Cis Azure Foundations 8.1.12

8.1.12 Ensure the Microsoft Defender for Cloud 'Security alert emails' is configured (Automated)

Description

Ensure that Microsoft Defender for Cloud is configured to send security alert email notifications to a designated security contact, enabling prompt response to security incidents.

Rationale

Configuring security alert email notifications ensures that the appropriate personnel are informed when security alerts are generated by Microsoft Defender for Cloud. Without email notifications, critical security alerts may go unnoticed, delaying incident response and potentially allowing threats to persist or escalate. Designating a security contact ensures accountability and timely action on security events.

Impact

Configuring email notifications has minimal impact. The designated recipients will receive email alerts for security events, which may result in a high volume of emails depending on the environment size and activity. Organizations should ensure the designated recipients can manage the alert volume effectively.

Audit Procedure

From Azure Portal:

1. Go to Microsoft Defender for Cloud.
2. Under Management, click Environment settings.
3. Click the name of a subscription.
4. Select the Email notifications blade.
5. Verify that a valid email address is configured in the Email recipients field.
6. Ensure Notify about alerts with the following severity (or higher) is enabled.

From Azure CLI:

az account get-access-token --query "{subscription:subscription,token:accessToken}" -o tsv

Then query the security contacts API:

az rest --method get --url "https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/securityContacts?api-version=2020-01-01-preview"

Verify that emails field contains valid email addresses.

From PowerShell:

Get-AzSecurityContact | Select-Object Name, Email, AlertNotifications

Ensure Email contains a valid address and AlertNotifications is On.

Expected Result

A valid security contact email address should be configured and alert notifications should be enabled.

Remediation

From Azure Portal:

1. Go to Microsoft Defender for Cloud.
2. Under Management, click Environment settings.
3. Click the name of a subscription.
4. Select the Email notifications blade.
5. In the Email recipients field, enter a valid email address for the security contact.
6. Set Notify about alerts with the following severity (or higher) to the desired level.
7. Click Save.

From Azure CLI:

az rest --method put --url "https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/securityContacts/default?api-version=2020-01-01-preview" --body '{"properties":{"emails":"security@example.com","alertNotifications":{"state":"On","minimalSeverity":"High"}}}'

From PowerShell:

Set-AzSecurityContact -Name "default" -Email "security@example.com" -AlertAdmin -NotifyOnAlert

Default Value

By default, no security contact email is configured for alert notifications.

References

1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-email-notifications
2. https://learn.microsoft.com/en-us/azure/defender-for-cloud/security-policy-concept
3. https://learn.microsoft.com/en-us/rest/api/defenderforcloud/security-contacts
4. https://learn.microsoft.com/en-us/powershell/module/az.security/set-azsecuritycontact

Profile

• Level 1