Skip to content

Commit 110b9ba

Browse files
Merge pull request #266945 from dcurwin/fix-formatting-feb22-2024
Fix formatting
2 parents fdea47d + 3e6309e commit 110b9ba

15 files changed

+75
-108
lines changed

articles/defender-for-cloud/concept-devops-environment-posture-management-overview.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,6 @@
22
title: DevOps environment posture management overview
33
description: Learn how to discover security posture violations in DevOps environments
44
ms.date: 10/17/2023
5-
author: AlizaBernstein
6-
ms.author: v-bernsteina
75
ms.topic: conceptual
86
---
97

articles/defender-for-cloud/create-custom-recommendations.md

Lines changed: 7 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -2,23 +2,18 @@
22
title: Create custom security standards and recommendations for AWS/GCP resources in Microsoft Defender for Cloud
33
description: Learn how to create custom security standards and recommendations for AWS/GCP resources in Microsoft Defender for Cloud
44
ms.topic: how-to
5-
author: AlizaBernstein
65
ms.date: 03/26/2023
76
---
87

98
# Create custom security standards and recommendations (AWS/GCP)
109

1110
[Security recommendations](security-policy-concept.md) in Microsoft Defender for Cloud help you to improve and harden your security posture. Recommendations are based on assessments against [security standards](security-policy-concept.md) defined for Azure subscriptions, AWS accounts, and GCP projects that have Defender for Cloud enabled.
1211

13-
14-
15-
1612
This article describes how to:
1713

1814
- Create custom recommendations for AWS accounts and GCP projects with a KQL query.
1915
- Assign custom recommendations to a custom security standard.
2016

21-
2217
## Before you start
2318

2419
- Defender for Cloud currently supports creating custom recommendations for AWS accounts and GCP projects only.
@@ -27,15 +22,11 @@ This article describes how to:
2722
- To create custom recommendations, you must have the [Defender CSPM plan](concept-cloud-security-posture-management.md) enabled.
2823
- [Review support in Azure clouds](support-matrix-cloud-environment.md) for custom recommendations.
2924

30-
3125
We recommend watching this episode of [Defender for Cloud in the field](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/creating-custom-recommendations-amp-standards-for-aws-gcp/ba-p/3810248) to learn more about the feature, and dig into creating KQL queries.
3226

33-
34-
3527
Watch this episode of [Defender for Cloud in the field](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/creating-custom-recommendations-amp-standards-for-aws-gcp/ba-p/3810248) to learn more about the feature, and dig into creating KQL queries.
3628

37-
38-
## Create a custom recommendation
29+
## Create a custom recommendation
3930

4031
Create custom recommendations, including steps for remediation, severity, and the standards to which the recommendation should be assigned. You add recommendation logic with KQL. You can use a simple query editor with built-in query templated that you can tweak as needed, or you can write your KQL query from scratch.
4132

@@ -51,8 +42,8 @@ Create custom recommendations, including steps for remediation, severity, and th
5142
1. In **Recommendation query**, write a KQL query, or select **Open query editor** to structure your query. If you want to use the query editor, follow the instructions below.
5243
1. After the query is ready, select **Next**.
5344
1. In **Standards**, select the custom standards to which you want to add the custom recommendation.
54-
1. and in **Review and create**, review the recommendations details.
55-
45+
1. and in **Review and create**, review the recommendations details.
46+
5647
:::image type="content" source="./media/create-custom-recommendations/review-recommendation.png" alt-text="Screenshot showing where to review the recommendation details." lightbox="./media/create-custom-recommendations/review-recommendation.png":::
5748

5849
### Use the query editor
@@ -61,20 +52,19 @@ We recommend using the query editor to create a recommendation query.
6152

6253
- Using the editor helps you to build and test your query before you start using it.
6354
- Select **How to** to get help on structuring the query, and additional instructions and links.
64-
- The editor contains examples of built-in recommendations queries, that you can use to help build your own query. The data appears in the same structure as in the API.
55+
- The editor contains examples of built-in recommendations queries, that you can use to help build your own query. The data appears in the same structure as in the API.
6556

6657
1. in the query editor, select **New query** to create a query
6758
1. Use the example query template with its instructions, or select an example built-in recommendation query to get started.
6859

69-
7060
:::image type="content" source="./media/create-custom-recommendations/query-editor.png" alt-text="Screenshot showing how to use the query editor." lightbox="./media/create-custom-recommendations/query-editor.png":::
7161

7262
1. Select **Run query** to test the query you've created.
7363
1. When the query is ready, cut and paste it from the editor into the **Recommendations query** pane.
7464

7565
## Create a custom standard
7666

77-
Custom recommendations can be assigned to one or more custom standards.
67+
Custom recommendations can be assigned to one or more custom standards.
7868

7969
1. Sign in to the [Azure portal](https://portal.azure.com/).
8070

@@ -94,9 +84,7 @@ Custom recommendations can be assigned to one or more custom standards.
9484

