You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -3,217 +3,57 @@ title: Manage AWS assessments and standards
3
3
titleSuffix: Defender for Cloud
4
4
description: Learn how to create custom security assessments and standards for your AWS environment.
5
5
ms.topic: how-to
6
-
ms.date: 02/07/2023
6
+
ms.date: 03/09/2023
7
7
---
8
8
9
9
# Manage AWS assessments and standards
10
10
11
-
Security standards contain comprehensive sets of security recommendations to help secure your cloud environments. Security teams can use the readily available standards such as AWS CIS 1.2.0, AWS CIS 1.5.0, AWS Foundational Security Best Practices, and AWS PCI DSS 3.2.1, or create custom standards to meet specific internal requirements.
11
+
Security standards contain comprehensive sets of security recommendations to help secure your cloud environments. Security teams can use the readily available standards such as AWS CIS 1.2.0, AWS CIS 1.5.0, AWS Foundational Security Best Practices, and AWS PCI DSS 3.2.1.
12
12
13
-
There are three types of resources that are needed to create and manage assessments:
13
+
There are two types of resources that are needed to create and manage assessments:
14
14
15
-
- Assessment:
16
-
- assessment details such as name, description, severity, remediation logic, etc.
17
-
- assessment logic in KQL
18
-
- the standard it belongs to
19
15
- Standard: defines a set of assessments
20
-
- Standard assignment: defines the scope, which the standard will evaluate. For example, specific AWS account(s).
16
+
- Standard assignment: defines the scope, which the standard evaluates. For example, specific AWS account(s).
21
17
22
-
You can either use the built-in regulatory compliance standards or create your own custom standards.
18
+
## Create a custom compliance standard to your AWS account
23
19
24
-
## Assign a built-in compliance standard to your AWS account
25
-
26
-
**To assign a built-in compliance standard to your AWS account**:
20
+
**To create a custom compliance standard to your AWS account**:
27
21
28
22
1. Sign in to the [Azure portal](https://portal.azure.com/).
29
23
30
24
1. Navigate to **Microsoft Defender for Cloud** > **Environment settings**.
:::image type="content" source="media/how-to-manage-assessments-standards/aws-add-standard.png" alt-text="Screenshot that shows you where to navigate to in order to add an AWS standard." lightbox="media/how-to-manage-assessments-standards/aws-add-standard-zoom.png":::
37
31
38
-
1. Select a built-in standard from the drop-down menu.
32
+
1. Enter a name, description and select built-in recommendations from the drop-down menu.
33
+
34
+
:::image type="content" source="media/how-to-manage-assessments-standards/create-standard-aws.png" alt-text="Screenshot of the Create new standard window.":::
39
35
40
-
1. Select **Save**.
36
+
1. Select **Create**.
41
37
42
-
## Create a new custom standard for your AWS account
38
+
## Assign a built-in compliance standard to your AWS account
43
39
44
-
**To create a new custom standard for your AWS account**:
40
+
**To assign a built-in compliance standard to your AWS account**:
45
41
46
42
1. Sign in to the [Azure portal](https://portal.azure.com/).
47
43
48
44
1. Navigate to **Microsoft Defender for Cloud** > **Environment settings**.
:::image type="content" source="media/how-to-manage-assessments-standards/new-aws-standard.png" alt-text="Screenshot that shows you where to select a new AWS standard." lightbox="media/how-to-manage-assessments-standards/new-aws-standard.png":::
48
+
1. Select **Standards**.
57
49
58
-
1.Enter a name, description and select which assessments you want to add.
50
+
1.Select the **three dot button** for the built-in standard you want to assign.
59
51
60
-
1. Select **Save**.
52
+
:::image type="content" source="media/how-to-manage-assessments-standards/aws-built-in.png" alt-text="Screenshot that shows where the three dot button is located on the screen." lightbox="media/how-to-manage-assessments-standards/aws-built-in.png":::
61
53
62
-
## Assign a built-in assessment to your AWS account
63
-
64
-
**To assign a built-in assessment to your AWS account**:
65
-
66
-
1. Sign in to the [Azure portal](https://portal.azure.com/).
67
-
68
-
1. Navigate to **Microsoft Defender for Cloud** > **Environment settings**.
:::image type="content" source="media/how-to-manage-assessments-standards/aws-assessment.png" alt-text="Screenshot that shows where to navigate to, to select an AWS assessment." lightbox="media/how-to-manage-assessments-standards/aws-assessment.png":::
75
-
76
-
1. Select **Existing assessment**.
77
-
78
-
1. Select all relevant assessments from the drop-down menu.
79
-
80
-
1. Select the standards from the drop-down menu.
81
-
82
-
1. Select **Save**.
83
-
84
-
## How to build a query
85
-
86
-
The last row of the query should return all the original columns (don’t use ‘project’, ‘project-away'). End the query with an iff statement that defines the healthy or unhealthy conditions: `| extend HealthStatus = iff([boolean-logic-here], 'UNHEALTHY','HEALTHY')`.
87
-
88
-
### Sample KQL queries
89
-
90
-
When building a KQL query, you should use the following table structure:
> The `Record` field contains the data structure as it is returned from the AWS API. Use this field to define conditions which will determine if the resource is healthy or unhealthy.
183
-
>
184
-
> You can access internal properties of `Record` filed using a dot notation. For example: `| extend EncryptionType = Record.Encryption.Type`.
