Azure Microsoft Defender for Cloud security alert email notification is not set misconfiguration det

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_21
Category - Subcategory	Monitoring - Alerting And Notifications
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

The alert notifications setting within an Azure Security Center contact configuration specifies whether email notifications for high severity alerts are sent to the security contact. Enabling this setting ensures that the designated contacts are promptly informed of high severity security alerts, allowing for a quicker response to potential security incidents.

How to Fix

Resource: Microsoft.Security/securityContacts

• Property: properties.alertNotifications [source,go]

---

{ "type": "Microsoft.Security/securityContacts", "apiVersion": "2020-01-01", "name": "default", "properties": { "email": "[e-mail]",

• "alertNotifications": "On", "phone": "[phone]", "alertsToAdmins": "Off" // Or "On", depending on organizational requirements } }

---