You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/defender-for-cloud/create-custom-recommendations.md
+7-19Lines changed: 7 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,23 +2,18 @@
2
2
title: Create custom security standards and recommendations for AWS/GCP resources in Microsoft Defender for Cloud
3
3
description: Learn how to create custom security standards and recommendations for AWS/GCP resources in Microsoft Defender for Cloud
4
4
ms.topic: how-to
5
-
author: AlizaBernstein
6
5
ms.date: 03/26/2023
7
6
---
8
7
9
8
# Create custom security standards and recommendations (AWS/GCP)
10
9
11
10
[Security recommendations](security-policy-concept.md) in Microsoft Defender for Cloud help you to improve and harden your security posture. Recommendations are based on assessments against [security standards](security-policy-concept.md) defined for Azure subscriptions, AWS accounts, and GCP projects that have Defender for Cloud enabled.
12
11
13
-
14
-
15
-
16
12
This article describes how to:
17
13
18
14
- Create custom recommendations for AWS accounts and GCP projects with a KQL query.
19
15
- Assign custom recommendations to a custom security standard.
20
16
21
-
22
17
## Before you start
23
18
24
19
- Defender for Cloud currently supports creating custom recommendations for AWS accounts and GCP projects only.
@@ -27,15 +22,11 @@ This article describes how to:
27
22
- To create custom recommendations, you must have the [Defender CSPM plan](concept-cloud-security-posture-management.md) enabled.
28
23
-[Review support in Azure clouds](support-matrix-cloud-environment.md) for custom recommendations.
29
24
30
-
31
25
We recommend watching this episode of [Defender for Cloud in the field](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/creating-custom-recommendations-amp-standards-for-aws-gcp/ba-p/3810248) to learn more about the feature, and dig into creating KQL queries.
32
26
33
-
34
-
35
27
Watch this episode of [Defender for Cloud in the field](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/creating-custom-recommendations-amp-standards-for-aws-gcp/ba-p/3810248) to learn more about the feature, and dig into creating KQL queries.
36
28
37
-
38
-
## Create a custom recommendation
29
+
## Create a custom recommendation
39
30
40
31
Create custom recommendations, including steps for remediation, severity, and the standards to which the recommendation should be assigned. You add recommendation logic with KQL. You can use a simple query editor with built-in query templated that you can tweak as needed, or you can write your KQL query from scratch.
41
32
@@ -51,8 +42,8 @@ Create custom recommendations, including steps for remediation, severity, and th
51
42
1. In **Recommendation query**, write a KQL query, or select **Open query editor** to structure your query. If you want to use the query editor, follow the instructions below.
52
43
1. After the query is ready, select **Next**.
53
44
1. In **Standards**, select the custom standards to which you want to add the custom recommendation.
54
-
1. and in **Review and create**, review the recommendations details.
55
-
45
+
1. and in **Review and create**, review the recommendations details.
46
+
56
47
:::image type="content" source="./media/create-custom-recommendations/review-recommendation.png" alt-text="Screenshot showing where to review the recommendation details." lightbox="./media/create-custom-recommendations/review-recommendation.png":::
57
48
58
49
### Use the query editor
@@ -61,20 +52,19 @@ We recommend using the query editor to create a recommendation query.
61
52
62
53
- Using the editor helps you to build and test your query before you start using it.
63
54
- Select **How to** to get help on structuring the query, and additional instructions and links.
64
-
- The editor contains examples of built-in recommendations queries, that you can use to help build your own query. The data appears in the same structure as in the API.
55
+
- The editor contains examples of built-in recommendations queries, that you can use to help build your own query. The data appears in the same structure as in the API.
65
56
66
57
1. in the query editor, select **New query** to create a query
67
58
1. Use the example query template with its instructions, or select an example built-in recommendation query to get started.
68
59
69
-
70
60
:::image type="content" source="./media/create-custom-recommendations/query-editor.png" alt-text="Screenshot showing how to use the query editor." lightbox="./media/create-custom-recommendations/query-editor.png":::
71
61
72
62
1. Select **Run query** to test the query you've created.
73
63
1. When the query is ready, cut and paste it from the editor into the **Recommendations query** pane.
74
64
75
65
## Create a custom standard
76
66
77
-
Custom recommendations can be assigned to one or more custom standards.
