Azure Microsoft Defender for Cloud set to Off for Resource Manager misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_234
Category - Subcategory	Monitoring - Alerting And Notifications
Provider	AZURE
Severity	MEDIUM
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	12d694e1-955b-4cb7-a1d2-44f13d50bf3c

Impact

This rule checks to ensure that Azure Defender for the cloud is enabled for the Resource Manager. Azure Defender is a key security feature that provides threat protection for workloads across Azure, on-premises, and other cloud environments. The Resource Manager, being a central management component, must have Azure Defender enabled to prevent the risk of unauthorized access and potential harm to resources. Failure to do so increases the risk of potential threats and cyber attacks.

How to Fix

Resource: azurerm_security_center_subscription_pricing

• Arguments: resource_type, tier

This code enables Azure Defender for Cloud, which is a cloud native security service, for the Resource Manager. Once enabled, Azure Defender extends Azure Security Center's capabilities to include workloads hosted within Azure Resource Manager. [source,go]

resource "azurerm_security_center_subscription_pricing" "example" { tier = "Standard" resource_type = "Arm" ... }