9585
You can use the following links to learn more about Kusto queries:
9686

97-
- [KQL Quick Reference](/azure/data-explorer/kql-quick-reference)
87+
- [KQL Quick Reference](/azure/data-explorer/kql-quick-reference)
9888
- [Kusto Query Language (KQL) overview](/azure/data-explorer/kusto/query/)
99-
- [Must Learn KQL Part 1: Tools and Resources](https://rodtrent.substack.com/p/must-learn-kql-part-1-tools-and-resources)
89+
- [Must Learn KQL Part 1: Tools and Resources](https://rodtrent.substack.com/p/must-learn-kql-part-1-tools-and-resources)
10090
- [What are security policies, initiatives, and recommendations?](security-policy-concept.md)
101-
102-

articles/defender-for-cloud/data-aware-security-dashboard-overview.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
---
22
title: The data-aware security dashboard
33
description: Learn about the capabilities and functions of the data-aware security view in Microsoft Defender for Cloud.
4-
author: AlizaBernstein
5-
ms.author: v-bernsteina
64
ms.topic: conceptual
75
ms.date: 02/11/2024
86
---

articles/defender-for-cloud/defender-for-apis-prepare.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ ms.custom: references_regions
1010
---
1111
# Support and prerequisites for Defender for APIs deployment
1212

13-
Review the requirements on this page before setting up [Microsoft Defender for APIs](defender-for-apis-introduction.md).
13+
Review the requirements on this page before setting up [Microsoft Defender for APIs](defender-for-apis-introduction.md).
1414

1515
## Cloud and region support
1616

articles/defender-for-cloud/defender-for-containers-vulnerability-assessment-azure.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ Container vulnerability assessment powered by Qualys has the following capabilit
4141

4242
- **Reporting** - Container Vulnerability Assessment for Azure powered by Qualys provides vulnerability reports using the following recommendations:
4343

44-
| Recommendation | Description | Assessment Key
44+
| Recommendation | Description | Assessment Key |
4545
|--|--|--|
4646
| [Azure registry container images should have vulnerabilities resolved (powered by Qualys)](https://ms.portal.azure.com/#view/Microsoft_Azure_Security_CloudNativeCompute/ContainerRegistryRecommendationDetailsBlade/assessmentKey/dbd0cb49-b563-45e7-9724-889e799fa648)| Container image vulnerability assessment scans your registry for security vulnerabilities and exposes detailed findings for each image. Resolving the vulnerabilities can greatly improve your containers security posture and protect them from attacks. | dbd0cb49-b563-45e7-9724-889e799fa648 |
4747
| [Azure running container images should have vulnerabilities resolved - (powered by Qualys)](https://ms.portal.azure.com/#view/Microsoft_Azure_Security_CloudNativeCompute/KubernetesRuntimeVisibilityRecommendationDetailsBlade/assessmentKey/41503391-efa5-47ee-9282-4eff6131462c)| Container image vulnerability assessment scans container images running on your Kubernetes clusters for security vulnerabilities and exposes detailed findings for each image. Resolving the vulnerabilities can greatly improve your containers security posture and protect them from attacks. | 41503391-efa5-47ee-9282-4eff6131462c |

articles/defender-for-cloud/defender-for-sql-on-machines-vulnerability-assessment.md

Lines changed: 15 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ ms.date: 11/09/2021
1919
The integrated [vulnerability assessment scanner](./sql-azure-vulnerability-assessment-overview.md) discovers, tracks, and helps you remediate potential database vulnerabilities. Assessment scans findings provide an overview of your SQL machines' security state, and details of any security findings.
2020

2121
> [!NOTE]
22-
> The scan is lightweight, safe, only takes a few seconds per database to run and is entirely read-only. It does not make any changes to your database.
22+
> The scan is lightweight, safe, only takes a few seconds per database to run and is entirely read-only. It does not make any changes to your database.
2323
2424
## Explore vulnerability assessment reports
2525

@@ -31,7 +31,7 @@ You can view the vulnerability assessment results directly from Defender for Clo
3131

3232
1. From Defender for Cloud's sidebar, open the **Recommendations** page.
3333

34-
1. Select the recommendation [SQL servers on machines should have vulnerability findings resolved](https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/f97aa83c-9b63-4f9a-99f6-b22c4398f936). For more information, see the [Defender for Cloud recommendations reference page](review-security-recommendations.md).
34+
1. Select the recommendation [SQL servers on machines should have vulnerability findings resolved](https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/f97aa83c-9b63-4f9a-99f6-b22c4398f936). For more information, see the [Defender for Cloud recommendations reference page](review-security-recommendations.md).
3535

3636
:::image type="content" source="./media/security-center-advanced-iaas-data/data-and-storage-sqldb-vulns-on-vm.png" alt-text="SQL servers on machines should have vulnerability findings resolved":::
3737

@@ -47,15 +47,15 @@ You can view the vulnerability assessment results directly from Defender for Clo
4747

4848
In each view, the security checks are sorted by **Severity**. Select a specific security check to see a details pane with a **Description**, how to **Remediate** it, and other related information such as **Impact** or **Benchmark**.
4949

