Control: 2.13 Ensure 'Additional email addresses' is configured with a security contact email
Description
Security Center emails the subscription owners whenever a high-severity alert is triggered for their subscription. You should provide a security contact email address as an additional email address.
Azure Security Center emails the Subscription Owner to notify them about security alerts. Adding your Security Contact's email address to the 'Additional email addresses' field ensures that your organization's Security Team is included in these alerts. This ensures that the proper people are aware of any potential compromise in order to mitigate the risk in a timely fashion.
Remediation
From Console
- Login to Azure console and navigate to Security Center.
- Select
Pricing & settingsblade under Management. - Click on the appropriate Management Group, Subscription, or Tenant.
- Click on
Email notifications. - Enter a valid security contact email address (or multiple addresses separated by commas) in the
Additional email addressesfield. - Click Save.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v130_2_13Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v130_2_13 --shareSQL
This control uses a named query:
with contact_info as ( select jsonb_agg(email) filter (where name = 'default' and email != '') as default_email, count(*) filter (where name != 'default') as non_default_count, count(*) filter (where name = 'default') as default_count, subscription_id from azure_security_center_contact group by subscription_id limit 1)select sub.subscription_id as resource, case when non_default_count > 0 then 'ok' when default_count = 1 and jsonb_array_length(default_email) != 0 then 'ok' else 'alarm' end as status, case when non_default_count > 0 then 'Additional email addresses configured.' when default_count = 1 and default_email is not null then'Additional email addresses configured.' else 'Additional email addresses not configured.' end as reason , sub.display_name as subscriptionfrom azure_subscription sub left join contact_info ci on sub.subscription_id = ci.subscription_id;