📝 Azure Subscription Security Alert Notifications for alerts with High severity are not configured 🟢

• Contextual name: 📝 Security Alert Notifications for alerts with High severity is not configured 🟢
• ID: /ce/ca/azure/subscription/security-alert-notifications-for-alerts-with-high-severity
• Located in: 📁 Azure Subscription

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Email Notification for Alerts
• Internal
  • dec-x-ba4c5b1c

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-ba4c5b1c	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 Azure Subscription
  • 🔌 Azure Subscription - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Enables emailing security alerts to the subscription owner or other designated security contact.

Rationale

Enabling security alert emails ensures that security alert emails are received from Microsoft. This ensures that the right people are aware of any potential security issues and are able to mitigate the risk.

Audit

From Azure Portal

1. From Azure Home select the Portal Menu.
2. Select Microsoft Defender for Cloud.
3. Under Management, select Environment Settings.
4. Click on the appropriate Management Group, Subscription, or Workspace.
5. Click on Email notifications.
6. Ensure that the Notify about alerts with the following severity (or higher) setting is checked and set to High.

From Azure CLI

Ensure the output of below command is set to True, enter your Subscription ID at the $0 between /subscriptions/<$0>/providers:

az account get-access-token --query "{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X GET -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/securityContacts?api-version=2020-01-01-preview' | jq '.|.[] | select(.name=="default")'|jq '.properties.alertNotifications'

... [see more](description.md)

Remediation

Open File

Remediation

From Azure Portal

1. From Azure Home select the Portal Menu.
2. Select Microsoft Defender for Cloud.
3. Under Management, select Environment Settings.
4. Click on the appropriate Management Group, Subscription, or Workspace.
5. Click on Email notifications.
6. Under Notification types, check the check box next to Notify about alerts with the following severity (or higher) and select High from the drop down menu.
7. Click Save.

From Azure CLI

Use the below command to set Send email notification for high severity alerts to On.

az account get-access-token --query "{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/<$0>/providers/Microsoft.Security/securityContacts/default1?api-version=2017-08-01-preview -d@"input.json"'

Where input.json contains the data below, replacing validEmailAddress with a single email address or multiple comma-separated email addresses:

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 16f information security reporting and analytics;		9	11
💼 APRA CPG 234 → 💼 16g incident detection and response, including recovery, notification and communication;		2	2
💼 APRA CPG 234 → 💼 36i service level management mechanisms — to monitor, manage and align information security with business objectives;		2	2
💼 APRA CPG 234 → 💼 36j monitoring controls — for timely detection of compromises to information security;		9	11
💼 APRA CPG 234 → 💼 67a network and user profiling that establishes a baseline of normal activity which, when combined with logging and alerting mechanisms, can enable detection of anomalous activity;		18	21
💼 APRA CPG 234 → 💼 73c escalation to ensure that decision-makers are aware of the incident and to trigger incident response processes;		2	2
💼 CIS Azure v2.1.0 → 💼 2.1.19 Ensure That 'Notify about alerts with the following severity' is Set to 'High' - Level 1 (Automated)			1
💼 CIS Azure v3.0.0 → 💼 3.1.14 Ensure That 'Notify about alerts with the following severity' is Set to 'High' (Automated)			1
💼 Cloudaware Framework → 💼 Microsoft Defender Configuration			26
💼 FedRAMP High Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)		1	13
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)	2		47
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)		46	48
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			47
💼 FedRAMP Moderate Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)			13
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			47
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events			83
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events			59
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events			89
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(4) Account Management _ Automated Audit Actions		11	13
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation	4	45	47