Benchmark: 8.1 Microsoft Defender for Cloud
Microsoft Defender for Cloud
This subsection provides guidance on the use of Microsoft Defender for Cloud and associated product plans. This guidance is intended to ensure that—at a minimum—the protective measures offered by these plans are being considered. Organizations may find that they have existing products or services that provide the same utility as some Microsoft Defender for Cloud products. Security and Administrative personnel need to make the determination on their organization's behalf regarding which—if any—of these recommendations are relevant to their organization's needs. In consideration of the above, and because of the potential for increased cost and complexity, please be aware that all Microsoft Defender for Cloud and associated plan recommendations are profiled as "Level 2" recommendations.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-azure-complianceStart the Powerpipe server:
steampipe service startpowerpipe serverOpen http://localhost:9033 in your browser and select 8.1 Microsoft Defender for Cloud.
Run this benchmark in your terminal:
powerpipe benchmark run azure_compliance.benchmark.cis_v500_8_1Snapshot and share results via Turbot Pipes:
powerpipe benchmark run azure_compliance.benchmark.cis_v500_8_1 --shareBenchmarks
- 8.1.1 Microsoft Cloud Security Posture Management (CSPM)
- 8.1.2 Defender Plan: APIs
- 8.1.3 Defender Plan: Servers
- 8.1.4 Defender Plan: Containers
- 8.1.5 Defender Plan: Storage
- 8.1.6 Defender Plan: App Service
- 8.1.7 Defender Plan: Databases
- 8.1.8 Defender Plan: Key Vault
- 8.1.9 Defender Plan: Resource Manager
Controls
- 8.1.10 Ensure that Microsoft Defender for Cloud is configured to check VM operating systems for updates
- 8.1.11 Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled'
- 8.1.12 Ensure That 'All users with the following roles' is set to 'Owner'
- 8.1.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email
- 8.1.14 Ensure that 'Notify about alerts with the following severity (or higher)' is enabled
- 8.1.15 Ensure that 'Notify about attack paths with the following risk level (or higher)' is enabled
- 8.1.16 Ensure that Microsoft Defender External Attack Surface Monitoring (EASM) is enabled