Determine whether to check or enforce Auto Provisioning settings for the Azure Security Center.&#92;n

Azure > Security Center > Security Center

Azure > Security Center > Security Center > Auto Provisioning

Record and synchronize details for the Azure Security Center into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;nNote that if CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

Azure > Security Center > Security Center > CMDB

Configure Defender Plan settings on `Azure &gt; Security Center &gt; Security Center`.&#92;n

Azure > Security Center > Security Center > Defender Plan

Azure > Security Center > Security Center > Defender Plan > Resource Type

Discover Azure Security Center and add them to Guardrails.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n

Azure > Subscription

Azure > Security Center > Security Center > Discovery

Security Center

securityCenter

securityCenterAka

securityCenterService

securityCenterServiceAka

securityCenterServiceNow

azure-securitycenter

A calculated policy that Guardrails uses to create a compiled list of ALL&#92;npermissions for Azure Security Center that is used as input to the control that manages&#92;nthe IAM stack.&#92;n

Azure > Turbot > Permissions > Compiled > Service Permissions

Azure > Turbot > Permissions > Compiled > Service Permissions > @turbot/azure-securitycenter

A calculated policy that Guardrails uses to create a compiled list of ALL&#92;npermission levels for Azure Security Center that is used as input to the&#92;nstack that manages the Guardrails IAM permissions objects.&#92;n

Azure > Turbot > Permissions > Compiled > Levels

Azure > Turbot > Permissions > Compiled > Levels > @turbot/azure-securitycenter

azure_securitycenter_auto_provisioning

Azure CIS v2.0.0 - Section 2 - Microsoft Defender

Configure whether to record and synchronize details for Azure&#92;nSecurity Center security center(s) into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;nNote that if CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

azure_securitycenter_defender_plan

The resource types for which the Security Center&#39;s Defender Plan is to be configured.&#92;n

azure_securitycenter_defender_plan_resource_type

Azure > Security Center

Azure > Security Center > Enabled

Azure > Security Center > Permissions > Levels

Configure whether permissions policies are in effect for Azure Security Center&#92;nThis setting does not affect Subscription level permissions (Azure/Admin, Azure/Owner, etc)&#92;n

Azure > Security Center > Permissions

Azure > Security Center > Permissions > Levels > Modifiers

Define the permissions levels that can be used to grant access to Storage an&#92;nAzure Subscription.  Permissions levels defined will appear in the UI to assign&#92;naccess to Guardrails users.&#92;n

A map of Azure API to Guardrails Permission Level used to customize Guardrails&#39;&#92;nstandard permissions. You can add, remove or redefine the mapping of&#92;nAzure API operations to Guardrails permissions levels here.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;Microsoft.Security Center/Security Center/delete&quot;: operator&#92;n  - &quot;Microsoft.Security Center/Security Center/write&quot;: admin&#92;n  - &quot;Microsoft.Security Center/Security Center/read&quot;: readonly&#92;n```&#92;n

Azure > Security Center > Security Center > ServiceNow

Azure > CIS v1 > 2 Security Center > 2.01 Ensure that standard pricing tier is selected (Scored)

Azure > CIS v1 > 2 Security Center > 2.02 Ensure that &quot;Automatic provisioning of monitoring agent&quot; is set to &quot;On&quot; (Scored)

Azure > CIS v1 > 2 Security Center > 2.03 Ensure ASC Default policy setting &quot;Monitor System Updates&quot; is not &quot;Disabled&quot; (Scored)

Azure > CIS v1 > 2 Security Center > 2.04 Ensure ASC Default policy setting &quot;Monitor OS Vulnerabilities&quot; is not &quot;Disabled&quot; (Scored)

Azure > CIS v1 > 2 Security Center > 2.05 Ensure ASC Default policy setting &quot;Monitor Endpoint Protection&quot; is not &quot;Disabled&quot; (Scored)

Azure > CIS v1 > 2 Security Center > 2.06 Ensure ASC Default policy setting &quot;Monitor Disk Encryption&quot; is not &quot;Disabled&quot; (Scored)

Azure > CIS v1 > 2 Security Center > 2.07 Ensure ASC Default policy setting &quot;Monitor Network Security Groups&quot; is not &quot;Disabled&quot; (Scored)

Azure > CIS v1 > 2 Security Center > 2.08 Ensure ASC Default policy setting &quot;Monitor Web Application Firewall&quot; is not &quot;Disabled&quot; (Scored)

Azure > CIS v1 > 2 Security Center > 2.09 Ensure ASC Default policy setting &quot;Enable Next Generation Firewall(NGFW) Monitoring&quot; is not &quot;Disabled&quot; (Scored)

Azure > CIS v1 > 2 Security Center > 2.10 Ensure ASC Default policy setting &quot;Monitor Vulnerability Assessment&quot; is not &quot;Disabled&quot; (Scored)

Azure > CIS v1 > 2 Security Center > 2.11 Ensure ASC Default policy setting &quot;Monitor Storage Blob Encryption&quot; is not &quot;Disabled&quot; (Scored)