67
+
Custom recommendations can be assigned to one or more custom standards.
78
68
79
69
1. Sign in to the [Azure portal](https://portal.azure.com/).
80
70
@@ -94,9 +84,7 @@ Custom recommendations can be assigned to one or more custom standards.
94
84
95
85
You can use the following links to learn more about Kusto queries:
Copy file name to clipboardExpand all lines: articles/defender-for-cloud/defender-for-containers-vulnerability-assessment-azure.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -41,7 +41,7 @@ Container vulnerability assessment powered by Qualys has the following capabilit
41
41
42
42
-**Reporting** - Container Vulnerability Assessment for Azure powered by Qualys provides vulnerability reports using the following recommendations:
43
43
44
-
| Recommendation | Description | Assessment Key
44
+
| Recommendation | Description | Assessment Key|
45
45
|--|--|--|
46
46
|[Azure registry container images should have vulnerabilities resolved (powered by Qualys)](https://ms.portal.azure.com/#view/Microsoft_Azure_Security_CloudNativeCompute/ContainerRegistryRecommendationDetailsBlade/assessmentKey/dbd0cb49-b563-45e7-9724-889e799fa648)| Container image vulnerability assessment scans your registry for security vulnerabilities and exposes detailed findings for each image. Resolving the vulnerabilities can greatly improve your containers security posture and protect them from attacks. | dbd0cb49-b563-45e7-9724-889e799fa648 |
47
47
|[Azure running container images should have vulnerabilities resolved - (powered by Qualys)](https://ms.portal.azure.com/#view/Microsoft_Azure_Security_CloudNativeCompute/KubernetesRuntimeVisibilityRecommendationDetailsBlade/assessmentKey/41503391-efa5-47ee-9282-4eff6131462c)| Container image vulnerability assessment scans container images running on your Kubernetes clusters for security vulnerabilities and exposes detailed findings for each image. Resolving the vulnerabilities can greatly improve your containers security posture and protect them from attacks. | 41503391-efa5-47ee-9282-4eff6131462c |
Copy file name to clipboardExpand all lines: articles/defender-for-cloud/defender-for-sql-on-machines-vulnerability-assessment.md
+15-16Lines changed: 15 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,7 +19,7 @@ ms.date: 11/09/2021
19
19
The integrated [vulnerability assessment scanner](./sql-azure-vulnerability-assessment-overview.md) discovers, tracks, and helps you remediate potential database vulnerabilities. Assessment scans findings provide an overview of your SQL machines' security state, and details of any security findings.
20
20
21
21
> [!NOTE]
22
-
> The scan is lightweight, safe, only takes a few seconds per database to run and is entirely read-only. It does not make any changes to your database.
22
+
> The scan is lightweight, safe, only takes a few seconds per database to run and is entirely read-only. It does not make any changes to your database.
23
23
24
24
## Explore vulnerability assessment reports
25
25
@@ -31,7 +31,7 @@ You can view the vulnerability assessment results directly from Defender for Clo
31
31
32
32
1. From Defender for Cloud's sidebar, open the **Recommendations** page.
33
33
34
-
1. Select the recommendation [SQL servers on machines should have vulnerability findings resolved](https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/f97aa83c-9b63-4f9a-99f6-b22c4398f936). For more information, see the [Defender for Cloud recommendations reference page](review-security-recommendations.md).
34
+
1. Select the recommendation [SQL servers on machines should have vulnerability findings resolved](https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/f97aa83c-9b63-4f9a-99f6-b22c4398f936). For more information, see the [Defender for Cloud recommendations reference page](review-security-recommendations.md).
35
35
36
36
:::image type="content" source="./media/security-center-advanced-iaas-data/data-and-storage-sqldb-vulns-on-vm.png" alt-text="SQL servers on machines should have vulnerability findings resolved":::
37
37
@@ -47,15 +47,15 @@ You can view the vulnerability assessment results directly from Defender for Clo
47
47
48
48
In each view, the security checks are sorted by **Severity**. Select a specific security check to see a details pane with a **Description**, how to **Remediate** it, and other related information such as **Impact** or **Benchmark**.
