📝 Azure Subscription Security Alert Notifications additional email address is not configured 🟢

• Contextual name: 📝 Security Alert Notifications additional email address is not configured 🟢
• ID: /ce/ca/azure/subscription/security-alert-notifications-additional-email-address
• Located in: 📁 Azure Subscription

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Configure Additional Email Addresses for Azure Security Center Notifications
• Internal
  • dec-x-52ca1960

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-52ca1960	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📗 Azure Subscription
  • 🔌 Azure Subscription - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Microsoft Defender for Cloud emails the subscription owners whenever a high-severity alert is triggered for their subscription. You should provide a security contact email address as an additional email address.

Rationale

Microsoft Defender for Cloud emails the Subscription Owner to notify them about security alerts. Adding your Security Contact's email address to the 'Additional email addresses' field ensures that your organization's Security Team is included in these alerts. This ensures that the proper people are aware of any potential compromise in order to mitigate the risk in a timely fashion.

Audit

This policy flags an Azure Subscription as INCOMPLIANT if the Security Center: Contacts configuration does not include a default contact with a configured security contact email.

Default Value

By default, there are no additional email addresses entered.

References

1. https://docs.microsoft.com/en-us/azure/security-center/security-center-provide-security-contact-details
2. https://docs.microsoft.com/en-us/rest/api/securitycenter/securitycontacts/list

... see more

Remediation

Open File

Remediation

From Azure Portal

1. From Azure Home select the Portal Menu.
2. Select Microsoft Defender for Cloud.
3. Under Management, select Environment Settings.
4. Click on the appropriate Management Group, Subscription, or Workspace.
5. Click on Email notifications.
6. Enter a valid security contact email address (or multiple addresses separated by commas) in the Additional email addresses field.
7. Click Save.

From Azure CLI

Use the below command to set Security contact emails to On:

az account get-access-token --query "{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/securityContacts/default?api-version=2020-01-01-preview -d@"input.json"'

Where input.json contains the data below, replacing validEmailAddress with a single email address or multiple comma-separated email addresses:

{ 
    "id": "/subscriptions/<Your_Subscription_Id>/providers/Microsoft.Security/securityContacts/default", 

... [see more](remediation.md)

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 16f information security reporting and analytics;		9	11
💼 APRA CPG 234 → 💼 16g incident detection and response, including recovery, notification and communication;		2	2
💼 APRA CPG 234 → 💼 36j monitoring controls — for timely detection of compromises to information security;		9	11
💼 APRA CPG 234 → 💼 67a network and user profiling that establishes a baseline of normal activity which, when combined with logging and alerting mechanisms, can enable detection of anomalous activity;		19	22
💼 APRA CPG 234 → 💼 73c escalation to ensure that decision-makers are aware of the incident and to trigger incident response processes;		2	2
💼 CIS Azure v1.3.0 → 💼 2.13 Ensure 'Additional email addresses' is configured with a security contact email - Level 1 (Automated)		1	1
💼 CIS Azure v1.4.0 → 💼 2.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email - Level 1 (Automated)		1	1
💼 CIS Azure v1.5.0 → 💼 2.3.2 Ensure 'Additional email addresses' is Configured with a Security Contact Email - Level 1 (Automated)		1	1
💼 CIS Azure v2.0.0 → 💼 2.1.19 Ensure 'Additional email addresses' is Configured with a Security Contact Email - Level 1 (Automated)		1	1
💼 CIS Azure v2.1.0 → 💼 2.1.18 Ensure 'Additional email addresses' is Configured with a Security Contact Email - Level 1 (Automated)		1	1
💼 CIS Azure v3.0.0 → 💼 3.1.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email (Automated)			1
💼 CIS Azure v4.0.0 → 💼 9.1.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email (Automated)			1
💼 Cloudaware Framework → 💼 Microsoft Defender Configuration			26
💼 FedRAMP High Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)	6	20	30
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)	2		65
💼 FedRAMP High Security Controls → 💼 IR-6(3) Supply Chain Coordination (M)(H)		2	2
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)		48	51
💼 FedRAMP Low Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)			24
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			65
💼 FedRAMP Moderate Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)	2		30
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			65
💼 FedRAMP Moderate Security Controls → 💼 IR-6(3) Supply Chain Coordination (M)(H)			2
💼 ISO/IEC 27001:2013 → 💼 A.16.1.2 Reporting information security events		9	10
💼 ISO/IEC 27001:2022 → 💼 5.5 Contact with authorities		2	3
💼 ISO/IEC 27001:2022 → 💼 5.6 Contact with special interest		2	3
💼 ISO/IEC 27001:2022 → 💼 5.20 Addressing information security within supplier agreements		2	3
💼 ISO/IEC 27001:2022 → 💼 5.24 Information security incident management planning and preparation		2	3
💼 NIST CSF v1.1 → 💼 DE.DP-4: Event detection information is communicated		29	32
💼 NIST CSF v1.1 → 💼 RS.CO-2: Incidents are reported consistent with established criteria		19	22
💼 NIST CSF v1.1 → 💼 RS.CO-3: Information is shared consistent with response plans		16	17
💼 NIST CSF v2.0 → 💼 DE.AE-06: Information on adverse events is provided to authorized staff and tools			32
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events			115
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events			81
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events			134
💼 NIST CSF v2.0 → 💼 RC.CO-04: Public updates on incident recovery are shared using approved methods and messaging			22
💼 NIST CSF v2.0 → 💼 RS.CO-02: Internal and external stakeholders are notified of incidents			30
💼 NIST CSF v2.0 → 💼 RS.CO-03: Information is shared with designated internal and external stakeholders			18
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation	4	47	65