33 lines
1.7 KiB
YAML
33 lines
1.7 KiB
YAML
id: azure-defender-auto-provisioning-disabled
|
|
info:
|
|
name: Azure Defender for Cloud Automatic Provisioning Disabled
|
|
author: princechaddha
|
|
severity: medium
|
|
description: |
|
|
Ensure that the automatic provisioning extensions are enabled within the Microsoft Defender for Cloud settings to collect security data and events from your Azure virtual machines (VMs) and containers. By enabling Auto provisioning, you can ensure that the agents needed for processes such as vulnerability assessments, log analytics, and container monitoring are automatically installed on your infrastructure.
|
|
impact: |
|
|
Disabling or not configuring automatic provisioning may lead to lack of critical security data collection, hindering effective security monitoring and incident response.
|
|
remediation: |
|
|
Enable the automatic provisioning feature within Microsoft Defender for Cloud to ensure that all necessary security agents are automatically deployed across your Azure resources.
|
|
reference:
|
|
- https://docs.microsoft.com/en-us/azure/security-center/security-center-auto-provisioning
|
|
tags: cloud,devops,azure,microsoft,defender-for-cloud,azure-cloud-config
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az security auto-provisioning-setting list
|
|
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- '"autoProvision": "Off"'
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- '"Automatic Provisioning for Microsoft Defender are not enabled"'
|
|
# digest: 490a004630440220633ff2772530d972992aac944a5951a6af42e6cba220f8a3e1084c293c0ccf5b022071da58e79b5527f2111e4c41d7e8444167312bbd8394a3f52bdf3f4b82fb5166:922c64590222798bb761d5b6d8e72950 |