Benchmark: 2 Microsoft Defender for Cloud
Overview
This section covers security recommendations to follow when setting various security policies on an Azure Subscription. A security policy defines the set of controls, which are recommended for resources within the specified Azure subscription. Please note that the majority of the recommendations mentioned in this section only produce an alert if a security violation is found. They do not actually enforce security settings by themselves. Alerts should be acted upon and remedied wherever possible.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-azure-compliance
Start the Powerpipe server:
steampipe service startpowerpipe server
Open http://localhost:9033 in your browser and select 2 Microsoft Defender for Cloud.
Run this benchmark in your terminal:
powerpipe benchmark run azure_compliance.benchmark.cis_v140_2
Snapshot and share results via Turbot Pipes:
powerpipe benchmark run azure_compliance.benchmark.cis_v140_2 --share
Controls
- 2.1 Ensure that Microsoft Defender for Servers is set to 'On'
- 2.2 Ensure that Microsoft Defender for App Service is set to 'On'
- 2.3 Ensure that Microsoft Defender for Azure SQL Databases is set to 'On'
- 2.4 Ensure that Microsoft Defender for SQL servers on machines is set to 'On'
- 2.5 Ensure that Microsoft Defender for Storage is set to 'On'
- 2.6 Ensure that Microsoft Defender for Kubernetes is set to 'On'
- 2.7 Ensure that Microsoft Defender for Container Registries is set to 'On'
- 2.8 Ensure that Microsoft Defender for Key Vault is set to 'On'
- 2.9 Ensure that Microsoft Defender for Endpoint (WDATP) integration with Microsoft Defender for Cloud is selected
- 2.10 Ensure that Microsoft Defender for Cloud Apps (MCAS) Integration with Microsoft Defender for Cloud is Selected
- 2.11 Ensure That Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On'
- 2.12 Ensure Any of the ASC Default Policy Setting is Not Set to 'Disabled'
- 2.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email
- 2.14 Ensure that 'Notify about alerts with the following severity' is set to 'High'
- 2.15 Ensure that 'All users with the following roles' is set to 'Owner'