Policy Packs

guardrails-samples

This section contains recommendations to consider for tenant-wide security policies and plans related to Microsoft Defender.

Azure CIS v2.0.0 - Section 2 - Microsoft Defender

main

azure_securitycenter_auto_provisioning

Determine whether to check or enforce Auto Provisioning settings for the Azure Security Center.&#92;n&#92;n**Note:** Log Analytics Auto Provisioning is deprecated and can no longer be enabled or disabled.&#92;nSee [here](https://learn.microsoft.com/en-us/azure/defender-for-cloud/prepare-deprecation-log-analytics-mma-agent#log-analytics-agent-autoprovisioning-experience---deprecation-plan) for more information.&#92;nThis control has also been deprecated in v5.5.1 and will be removed in the next major version.&#92;n

securityCenterAutoProvisioning

Azure > Security Center > Security Center > Auto Provisioning [Deprecated]

azure_securitycenter_defender_plan

Configure Defender Plan settings on `Azure &gt; Security Center &gt; Security Center`.&#92;n

securityCenterDefenderPlan

Azure > Security Center > Security Center > Defender Plan

azure_securitycenter_defender_plan_resource_type

The resource types for which the Security Center&#39;s Defender Plan is to be configured.&#92;n

securityCenterDefenderPlanResourceType

Azure > Security Center > Security Center > Defender Plan > Resource Type

turbot_policy_setting.azure_securitycenter_auto_provisioning

turbot_policy_setting.azure_securitycenter_defender_plan

turbot_policy_setting.azure_securitycenter_defender_plan_resource_type

Policy	Setting	Note
Azure > Security Center > Security Center > Auto Provisioning [Deprecated]	Check: Enabled	Azure CIS v2.0.0 - Control: 2.1.15
Azure > Security Center > Security Center > Defender Plan	Check: Defender Plan Enabled	Azure CIS v2.0.0 - Controls: 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 2.1.10, 2.1.11 and 2.1.12
Azure > Security Center > Security Center > Defender Plan > Resource Type	- "Servers" - "App Service" - "Azure SQL Databases" - "Cloud Posture" - "Container registries" - "Containers" - "Cosmos DB" - "DNS" - "Key Vault" - "Kubernetes" - "Open-source relational databases" - "Resource Manager" - "SQL servers on machines" - "Storage"	Azure CIS v2.0.0 - Controls: 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 2.1.10, 2.1.11 and 2.1.12

Policy Settings