49
49
50
-
## Set a baseline
50
+
## Set a baseline
51
51
52
52
As you review your assessment results, you can mark results as being an acceptable baseline in your environment. The baseline is essentially a customization of how the results are reported. Results that match the baseline are considered as passing in subsequent scans. After you've established your baseline security state, the vulnerability assessment scanner only reports on deviations from the baseline. In this way, you can focus your attention on the relevant issues.
53
53
54
54
:::image type="content" source="media/defender-for-sql-on-machines-vulnerability-assessment/analyze-report-for-details.png" alt-text="As you review your assessment results, you can mark results as being an acceptable baseline in your environment.":::
55
55
56
56
## Export results
57
57
58
-
Use the [Continuous export](continuous-export.md) feature of Microsoft Defender for Cloud to export vulnerability assessment findings to Azure Event Hubs or to Log Analytics workspace.
58
+
Use the [Continuous export](continuous-export.md) feature of Microsoft Defender for Cloud to export vulnerability assessment findings to Azure Event Hubs or to Log Analytics workspace.
59
59
60
60
## View vulnerabilities in graphical, interactive reports
61
61
@@ -72,7 +72,6 @@ The 'Vulnerability Assessment Findings' report gathers all of these findings and
72
72
73
73
:::image type="content" source="media/defender-for-sql-on-machines-vulnerability-assessment/vulnerability-assessment-findings-report-sql.png" alt-text="Defender for Cloud's vulnerability assessment findings report":::
74
74
75
-
76
75
## Disable specific findings
77
76
78
77
If you have an organizational need to ignore a finding, rather than remediate it, you can optionally disable it. Disabled findings don't impact your secure score or generate unwanted noise.
@@ -92,16 +91,16 @@ To create a rule:
92
91
93
92
1. Select the relevant scope.
94
93
95
-
1. Define your criteria. You can use any of the following criteria:
96
-
- Finding ID
97
-
- Severity
98
-
- Benchmarks
94
+
1. Define your criteria. You can use any of the following criteria:
95
+
- Finding ID
96
+
- Severity
97
+
- Benchmarks
99
98
100
99
:::image type="content" source="./media/defender-for-sql-on-machines-vulnerability-assessment/disable-rule-vulnerability-findings-sql.png" alt-text="Create a disable rule for VA findings on SQL servers on machines.":::
101
100
102
101
1. Select **Apply rule**. Changes might take up to 24 hours to take effect.
103
102
104
-
1. To view, override, or delete a rule:
103
+
1. To view, override, or delete a rule:
105
104
106
105
1. Select **Disable rule**.
107
106
@@ -133,14 +132,14 @@ SQL Vulnerability Assessment queries the SQL server using publicly available que
133
132
134
133
Metadata information about the connected machine is also collected. Specifically:
135
134
136
-
-Operating system name, type, and version
137
-
-Computer fully qualified domain name (FQDN)
138
-
-Connected Machine agent version
139
-
-UUID (BIOS ID)
140
-
-SQL server name and underlying database names
135
+
-Operating system name, type, and version
136
+
-Computer fully qualified domain name (FQDN)
137
+
-Connected Machine agent version
138
+
-UUID (BIOS ID)
139
+
-SQL server name and underlying database names
141
140
142
141
You can specify the region where your SQL Vulnerability Assessment data will be stored by choosing the Log Analytics workspace location. Microsoft might replicate to other regions for data resiliency, but Microsoft does not replicate data outside the geography.
143
142
144
143
## Next steps
145
144
146
-
Learn more about Defender for Cloud's protections for SQL resources in [Overview of Microsoft Defender for SQL](defender-for-sql-introduction.md).
145
+
Learn more about Defender for Cloud's protections for SQL resources in [Overview of Microsoft Defender for SQL](defender-for-sql-introduction.md).
0 commit comments