Benchmark: 2.3 Microsoft Defender for External Attack Surface Monitoring

Overview

As more services are exposed to the public internet it is important to be able to monitor the externally exposed surface of your Azure Tenant, to this end it is recommended that tools that monitor this surface are implemented.

Microsoft have a new tool to do this in their Defender Suite of products. Defender EASM, this tool is configured very simply to scan specified domains and report on them, specific domains and addresses can be excluded from the scan.

Typically these tools will report on any vulnerability that is identified (CVE) and will also identify ports and protocols that are open on devices.

Results are classified Critical/High/Medium & Low with proposed mitigations.

Usage

Install the mod:

mkdir dashboards
cd dashboards
powerpipe mod init
powerpipe mod install github.com/turbot/steampipe-mod-azure-compliance

Start the Powerpipe server:

steampipe service start
powerpipe server

Open http://localhost:9033 in your browser and select 2.3 Microsoft Defender for External Attack Surface Monitoring.

Run this benchmark in your terminal:

powerpipe benchmark run azure_compliance.benchmark.cis_v200_2_3

Snapshot and share results via Turbot Pipes:

powerpipe benchmark run azure_compliance.benchmark.cis_v200_2_3 --share

Benchmark: 2.3 Microsoft Defender for External Attack Surface Monitoring

Overview

Usage

Tags