for Storage allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).
Remediation
From Azure Portal
- Go to
Microsoft Defender for Cloud. - Select
Environment Settingsblade. - Click on the subscription name.
- Select the
Defender plansblade. - Set
StatustoOnforStorage. - Select
Save.
From Azure CLI
Ensure the output of the below command is Standard
az security pricing create -n StorageAccounts --tier 'standard'
From Powershell
Set-AzSecurityPricing -Name 'StorageAccounts' -PricingTier 'Standard'
Default Value
By default, Microsoft Defender plan is off.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v210_2_1_7Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v210_2_1_7 --shareSQL
This control uses a named query:
securitycenter_azure_defender_on_for_storage