Skip to main content

🛡️ Azure Subscription Security Alert Notifications additional email address is not configured🟢

  • Contextual name: 🛡️ Security Alert Notifications additional email address is not configured🟢
  • ID: /ce/ca/azure/subscription/security-alert-notifications-additional-email-address
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Stats​

not available

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-52ca19601

Description​

Open File

Description​

Microsoft Defender for Cloud emails the subscription owners whenever a high-severity alert is triggered for their subscription. You should provide a security contact email address as an additional email address.

Rationale​

Microsoft Defender for Cloud emails the Subscription Owner to notify them about security alerts. Adding your Security Contact's email address to the 'Additional email addresses' field ensures that your organization's Security Team is included in these alerts. This ensures that the proper people are aware of any potential compromise in order to mitigate the risk in a timely fashion.

Audit​

This policy flags an Azure Subscription as INCOMPLIANT if the Security Center: Contacts configuration does not include a default contact with a configured security contact email.

Default Value​

By default, there are no additional email addresses entered.

References​

  1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-email-notifications
  2. https://learn.microsoft.com/en-us/rest/api/defenderforcloud/security-contacts/list

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. From Azure Home, select the Portal Menu.
  2. Select Microsoft Defender for Cloud.
  3. Under Management, select Environment Settings.
  4. Click on the appropriate Management Group, Subscription, or Workspace.
  5. Click on Email notifications.
  6. Enter a valid security contact email address (or multiple addresses separated by commas) in the Additional email addresses field.
  7. Click Save.

From Azure CLI​

Use the below command to set Security contact emails to On:

az account get-access-token \
    --query "{subscription:subscription,accessToken:accessToken}" \
    --out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/{{subscription-id}}/providers/Microsoft.Security/securityContacts/default?api-version=2020-01-01-preview -d@"input.json"'

Where input.json contains the data below, replacing validEmailAddress with a single email address or multiple comma-separated email addresses:

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 16f information security reporting and analytics;1012no data
💼 APRA CPG 234 → 💼 16g incident detection and response, including recovery, notification and communication;22no data
💼 APRA CPG 234 → 💼 36j monitoring controls — for timely detection of compromises to information security;1012no data
💼 APRA CPG 234 → 💼 67a network and user profiling that establishes a baseline of normal activity which, when combined with logging and alerting mechanisms, can enable detection of anomalous activity;2124no data
💼 APRA CPG 234 → 💼 73c escalation to ensure that decision-makers are aware of the incident and to trigger incident response processes;22no data
💼 CIS Azure v1.3.0 → 💼 2.13 Ensure 'Additional email addresses' is configured with a security contact email - Level 1 (Automated)11no data
💼 CIS Azure v1.4.0 → 💼 2.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email - Level 1 (Automated)11no data
💼 CIS Azure v1.5.0 → 💼 2.3.2 Ensure 'Additional email addresses' is Configured with a Security Contact Email - Level 1 (Automated)11no data
💼 CIS Azure v2.0.0 → 💼 2.1.19 Ensure 'Additional email addresses' is Configured with a Security Contact Email - Level 1 (Automated)11no data
💼 CIS Azure v2.1.0 → 💼 2.1.18 Ensure 'Additional email addresses' is Configured with a Security Contact Email - Level 1 (Automated)11no data
💼 CIS Azure v3.0.0 → 💼 3.1.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email (Automated)1no data
💼 CIS Azure v4.0.0 → 💼 9.1.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email (Automated)1no data
💼 CIS Azure v5.0.0 → 💼 8.1.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email (Automated)1no data
💼 CIS Azure v6.0.0 → 💼 8.1.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email (Automated)1no data
💼 Cloudaware Framework → 💼 Microsoft Defender Configuration29no data
💼 FedRAMP High Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)62344no data
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)276no data
💼 FedRAMP High Security Controls → 💼 IR-6(3) Supply Chain Coordination (M)(H)22no data
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)5159no data
💼 FedRAMP Low Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)26no data
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)76no data
💼 FedRAMP Moderate Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)244no data
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)76no data
💼 FedRAMP Moderate Security Controls → 💼 IR-6(3) Supply Chain Coordination (M)(H)2no data
💼 ISO/IEC 27001:2013 → 💼 A.16.1.2 Reporting information security events1010no data
💼 ISO/IEC 27001:2022 → 💼 5.5 Contact with authorities23no data
💼 ISO/IEC 27001:2022 → 💼 5.6 Contact with special interest23no data
💼 ISO/IEC 27001:2022 → 💼 5.20 Addressing information security within supplier agreements23no data
💼 ISO/IEC 27001:2022 → 💼 5.24 Information security incident management planning and preparation23no data
💼 NIST CSF v1.1 → 💼 DE.DP-4: Event detection information is communicated3235no data
💼 NIST CSF v1.1 → 💼 RS.CO-2: Incidents are reported consistent with established criteria2224no data
💼 NIST CSF v1.1 → 💼 RS.CO-3: Information is shared consistent with response plans1718no data
💼 NIST CSF v2.0 → 💼 DE.AE-06: Information on adverse events is provided to authorized staff and tools35no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events187no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events107no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events185no data
💼 NIST CSF v2.0 → 💼 RC.CO-04: Public updates on incident recovery are shared using approved methods and messaging24no data
💼 NIST CSF v2.0 → 💼 RS.CO-02: Internal and external stakeholders are notified of incidents33no data
💼 NIST CSF v2.0 → 💼 RS.CO-03: Information is shared with designated internal and external stakeholders19no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation45076no data