📝 Azure Subscription Security Alert Notifications additional email address is not configured 🟢

• Contextual name: 📝 Security Alert Notifications additional email address is not configured 🟢
• ID: /ce/ca/azure/subscription/security-alert-notifications-additional-email-address
• Located in: 📁 Azure Subscription

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Configure Additional Email Addresses for Azure Security Center Notifications
• Internal
  • dec-x-52ca1960

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-52ca1960	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 Azure Subscription
  • 🔌 Azure Subscription - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Microsoft Defender for Cloud emails the subscription owners whenever a high-severity alert is triggered for their subscription. You should provide a security contact email address as an additional email address.

Rationale

Microsoft Defender for Cloud emails the Subscription Owner to notify them about security alerts. Adding your Security Contact's email address to the 'Additional email addresses' field ensures that your organization's Security Team is included in these alerts. This ensures that the proper people are aware of any potential compromise in order to mitigate the risk in a timely fashion.

Audit

From Azure Portal

1. From Azure Home select the Portal Menu.
2. Select Microsoft Defender for Cloud.
3. Under Management, select Environment Settings.
4. Click on the appropriate Management Group, Subscription, or Workspace.
5. Click on Email notifications.
6. Ensure that a valid security contact email address is listed in the Additional email addresses field.

From Azure CLI

Ensure the output of the below command is set not empty and is set with appropriate email ids:

... see more

Remediation

Open File

Remediation

From Azure Portal

1. From Azure Home select the Portal Menu.
2. Select Microsoft Defender for Cloud.
3. Under Management, select Environment Settings.
4. Click on the appropriate Management Group, Subscription, or Workspace.
5. Click on Email notifications.
6. Enter a valid security contact email address (or multiple addresses separated by commas) in the Additional email addresses field.
7. Click Save.

From Azure CLI

Use the below command to set Security contact emails to On:

az account get-access-token --query "{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/securityContacts/default?api-version=2020-01-01-preview -d@"input.json"'

Where input.json contains the data below, replacing validEmailAddress with a single email address or multiple comma-separated email addresses:

{ 
    "id": "/subscriptions/<Your_Subscription_Id>/providers/Microsoft.Security/securityContacts/default", 

... [see more](remediation.md)

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 16f information security reporting and analytics;		9	11
💼 APRA CPG 234 → 💼 16g incident detection and response, including recovery, notification and communication;		2	2
💼 APRA CPG 234 → 💼 36j monitoring controls — for timely detection of compromises to information security;		9	11
💼 APRA CPG 234 → 💼 67a network and user profiling that establishes a baseline of normal activity which, when combined with logging and alerting mechanisms, can enable detection of anomalous activity;		18	21
💼 APRA CPG 234 → 💼 73c escalation to ensure that decision-makers are aware of the incident and to trigger incident response processes;		2	2
💼 CIS Azure v1.3.0 → 💼 2.13 Ensure 'Additional email addresses' is configured with a security contact email - Level 1 (Automated)		1	1
💼 CIS Azure v1.4.0 → 💼 2.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email - Level 1 (Automated)		1	1
💼 CIS Azure v1.5.0 → 💼 2.3.2 Ensure 'Additional email addresses' is Configured with a Security Contact Email - Level 1 (Automated)		1	1
💼 CIS Azure v2.0.0 → 💼 2.1.19 Ensure 'Additional email addresses' is Configured with a Security Contact Email - Level 1 (Automated)		1	1
💼 CIS Azure v2.1.0 → 💼 2.1.18 Ensure 'Additional email addresses' is Configured with a Security Contact Email - Level 1 (Automated)		1	1
💼 CIS Azure v3.0.0 → 💼 3.1.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email (Automated)			1
💼 Cloudaware Framework → 💼 Microsoft Defender Configuration			26
💼 FedRAMP High Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)	6	21	26
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)	2		47
💼 FedRAMP High Security Controls → 💼 IR-6(3) Supply Chain Coordination (M)(H)		2	2
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)		46	48
💼 FedRAMP Low Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)			23
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			47
💼 FedRAMP Moderate Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)	2		26
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			47
💼 FedRAMP Moderate Security Controls → 💼 IR-6(3) Supply Chain Coordination (M)(H)			2
💼 ISO/IEC 27001:2013 → 💼 A.16.1.2 Reporting information security events		9	10
💼 ISO/IEC 27001:2022 → 💼 5.5 Contact with authorities		2	2
💼 ISO/IEC 27001:2022 → 💼 5.6 Contact with special interest		2	2
💼 ISO/IEC 27001:2022 → 💼 5.20 Addressing information security within supplier agreements		2	2
💼 ISO/IEC 27001:2022 → 💼 5.24 Information security incident management planning and preparation		2	2
💼 NIST CSF v1.1 → 💼 DE.DP-4: Event detection information is communicated		30	33
💼 NIST CSF v1.1 → 💼 RS.CO-2: Incidents are reported consistent with established criteria		20	23
💼 NIST CSF v1.1 → 💼 RS.CO-3: Information is shared consistent with response plans		16	17
💼 NIST CSF v2.0 → 💼 DE.AE-06: Information on adverse events is provided to authorized staff and tools			33
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events			83
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events			59
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events			89
💼 NIST CSF v2.0 → 💼 RC.CO-04: Public updates on incident recovery are shared using approved methods and messaging			23
💼 NIST CSF v2.0 → 💼 RS.CO-02: Internal and external stakeholders are notified of incidents			30
💼 NIST CSF v2.0 → 💼 RS.CO-03: Information is shared with designated internal and external stakeholders			17
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation	4	45	47