50-
## Set a baseline
50+
## Set a baseline
5151

5252
As you review your assessment results, you can mark results as being an acceptable baseline in your environment. The baseline is essentially a customization of how the results are reported. Results that match the baseline are considered as passing in subsequent scans. After you've established your baseline security state, the vulnerability assessment scanner only reports on deviations from the baseline. In this way, you can focus your attention on the relevant issues.
5353

5454
:::image type="content" source="media/defender-for-sql-on-machines-vulnerability-assessment/analyze-report-for-details.png" alt-text="As you review your assessment results, you can mark results as being an acceptable baseline in your environment.":::
5555

5656
## Export results
5757

58-
Use the [Continuous export](continuous-export.md) feature of Microsoft Defender for Cloud to export vulnerability assessment findings to Azure Event Hubs or to Log Analytics workspace.
58+
Use the [Continuous export](continuous-export.md) feature of Microsoft Defender for Cloud to export vulnerability assessment findings to Azure Event Hubs or to Log Analytics workspace.
5959

6060
## View vulnerabilities in graphical, interactive reports
6161

@@ -72,7 +72,6 @@ The 'Vulnerability Assessment Findings' report gathers all of these findings and
7272

7373
:::image type="content" source="media/defender-for-sql-on-machines-vulnerability-assessment/vulnerability-assessment-findings-report-sql.png" alt-text="Defender for Cloud's vulnerability assessment findings report":::
7474

75-
7675
## Disable specific findings
7776

7877
If you have an organizational need to ignore a finding, rather than remediate it, you can optionally disable it. Disabled findings don't impact your secure score or generate unwanted noise.
@@ -92,16 +91,16 @@ To create a rule:
9291

9392
1. Select the relevant scope.
9493

95-
1. Define your criteria. You can use any of the following criteria:
96-
- Finding ID
97-
- Severity
98-
- Benchmarks
94+
1. Define your criteria. You can use any of the following criteria:
95+
- Finding ID
96+
- Severity
97+
- Benchmarks
9998

10099
:::image type="content" source="./media/defender-for-sql-on-machines-vulnerability-assessment/disable-rule-vulnerability-findings-sql.png" alt-text="Create a disable rule for VA findings on SQL servers on machines.":::
101100

102101
1. Select **Apply rule**. Changes might take up to 24 hours to take effect.
103102

104-
1. To view, override, or delete a rule:
103+
1. To view, override, or delete a rule:
105104

106105
1. Select **Disable rule**.
107106

@@ -133,14 +132,14 @@ SQL Vulnerability Assessment queries the SQL server using publicly available que
133132

134133
Metadata information about the connected machine is also collected. Specifically:
135134

136-
- Operating system name, type, and version
137-
- Computer fully qualified domain name (FQDN)
138-
- Connected Machine agent version
139-
- UUID (BIOS ID)
140-
- SQL server name and underlying database names
135+
- Operating system name, type, and version
136+
- Computer fully qualified domain name (FQDN)
137+
- Connected Machine agent version
138+
- UUID (BIOS ID)
139+
- SQL server name and underlying database names
141140

142141
You can specify the region where your SQL Vulnerability Assessment data will be stored by choosing the Log Analytics workspace location. Microsoft might replicate to other regions for data resiliency, but Microsoft does not replicate data outside the geography.
143142

144143
## Next steps
145144

146-
Learn more about Defender for Cloud's protections for SQL resources in [Overview of Microsoft Defender for SQL](defender-for-sql-introduction.md).
145+
Learn more about Defender for Cloud's protections for SQL resources in [Overview of Microsoft Defender for SQL](defender-for-sql-introduction.md).

articles/defender-for-cloud/defender-for-sql-scan-results.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ This article describes several ways to consume and export your scan results.
2525
1. Search for and select either:
2626

2727
- For Azure SQL databases - `SQL databases should have vulnerability findings resolved`.
28-
28+
2929
- For SQL on machines - `SQL servers on machines should have vulnerability findings resolved`.
3030

3131
1. Select **Open Query**.

articles/defender-for-cloud/defender-for-storage-azure-portal-enablement.md

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,6 @@
22
title: Enable and configure the Defender for Storage plan at scale using the Azure portal
33
description: Learn how to enable the Defender for Storage on your Azure subscription for Microsoft Defender for Cloud using the Azure portal.
44
ms.topic: install-set-up-deploy
5-
author: AlizaBernstein
6-
ms.author: v-bernsteina
75
ms.date: 08/15/2023
86
---
97

@@ -61,4 +59,4 @@ If you want to disable Defender for Storage on the storage account or disable on
6159
## Next steps
6260

6361
- Learn how to [enable and Configure the Defender for Storage plan at scale with an Azure built-in policy](defender-for-storage-policy-enablement.md).
64-
- Learn more on how to [set up response for malware scanning](defender-for-storage-configure-malware-scan.md) results.
62+
- Learn more on how to [set up response for malware scanning](defender-for-storage-configure-malware-scan.md) results.

0 commit comments

Comments
 (0)