🛡️ Azure Subscription Security Alert Notifications for alerts with High or Critical severity are not configured🟢

• Contextual name: 🛡️ Security Alert Notifications for alerts with High or Critical severity is not configured🟢
• ID: /ce/ca/azure/subscription/security-alert-notifications-for-alerts-with-high-severity
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Subscription
  • 🔌 Azure Subscription - object.extracts.yaml
  • 🧪 test-data.json

Similar Policies

• Cloud Conformity: Email Notification for Alerts
• Internal: dec-x-ba4c5b1c

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-ba4c5b1c	1

Description

Open File

Description

Enables emailing security alerts to the subscription owner or other designated security contact.

Rationale

Enabling security alert emails ensures that security alert emails are received from Microsoft. This ensures that the right people are aware of any potential security issues and are able to mitigate the risk.

Impact

Enabling security alert emails can cause alert fatigue, increasing the risk of missing important alerts. Select an appropriate severity level to manage notifications. Azure aims to reduce alert fatigue by limiting the daily email volume per severity level. Learn more: https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-email-notifications#email-frequency.

Audit

This policy flags an Azure Subscription as INCOMPLIANT if the Security Center: Contacts configuration does not include a default contact where alertNotifications is set to On and alertNotificationsMinimalSeverity is set to High or Critical.

From Azure Policy

If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure.

... see more

Remediation

Open File

Remediation

From Azure Portal

1. From Azure Home select the Portal Menu.
2. Select Microsoft Defender for Cloud.
3. Under Management, select Environment Settings.
4. Click on the appropriate Management Group, Subscription, or Workspace.
5. Click on Email notifications.
6. Under Notification types, check the check box next to Notify about alerts with the following severity (or higher) and select High from the drop down menu.
7. Click Save.
8. Repeat steps 1-7 for each Subscription requiring remediation.

From Azure CLI

Use the below command to set Send email notification for high severity alerts to On.

az account get-access-token --query "{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/<$0>/providers/Microsoft.Security/securityContacts/default1?api-version=2017-08-01-preview -d@"input.json"'

Where input.json contains the data below, replacing validEmailAddress with a single email address or multiple comma-separated email addresses:

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 APRA CPG 234 → 💼 16f information security reporting and analytics;		9	11		no data
💼 APRA CPG 234 → 💼 16g incident detection and response, including recovery, notification and communication;		2	2		no data
💼 APRA CPG 234 → 💼 36i service level management mechanisms — to monitor, manage and align information security with business objectives;		2	2		no data
💼 APRA CPG 234 → 💼 36j monitoring controls — for timely detection of compromises to information security;		9	11		no data
💼 APRA CPG 234 → 💼 67a network and user profiling that establishes a baseline of normal activity which, when combined with logging and alerting mechanisms, can enable detection of anomalous activity;		19	22		no data
💼 APRA CPG 234 → 💼 73c escalation to ensure that decision-makers are aware of the incident and to trigger incident response processes;		2	2		no data
💼 CIS Azure v2.1.0 → 💼 2.1.19 Ensure That 'Notify about alerts with the following severity' is Set to 'High' - Level 1 (Automated)			1		no data
💼 CIS Azure v3.0.0 → 💼 3.1.14 Ensure That 'Notify about alerts with the following severity' is Set to 'High' (Automated)			1		no data
💼 CIS Azure v4.0.0 → 💼 9.1.14 Ensure that 'Notify about alerts with the following severity (or higher)' is enabled (Automated)			1		no data
💼 Cloudaware Framework → 💼 Microsoft Defender Configuration			26		no data
💼 FedRAMP High Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)			16		no data
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)	2		65		no data
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)		48	51		no data
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			65		no data
💼 FedRAMP Moderate Security Controls → 💼 AC-2(4) Automated Audit Actions (M)(H)			16		no data
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			65		no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events			145		no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events			85		no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events			142		no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-2(4) Account Management _ Automated Audit Actions		14	16		no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation	4	47	65		no data