46 questions
1
vote
1
answer
120
views
How to retrieve all Microsoft Defender for Cloud recommendations for a specific Azure resource using PowerShell?
I am using Microsoft Defender for Cloud in Azure and I want to centrally retrieve all security recommendations for a specific Azure resource (for example, a VM, Storage Account, or App Service) ...
- 19
0
votes
0
answers
59
views
API version mismatch in Defender for Cloud workflow automation with a logic app
Using workflow automation to automatically send an email when an alert or vulnerability is detected by Defender for Cloud. During workflow creation in "logic app" step, I have considered &...
- 2,635
0
votes
0
answers
55
views
Custom detection rules device group change in Microsoft Defender
For one of our client we have onboarded 500+ custom detection rules in Microsoft Defender, as they were migrating from another EDR solution to Defender. Now client ask is, they have created a new ...
- 3
0
votes
0
answers
49
views
Scan for Malware in Azure Intune Workspace (Blob Storage)
We need to confirm if Microsoft Defender scans files uploaded to the Azure Blob Storage used by our operators. Specifically, we are uploading files through Intune to its designated workspace (which ...
- 51
0
votes
1
answer
385
views
How to Identify and Suppress "Azure Overprovisioned Identities" Recommendation in Microsoft Defender for Cloud
Recently, I received a recommendation from Microsoft Defender for Cloud regarding "Azure overprovisioned identities should have only the necessary permissions."
I want to suppress this ...
- 5,488
0
votes
0
answers
57
views
what role is required to send a request to defender for cloud api?
I have this sample payload that is supposed to send a request to defender for cloud api so that a connector can be created for an aws account. From the documentation: https://learn.microsoft.com/en-us/...
0
votes
1
answer
82
views
How can I detect azure cloud defender recommendations early?
Is there a good way to prevent defender for cloud recommendations/warnings before doing changes?
Defender for DevOps usually deals with SAST scanning on repos, but the warnings I'm interested in ...
- 1,944
0
votes
1
answer
363
views
Subscribe to EventGrid for Defender For Cloud scan results?
I've managed to create an Azure Blob Storage and set up Defender For Cloud. I can see that on uploading it updates the tags for the blob.
I have also been able to set it up to send notifications to an ...
- 715
0
votes
1
answer
410
views
How to go to next page (Pagination) of Microsoft Defender API (MSAL)?
My URL is below
https://tiation.eu2.portal.cloudappsecurity.com/api/v1/discovery/discovered_apps
This returns JSON response of defender API:
{
"data": [
{
"_id&...
- 6,047
0
votes
1
answer
1k
views
Enable Microsoft Defender For Cloud at resource level for App Services
I want to enable Defender for Cloud for a subset of resources in an Azure subscription. I already enabled it for some VMs as mentioned in this blog
I need to enable this for some of the app services ...
0
votes
1
answer
427
views
Azure Policy Not Reflecting Namespace Exclusions in Azure Kubernetes Cluster
I have an Azure Security Benchmark assigned at the Management Group level.
The Azure Security Benchmark has a policy (/providers/Microsoft.Authorization/policyDefinitions/423dd1ba-798e-40e4-9c4d-...
- 776
0
votes
1
answer
657
views
AKS: Kubernetes clusters should disable automounting API credentials
I could see the following Recommendations in Microsoft Defender for Cloud
Below is the definition of the Service Account
apiVersion: v1
kind: ServiceAccount
metadata:
name: workload-identity-sa
...
- 776
0
votes
1
answer
105
views
Security Automation for all Alerts in Azure
I am trying to deploy Create A Security Automation for all Alerts via git-hub template.
https://github.com/Azure/azure-quickstart-templates/blob/master/quickstarts/microsoft.security/securitycenter-...
- 11
0
votes
1
answer
634
views
Add all result to baseline
I have secure score finding VA1258 - Database owners are as expected.
In this case, the owners are how we need them so I need to add the results to the baseline.
How can I automate updating the ...
- 4,375
0
votes
2
answers
434
views
Defender for cloud: Enable agentless scanning and endpoint protection using powershell
can we enable agentless scanning and endpoint protection using powershell.
And can we configure AMA in defender for sql settings using powershell.
Also using powershell can we get existing agentless ...
- 44