Microsoft AzureOverview
Microsoft Defender for Cloud emails the subscription owners whenever a high-severity alert is triggered for their subscription. You should provide a security contact email address as an additional email address.
Rationale
Microsoft Defender for Cloud emails the Subscription Owner to notify them about security alerts. Adding your Security Contact's email address to the 'Additional email addresses' field ensures that your organization's Security Team is included in these alerts. This ensures that the appropriate professionals are aware of any potential compromise in order to mitigate the risk in a timely manner.
Default Value
By default, there are no additional email addresses entered.
References
- https://learn.microsoft.com/en-us/azure/security-center/security-center-provide-security-contact-details
- https://learn.microsoft.com/en-us/rest/api/securitycenter/securitycontacts/list
- https://learn.microsoft.com/en-us/rest/api/securitycenter/security-contacts
- https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-incident-response#ir-2-preparation--setup-incident-notification
Remediation guidance
From Azure Console
- Open Microsoft Defender for Cloud | Environment settings
- Select the appropriate
Management Group,Subscription, orWorkspace - Select
Email notifications - Under
Email recipients, in theAdditional email addressesfield, enter a valid security contact email address (or multiple, separated by comma) - Select
Save
Using Azure Command Line Interface
Use the below command to set Security contact emails to On.
az account get-access-token --query "{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json"
https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/securityContacts/default1?api-version=2017-08-01-preview -d@"input.json"'
Where input.json contains the Request body json data as mentioned below. Replace <validEmailAddress> with one email address or multiple comma-separated email addresses.
{
"id": "/subscriptions/<subscriptionID>/providers/Microsoft.Security/securityContacts/default",
"name": "default",
"type": "Microsoft.Security/securityContacts",
"properties": {
"email": "<validEmailAddress>",
"alertNotifications": "On",
"alertsToAdmins": "On"
}
}
Additional Information
- Excluding any of the entries in the input.json properties block disables the specific setting by default.
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Azure
Use management group or subscription Azure Policy assignments, remediation tasks where supported, landing-zone standards, and IaC modules so drift is prevented at scale.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Azure connectors without security contact additional email addresses
Connectors
Covered asset types
Expected check: eq []
{
connectors(
where: {
OR: [
{ securityContacts_SOME: null }
{ securityContacts_SOME: { email: null } }
{ securityContacts_SOME: { email: "" } }
]
}
) {
...AssetFragment
}
}
