Skip to content

Commit 60ee17e

Browse files
BernieWhiteBernieWhite
authored
Fixed properties used by Azure.DefenderCloud.Contact Azure#3117 (Azure#3161)
1 parent 3907935 commit 60ee17e

10 files changed

+676
-581
lines changed

‎docs/CHANGELOG-v1.md

+6
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,12 @@ See [upgrade notes][1] for helpful information when upgrading from previous vers
2929

3030
## Unreleased
3131

32+
- Updated rules:
33+
- Microsoft Defender for Cloud:
34+
- Updated `Azure.DefenderCloud.Contact` to use `emails` property and removed `phone` by @BernieWhite.
35+
[#3117](https://github.com/Azure/PSRule.Rules.Azure/issues/3117)
36+
- Renamed rule to `Azure.Defender.SecurityContact` to better align with naming for defender rules.
37+
- Bumped rule set to `2024_12`.
3238
- Bug fixes:
3339
- Fixed evaluation of `Azure.NSG.LateralTraversal` with empty string properties by @BernieWhite.
3440
[#3130](https://github.com/Azure/PSRule.Rules.Azure/issues/3130)

‎docs/en/rules/Azure.Defender.SecurityContact.md

+109
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
---
2+
severity: Important
3+
pillar: Security
4+
category: SE:12 Incident response
5+
resource: Microsoft Defender for Cloud
6+
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Defender.SecurityContact/
7+
ms-content-id: 18fcf75f-a5e6-4a34-baba-74bd49502cd7
8+
---
9+
10+
# Defender for Cloud notification contact not set
11+
12+
## SYNOPSIS
13+
14+
Important security notifications may be lost or not processed in a timely manner when a clear security contact is not identified.
15+
16+
## DESCRIPTION
17+
18+
Microsoft Defender for Cloud allows one or more email addresses to be specified for receiving security alerts.
19+
This is in addition to subscription owners or other configured role.
20+
21+
Directing security notifications to the correct party enables triage and response to security incidents in a timely manner.
22+
23+
## RECOMMENDATION
24+
25+
Consider configuring a security notification email address to assist timely notification and incident response.
26+
27+
## EXAMPLES
28+
29+
### Configure with Azure template
30+
31+
To deploy subscriptions that pass this rule:
32+
33+
- Set the `properties.emails` property to an email address for security incident response.
34+
35+
For example:
36+
37+
```json
38+
{
39+
"type": "Microsoft.Security/securityContacts",
40+
"apiVersion": "2023-12-01-preview",
41+
"name": "default",
42+
"properties": {
43+
"isEnabled": true,
44+
"notificationsByRole": {
45+
"roles": [
46+
"Owner"
47+
],
48+
"state": "On"
49+
},
50+
"emails": "[email protected]",
51+
"notificationsSources": [
52+
{
53+
"sourceType": "Alert",
54+
"minimalSeverity": "High"
55+
},
56+
{
57+
"sourceType": "AttackPath",
58+
"minimalRiskLevel": "High"
59+
}
60+
]
61+
}
62+
}
63+
```
64+
65+
### Configure with Bicep
66+
67+
To deploy subscriptions that pass this rule:
68+
69+
- Set the `properties.emails` property to an email address for security incident response.
70+
71+
For example:
72+
73+
```bicep
74+
resource securityContact 'Microsoft.Security/securityContacts@2023-12-01-preview' = {
75+
name: 'default'
76+
properties: {
77+
isEnabled: true
78+
notificationsByRole: {
79+
roles: [
80+
'Owner'
81+
]
82+
state: 'On'
83+
}
84+
emails: '[email protected]'
85+
notificationsSources: [
86+
{
87+
sourceType: 'Alert'
88+
minimalSeverity: 'High'
89+
}
90+
{
91+
sourceType: 'AttackPath'
92+
minimalRiskLevel: 'High'
93+
}
94+
]
95+
}
96+
}
97+
```
98+
99+
### Configure with Azure CLI
100+
101+
```bash
102+
az security contact update -n 'default' --emails '[email protected]'
103+
```
104+
105+
## LINK
106+
107+
- [SE:12 Incident response](https://learn.microsoft.com/azure/well-architected/security/incident-response)
108+
- [Quickstart: Configure email notifications for security alerts](https://learn.microsoft.com/azure/defender-for-cloud/configure-email-notifications)
109+
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.security/securitycontacts)

‎docs/en/rules/Azure.DefenderCloud.Contact.md

-32
This file was deleted.