Azure > CIS v1 > 2 Security Center > 2.12 Ensure ASC Default policy setting &quot;Monitor JIT Network Access&quot; is not &quot;Disabled&quot; (Scored)

Azure > CIS v1 > 2 Security Center > 2.13 Ensure ASC Default policy setting &quot;Monitor Adaptive Application Whitelisting&quot; is not &quot;Disabled&quot; (Scored)

Azure > CIS v1 > 2 Security Center > 2.14 Ensure ASC Default policy setting &quot;Monitor SQL Auditing&quot; is not &quot;Disabled&quot; (Scored)

Azure > CIS v1 > 2 Security Center > 2.15 Ensure ASC Default policy setting &quot;Monitor SQL Encryption&quot; is not &quot;Disabled&quot; (Scored)

Azure > CIS v1 > 2 Security Center > 2.16 Ensure that &#39;Security contact emails&#39; is set (Scored)

Azure > CIS v1 > 2 Security Center > 2.17 Ensure that security contact &#39;Phone number&#39; is set (Scored)

Azure > CIS v1 > 2 Security Center > 2.18 Ensure that &#39;Send email notification for high severity alerts&#39; is set to &#39;On&#39; (Scored)

Azure > CIS v1 > 2 Security Center > 2.19 Ensure that &#39;Send email also to subscription owners&#39; is set to &#39;On&#39; (Scored)

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.01 - Ensure That Microsoft Defender for Servers Is Set to &#39;On&#39;

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.02 - Ensure That Microsoft Defender for App Services Is Set To &#39;On&#39;

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.03 -  Ensure That Microsoft Defender for Databases Is Set To &#39;On&#39;

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.04 - Ensure That Microsoft Defender for Azure SQL Databases Is Set To &#39;On&#39;

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.05 - Ensure That Microsoft Defender for SQL Servers on Machines Is Set To &#39;On&#39;

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.06 - Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To &#39;On&#39;

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.07 - Ensure That Microsoft Defender for Storage Is Set To &#39;On&#39;

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.08 - Ensure That Microsoft Defender for Containers Is Set To &#39;On&#39;

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.09 - Ensure That Microsoft Defender for Azure Cosmos DB Is Set To &#39;On&#39;

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.10 - Ensure That Microsoft Defender for Key Vault Is Set To &#39;On&#39;

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.11 - Ensure That Microsoft Defender for DNS Is Set To &#39;On&#39;

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.12 - Ensure That Microsoft Defender for Resource Manager Is Set To &#39;On&#39;

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.13 - Ensure that Microsoft Defender Recommendation for &#39;Apply system updates&#39; status is &#39;Completed&#39;

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.14 - Ensure Any of the ASC Default Policy Settings are Not Set to &#39;Disabled&#39;

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.15 - Ensure that Auto provisioning of &#39;Log Analytics agent for Azure VMs&#39; is Set to &#39;On&#39;

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.16 - Ensure that Auto provisioning of &#39;Vulnerability assessment for machines&#39; is Set to &#39;On&#39;

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.17 - Ensure that Auto provisioning of &#39;Microsoft Defender for Containers components&#39; is Set to &#39;On&#39;

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.18 - Ensure That &#39;All users with the following roles&#39; is set to &#39;Owner&#39;

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.19 - Ensure &#39;Additional email addresses&#39; is Configured with a Security Contact Email

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.20 - Ensure That &#39;Notify about alerts with the following severity&#39; is Set to &#39;High&#39;

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.21 - Ensure that Microsoft Defender for Cloud Apps integration with Microsoft Defender for Cloud is Selected

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.22 - Ensure that Microsoft Defender for Endpoint integration with Microsoft Defender for Cloud is selected

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.02 - Microsoft Defender for IoT > 2.02.01 - Ensure That Microsoft Defender for IoT Hub Is Set To &#39;On&#39;

Azure > Security Center > Security Center > ServiceNow > Configuration Item

Azure > CIS v1 > 2 Security Center > 2.02 Ensure that &#39;Automatic provisioning of monitoring agent&#39; is set to &#39;On&#39; (Scored)

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.13 - Ensure that Microsoft Defender Recommendation for &#39;Apply system updates&#39; status is &#39;Completed&#39; > Attestation

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.16 - Ensure that Auto provisioning of &#39;Vulnerability assessment for machines&#39; is Set to &#39;On&#39; > Attestation

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.01 - Microsoft Defender for Cloud > 2.01.17 - Ensure that Auto provisioning of &#39;Microsoft Defender for Containers components&#39; is Set to &#39;On&#39; > Attestation

Azure > CIS v2.0 > 02 - Microsoft Defender > 2.02 - Microsoft Defender for IoT > 2.02.01 - Ensure That Microsoft Defender for IoT Hub Is Set To &#39;On&#39; > Attestation

Azure > Security Center > Security Center > ServiceNow > Configuration Item > Record

Mod: azure-securitycenter

Recommended Version

Resource Types

Controls

IAM Roles

Policies

Policy Packs