Benchmark: 2 Security Center
Overview
This section covers security recommendations to follow when setting various security policies on an Azure Subscription. A security policy defines the set of controls, which are recommended for resources within the specified Azure subscription. Please note that the majority of the recommendations mentioned in this section only produce an alert if a security violation is found. They do not actually enforce security settings by themselves. Alerts should be acted upon and remedied wherever possible.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-azure-compliance
Start the Powerpipe server:
steampipe service startpowerpipe server
Open http://localhost:9033 in your browser and select 2 Security Center.
Run this benchmark in your terminal:
powerpipe benchmark run azure_compliance.benchmark.cis_v130_2
Snapshot and share results via Turbot Pipes:
powerpipe benchmark run azure_compliance.benchmark.cis_v130_2 --share
Controls
- 2.1 Ensure that Azure Defender is set to On for Servers
- 2.2 Ensure that Azure Defender is set to On for App Service
- 2.3 Ensure that Azure Defender is set to On for Azure SQL database servers
- 2.4 Ensure that Azure Defender is set to On for SQL servers on machines
- 2.5 Ensure that Azure Defender is set to On for Storage
- 2.6 Ensure that Azure Defender is set to On for Kubernetes
- 2.7 Ensure that Azure Defender is set to On for Container Registries
- 2.8 Ensure that Azure Defender is set to On for Key Vault
- 2.9 Ensure that Windows Defender ATP (WDATP) integration with Security Center is selected
- 2.10 Ensure that Microsoft Cloud App Security (MCAS) integration with Security Center is selected
- 2.11 Ensure that 'Automatic provisioning of monitoring agent' is set to 'On'
- 2.12 Ensure any of the ASC Default policy setting is not set to "Disabled"
- 2.13 Ensure 'Additional email addresses' is configured with a security contact email
- 2.14 Ensure that 'Notify about alerts with the following severity' is set to 'High'
- 2.15 Ensure that 'All users with the following roles' is set to 'Owner'