‎docs/examples/resources/defender.bicep

+12-5
Original file line numberDiff line numberDiff line change
@@ -6,20 +6,27 @@ targetScope = 'subscription'
66
// Bicep documentation examples
77

88
// Configures security contacts to be notified for Microsoft Defender alerts
9-
resource securityContact 'Microsoft.Security/securityContacts@2020-01-01-preview' = {
9+
resource securityContact 'Microsoft.Security/securityContacts@2023-12-01-preview' = {
1010
name: 'default'
1111
properties: {
12+
isEnabled: true
1213
notificationsByRole: {
1314
roles: [
1415
'Owner'
1516
]
1617
state: 'On'
1718
}
1819
emails: '[email protected]'
19-
alertNotifications: {
20-
minimalSeverity: 'High'
21-
state: 'On'
22-
}
20+
notificationsSources: [
21+
{
22+
sourceType: 'Alert'
23+
minimalSeverity: 'High'
24+
}
25+
{
26+
sourceType: 'AttackPath'
27+
minimalRiskLevel: 'High'
28+
}
29+
]
2330
}
2431
}
2532

‎docs/examples/resources/defender.json

+13-6
Original file line numberDiff line numberDiff line change
@@ -5,26 +5,33 @@
55
"_generator": {
66
"name": "bicep",
77
"version": "0.30.23.60470",
8-
"templateHash": "2395927344385178299"
8+
"templateHash": "7941752543000454149"
99
}
1010
},
1111
"resources": [
1212
{
1313
"type": "Microsoft.Security/securityContacts",
14-
"apiVersion": "2020-01-01-preview",
14+
"apiVersion": "2023-12-01-preview",
1515
"name": "default",
1616
"properties": {
17+
"isEnabled": true,
1718
"notificationsByRole": {
1819
"roles": [
1920
"Owner"
2021
],
2122
"state": "On"
2223
},
2324
"emails": "[email protected]",
24-
"alertNotifications": {
25-
"minimalSeverity": "High",
26-
"state": "On"
27-
}
25+
"notificationsSources": [
26+
{
27+
"sourceType": "Alert",
28+
"minimalSeverity": "High"
29+
},
30+
{
31+
"sourceType": "AttackPath",
32+
"minimalRiskLevel": "High"
33+
}
34+
]
2835
}
2936
},
3037
{

‎src/PSRule.Rules.Azure/en/PSRule-rules.psd1

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
AccessPolicyLeastPrivilege = "One or more access policies grant all or purge permission."
2727
DiagnosticSettingsNotConfigured = "Diagnostic settings are not configured."
2828
DiagnosticSettingsLoggingNotConfigured = "Diagnostic settings is not configured to log events for '{0}'."
29-
SecurityCenterNotConfigured = "Security Center is not configured."
29+
SecurityContactsNotConfigured = "Security contacts are not configured."
3030
LateralTraversalNotRestricted = "A rule to limit lateral traversal was not found."
3131
AllInboundRestricted = "The first inbound rule denies traffic from all sources."
3232
APIMProductSubscription = "The product '{0}' does not require a subscription to use."

‎src/PSRule.Rules.Azure/rules/Azure.Defender.Rule.ps1

+11-6
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,18 @@
88
#region Rules
99

1010
# Synopsis: Microsoft Defender for Cloud email and phone contact details should be set
11-
Rule 'Azure.DefenderCloud.Contact' -Alias 'Azure.SecurityCenter.Contact' -Ref 'AZR-000209' -Type 'Microsoft.Subscription' -Tag @{ release = 'GA'; ruleSet = '2020_06'; 'Azure.WAF/pillar' = 'Security'; } {
12-
Reason $LocalizedData.SecurityCenterNotConfigured;
13-
$contacts = @(GetSubResources -ResourceType 'Microsoft.Security/securityContacts');
14-
$Null -ne $contacts -and $contacts.Length -gt 0;
11+
Rule 'Azure.Defender.SecurityContact' -Alias 'Azure.DefenderCloud.Contact', 'Azure.SecurityCenter.Contact' -Ref 'AZR-000209' -Type 'Microsoft.Subscription', 'Microsoft.Security/securityContacts' -Tag @{ release = 'GA'; ruleSet = '2024_12'; 'Azure.WAF/pillar' = 'Security'; } {
12+
$contacts = @($TargetObject);
13+
if ($PSRule.TargetType -eq 'Microsoft.Subscription') {
14+
$contacts = @(GetSubResources -ResourceType 'Microsoft.Security/securityContacts');
15+
}
16+
17+
if ($contacts.Length -eq 0) {
18+
return $Assert.Fail($LocalizedData.SecurityContactsNotConfigured);
19+
}
20+
1521
foreach ($c in $contacts) {
16-
$Assert.HasFieldValue($c, 'Properties.Email')
17-
$Assert.HasFieldValue($c, 'Properties.Phone');
22+
$Assert.HasFieldValue($c, 'properties.emails')
1823
}
1924
}
2025

0 commit comments

Comments
 (0)