lacework-global-604
2.1.7 Set Microsoft Defender for Storage To 'On' (Manual)
Profile Applicability
• Level 2
Description
Turning on Microsoft Defender for Storage enables threat detection for Storage, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.
Rationale
Enabling Microsoft Defender for Storage allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).
Impact
Turning on Microsoft Defender for Storage incurs an additional cost per resource.
Audit
From Azure Portal
- Go to
Microsoft Defender for Cloud - Select
Environment Settingsblade - Click on the subscription name
- Select the
Defender plansblade - Review the chosen pricing tier. For the
Storageresource typePlanshould be set toOn.
From Azure CLI
Ensure the output of the below command is Standard
az security pricing show -n StorageAccounts
From Azure Powershell
Get-AzSecurityPricing -Name 'StorageAccounts' | Select-Object Name,PricingTier
Ensure output for Name PricingTier is StorageAccounts Standard
Remediation
From Azure Portal
- Go to Microsoft Defender for Cloud.
- Select Environment Settings blade.
- Click the subscription name.
- Select the Defender plans blade.
- Set Status to On for Storage.
- Select Save.
From Azure CLI
Ensure the output of the below command is Standard:
az security pricing create -n StorageAccounts --tier 'standard'
From Azure Powershell
Set-AzSecurityPricing -Name 'StorageAccounts' -PricingTier 'Standard'
References
https://docs.microsoft.com/en-us/azure/security-center/security-center-detection-capabilities
https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/list
https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/update
https://docs.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-1-enable-threat-detection-capabilities