id: azure-defender-auto-provisioning-disabled
info:
  name: Azure Defender for Cloud Automatic Provisioning Disabled
  author: princechaddha
  severity: medium
  description: |
    Ensure that the automatic provisioning extensions are enabled within the Microsoft Defender for Cloud settings to collect security data and events from your Azure virtual machines (VMs) and containers. By enabling Auto provisioning, you can ensure that the agents needed for processes such as vulnerability assessments, log analytics, and container monitoring are automatically installed on your infrastructure.
  impact: |
    Disabling or not configuring automatic provisioning may lead to lack of critical security data collection, hindering effective security monitoring and incident response.
  remediation: |
    Enable the automatic provisioning feature within Microsoft Defender for Cloud to ensure that all necessary security agents are automatically deployed across your Azure resources.
  reference:
    - https://docs.microsoft.com/en-us/azure/security-center/security-center-auto-provisioning
  tags: cloud,devops,azure,microsoft,defender-for-cloud,azure-cloud-config

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      az security auto-provisioning-setting list

    matchers:
      - type: word
        words:
          - '"autoProvision": "Off"'

    extractors:
      - type: dsl
        dsl:
          - '"Automatic Provisioning for Microsoft Defender are not enabled"'

# digest: 4a0a00473045022100fa6b62788b5554c19d1605cdacd4da9af464cfc0c965622b77c2f28099505dbb022032849caf7a82ac90c552d190b56aa23694d0b5c89a8c7cb31fcd36189afaf278:922c64590222798bb761d5b6d8e72950