You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/defender-for-cloud/how-to-manage-aws-assessments-standards.md
+6-186Lines changed: 6 additions & 186 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,24 +3,18 @@ title: Manage AWS assessments and standards
3
3
titleSuffix: Defender for Cloud
4
4
description: Learn how to create custom security assessments and standards for your AWS environment.
5
5
ms.topic: how-to
6
-
ms.date: 02/07/2023
6
+
ms.date: 03/08/2023
7
7
---
8
8
9
9
# Manage AWS assessments and standards
10
10
11
-
Security standards contain comprehensive sets of security recommendations to help secure your cloud environments. Security teams can use the readily available standards such as AWS CIS 1.2.0, AWS CIS 1.5.0, AWS Foundational Security Best Practices, and AWS PCI DSS 3.2.1, or create custom standards to meet specific internal requirements.
11
+
Security standards contain comprehensive sets of security recommendations to help secure your cloud environments. Security teams can use the readily available standards such as AWS CIS 1.2.0, AWS CIS 1.5.0, AWS Foundational Security Best Practices, and AWS PCI DSS 3.2.1.
12
12
13
13
There are three types of resources that are needed to create and manage assessments:
14
14
15
-
- Assessment:
16
-
- assessment details such as name, description, severity, remediation logic, etc.
17
-
- assessment logic in KQL
18
-
- the standard it belongs to
19
15
- Standard: defines a set of assessments
20
16
- Standard assignment: defines the scope, which the standard will evaluate. For example, specific AWS account(s).
21
17
22
-
You can either use the built-in regulatory compliance standards or create your own custom standards.
23
-
24
18
## Assign a built-in compliance standard to your AWS account
25
19
26
20
**To assign a built-in compliance standard to your AWS account**:
@@ -31,189 +25,15 @@ You can either use the built-in regulatory compliance standards or create your o
:::image type="content" source="media/how-to-manage-assessments-standards/aws-add-standard.png" alt-text="Screenshot that shows you where to navigate to in order to add an AWS standard." lightbox="media/how-to-manage-assessments-standards/aws-add-standard-zoom.png":::
37
31
38
-
1. Select a built-in standard from the drop-down menu.
39
-
40
-
1. Select **Save**.
41
-
42
-
## Create a new custom standard for your AWS account
43
-
44
-
**To create a new custom standard for your AWS account**:
45
-
46
-
1. Sign in to the [Azure portal](https://portal.azure.com/).
47
-
48
-
1. Navigate to **Microsoft Defender for Cloud** > **Environment settings**.
1. Enter a name, description and select built-in recommendations from the menu.
53
33
54
-
1. Select **New standard**.
55
-
56
-
:::image type="content" source="media/how-to-manage-assessments-standards/new-aws-standard.png" alt-text="Screenshot that shows you where to select a new AWS standard." lightbox="media/how-to-manage-assessments-standards/new-aws-standard.png":::
57
-
58
-
1. Enter a name, description and select which assessments you want to add.
59
-
60
-
1. Select **Save**.
61
-
62
-
## Assign a built-in assessment to your AWS account
63
-
64
-
**To assign a built-in assessment to your AWS account**:
65
-
66
-
1. Sign in to the [Azure portal](https://portal.azure.com/).
67
-
68
-
1. Navigate to **Microsoft Defender for Cloud** > **Environment settings**.
69
-
70
-
1. Select the relevant AWS account.
34
+
:::image type="content" source="media/how-to-manage-assessments-standards/create-standard-aws.png" alt-text="Screenshot of the create new standard window.":::
:::image type="content" source="media/how-to-manage-assessments-standards/aws-assessment.png" alt-text="Screenshot that shows where to navigate to, to select an AWS assessment." lightbox="media/how-to-manage-assessments-standards/aws-assessment.png":::
75
-
76
-
1. Select **Existing assessment**.
77
-
78
-
1. Select all relevant assessments from the drop-down menu.
79
-
80
-
1. Select the standards from the drop-down menu.
81
-
82
-
1. Select **Save**.
83
-
84
-
## How to build a query
85
-
86
-
The last row of the query should return all the original columns (don’t use ‘project’, ‘project-away'). End the query with an iff statement that defines the healthy or unhealthy conditions: `| extend HealthStatus = iff([boolean-logic-here], 'UNHEALTHY','HEALTHY')`.
87
-
88
-
### Sample KQL queries
89
-
90
-
When building a KQL query, you should use the following table structure:
> The `Record` field contains the data structure as it is returned from the AWS API. Use this field to define conditions which will determine if the resource is healthy or unhealthy.
183
-
>
184
-
> You can access internal properties of `Record` filed using a dot notation. For example: `| extend EncryptionType = Record.Encryption.Type`.
185
-
186
-
**Stopped EC2 instances should be removed after a specified time period**
187
-
188
-
```kusto
189
-
EC2_Instance
190
-
| extend State = tolower(tostring(Record.State.Name.Value))
0 commit comments