Azure Defender for Cloud Automatic Provisioning Disabled

ID: azure-defender-auto-provisioning-disabled

Severity: medium

Author: princechaddha

Tags: cloud,devops,azure,microsoft,defender-for-cloud,azure-cloud-config

Description

Ensure that the automatic provisioning extensions are enabled within the Microsoft Defender for Cloud settings to collect security data and events from your Azure virtual machines (VMs) and containers. By enabling Auto provisioning, you can ensure that the agents needed for processes such as vulnerability assessments, log analytics, and container monitoring are automatically installed on your infrastructure.

YAML Source

id: azure-defender-auto-provisioning-disabled
info:
  name: Azure Defender for Cloud Automatic Provisioning Disabled
  author: princechaddha
  severity: medium
  description: |
    Ensure that the automatic provisioning extensions are enabled within the Microsoft Defender for Cloud settings to collect security data and events from your Azure virtual machines (VMs) and containers. By enabling Auto provisioning, you can ensure that the agents needed for processes such as vulnerability assessments, log analytics, and container monitoring are automatically installed on your infrastructure.
  impact: |
    Disabling or not configuring automatic provisioning may lead to lack of critical security data collection, hindering effective security monitoring and incident response.
  remediation: |
    Enable the automatic provisioning feature within Microsoft Defender for Cloud to ensure that all necessary security agents are automatically deployed across your Azure resources.
  reference:
    - https://docs.microsoft.com/en-us/azure/security-center/security-center-auto-provisioning
  tags: cloud,devops,azure,microsoft,defender-for-cloud,azure-cloud-config

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      az security auto-provisioning-setting list

    matchers:
      - type: word
        words:
          - '"autoProvision": "Off"'

    extractors:
      - type: dsl
        dsl:
          - '"Automatic Provisioning for Microsoft Defender are not enabled"'
# digest: 4b0a00483046022100d03ce238fcbfd5d6e26cfaa77938fd9a3c1288824f07807cfd301e4645097793022100b15d697f6a5205dbbbabd1df68392c4c9d6c18c3464e166fe63b6b9a8062ce61:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "cloud/azure/securitycenter/azure-defender-auto-provisioning-disabled.yaml"

View on Github