Control: Azure Defender for Key Vault should be enabled
Description
Azure Defender for Key Vault provides an additional layer of protection and security intelligence by detecting unusual and potentially harmful attempts to access or exploit key vault accounts.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.securitycenter_azure_defender_on_for_keyvaultSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.securitycenter_azure_defender_on_for_keyvault --shareSQL
This control uses a named query:
select sub_pricing.id as resource, case when pricing_tier = 'Standard' then 'ok' else 'alarm' end as status, case when pricing_tier = 'Standard' then 'Azure Defender on for Key Vaults.' else 'Azure Defender off for Key Vaults.' end as reason , sub.display_name as subscriptionfrom azure_security_center_subscription_pricing sub_pricing right join azure_subscription sub on sub_pricing.subscription_id = sub.subscription_idwhere name = 'KeyVaults';