185
-
186
-
**Stopped EC2 instances should be removed after a specified time period**
187
-
188
-
```kusto
189
-
EC2_Instance
190
-
| extend State = tolower(tostring(Record.State.Name.Value))
Copy file name to clipboardExpand all lines: articles/defender-for-cloud/how-to-manage-gcp-assessments-standards.md
+17-85Lines changed: 17 additions & 85 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,128 +1,60 @@
1
1
---
2
2
title: Manage GCP assessments and standards
3
3
titleSuffix: Defender for Cloud
4
-
description: Learn how to create custom security assessments and standards for your GCP environment.
4
+
description: Learn how to create standards for your GCP environment.
5
5
ms.topic: how-to
6
-
ms.date: 01/24/2023
6
+
ms.date: 03/08/2023
7
7
---
8
8
9
9
# Manage GCP assessments and standards
10
10
11
11
Security standards contain comprehensive sets of security recommendations to help secure your cloud environments. Security teams can use the readily available regulatory standards such as GCP CIS 1.1.0, GCP CIS and 1.2.0, or create custom standards to meet specific internal requirements.
12
12
13
-
There are three types of resources that are needed to create and manage assessments:
13
+
There are two types of resources that are needed to create and manage standards:
14
14
15
-
- Assessment:
16
-
- assessment details such as name, description, severity, remediation logic, etc.
17
-
- assessment logic in KQL
18
-
- the standard it belongs to
19
15
- Standard: defines a set of assessments
20
-
- Standard assignment: defines the scope, which the standard will evaluate. For example, specific GCP projects.
16
+
- Standard assignment: defines the scope, which the standard evaluates. For example, specific GCP projects.
21
17
22
-
You can either use the built-in compliance standards or create your own custom standards or built-in assessments.
18
+
## Create a custom compliance standard to your GCP project
23
19
24
-
## Assign a built-in compliance standard to your GCP project
25
-
26
-
**To assign a built-in compliance standard to your GCP project**:
20
+
**To create a custom compliance standard to your GCP project**:
27
21
28
22
1. Sign in to the [Azure portal](https://portal.azure.com/).
29
23
30
24
1. Navigate to **Microsoft Defender for Cloud** > **Environment settings**.
:::image type="content" source="media/how-to-manage-assessments-standards/gcp-standard.png" alt-text="Screenshot that shows you where to navigate to, to add a GCP standard." lightbox="media/how-to-manage-assessments-standards/gcp-standard-zoom.png":::
37
31
38
-
1.Select a built-in standard from the drop-down menu.
32
+
1.Enter a name, description and select built-in recommendations from the drop-down menu.
39
33
40
34
:::image type="content" source="media/how-to-manage-assessments-standards/drop-down-menu.png" alt-text="Screenshot that shows you the standard options you can choose from the drop-down menu." lightbox="media/how-to-manage-assessments-standards/drop-down-menu.png":::
41
35
42
-
1. Select **Save**.
43
-
44
-
## Create a new custom standard for your GCP project
45
-
46
-
**To create a new custom standard for your GCP project**:
47
-
48
-
1. Sign in to the [Azure portal](https://portal.azure.com/).
49
-
50
-
1. Navigate to **Microsoft Defender for Cloud** > **Environment settings**.
51
-
52
-
1. Select the relevant GCP project.
53
-
54
-
1. Select **Standards** > **Add** > **Standard**.
55
-
56
-
1. Select **New standard**.
57
-
58
-
1. Enter a name, description and select which assessments you want to add.
59
-
60
-
1. Select **Save**.
36
+
1. Select **Create**.
61
37
62
-
## Assign a built-in assessment to your GCP project
38
+
## Assign a built-in compliance standard to your GCP project
63
39
64
-
**To assign a built-in assessment to your GCP project**:
40
+
**To assign a built-in compliance standard to your GCP project**:
65
41
66
42
1. Sign in to the [Azure portal](https://portal.azure.com/).
67
43
68
44
1. Navigate to **Microsoft Defender for Cloud** > **Environment settings**.
:::image type="content" source="media/how-to-manage-assessments-standards/gcp-assessment.png" alt-text="Screenshot that shows where to navigate to, to select GCP assessment." lightbox="media/how-to-manage-assessments-standards/gcp-assessment.png":::
75
-
76
-
1. Select **Existing assessment**.
77
-
78
-
1. Select all relevant assessments from the drop-down menu.
79
-
80
-
1. Select the standards from the drop-down menu.
81
-
82
-
1. Select **Save**.
83
-
84
-
## How to build a query
85
-
86
-
The last row of the query should return all the original columns (don’t use ‘project’, ‘project-away). End the query with an iff statement that defines the healthy or unhealthy conditions: `| extend HealthStatus = iff([boolean-logic-here], 'UNHEALTHY','HEALTHY')`.
87
-
88
-
### Sample KQL queries
89
-
90
-
**Ensure that Cloud Storage buckets have uniform bucket-level access enabled**
91
-
92
-
```kusto
93
-
let UnhealthyBuckets = Storage_Bucket
94
-
| extend RetentionPolicy = Record.retentionPolicy
95
-
| where isnull(RetentionPolicy) or isnull(RetentionPolicy.isLocked) or tobool(RetentionPolicy.isLocked)==false
:::image type="content" source="media/how-to-manage-assessments-standards/gcp-built-in.png" alt-text="Screenshot that shows where the three dot button is located on the screen." lightbox="media/how-to-manage-assessments-standards/gcp-built-in.png":::
120
53
121
-
You can use the following links to learn more about Kusto queries:
0 commit comments