📝 Microsoft Defender External Attack Surface Monitoring (EASM) is not enabled 🟢
- Contextual name: 📝 External Attack Surface Monitoring (EASM) is not enabled 🟢
- ID:
/ce/ca/azure/microsoft-defender/external-attack-surface-monitoring - Located in: 📁 Microsoft Defender for Cloud
Flags
Our Metadata
- Policy Type:
COMPLIANCE_POLICY - Policy Category:
SECURITY
Similar Policies
- Cloud Conformity
- Internal
dec-x-cff561fd
Similar Internal Rules
| Rule | Policies | Flags |
|---|---|---|
| ✉️ dec-x-cff561fd | 3 |
Description
Description
An organization's attack surface is the collection of assets with a public network identifier or URI that an external threat actor can see or access from outside your cloud. It is the set of points on the boundary of a system, a system element, system component, or an environment where an attacker can try to enter, cause an effect on, or extract data from, that system, system element, system component, or environment. The larger the attack surface, the harder it is to protect.
This tool can be configured to scan your organization's online infrastructure such as specified domains, hosts, CIDR blocks, and SSL certificates, and store them in an Inventory. Inventory items can be added, reviewed, approved, and removed, and may contain enrichments ("insights") and additional information collected from the tool's different scan engines and open-source intelligence sources.
A Defender EASM workspace will generate an Inventory of publicly exposed assets by crawling and scanning the internet using Seeds you provide when setting up the tool. Seeds can be FQDNs, IP CIDR blocks, and WHOIS records.
... see more
Remediation
Remediation
To begin remediation, a Microsoft Defender EASM workspace must be created. The resources and inventory items added to this workspace will depend on your environment.