2.2 Ensure that Azure Defender is set to On for App Service

Information

Turning on Azure Defender enables threat detection for App Service, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center.

Rationale:

Enabling Azure Defender for App Service allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).

Impact:

Turning on Azure Defender in Azure Security Center incurs an additional cost per resource.

Solution

From Azure Console

Go to Security Center

Select Pricing & settings blade

Click on the subscription name

Select the Azure Defender plans blade

On the line in the table for App Service Select On under Plan.

Select 'Save

Using Azure Command Line Interface 2.0
Use the below command to enable Standard pricing tier for App Service

az account get-access-token --query '{subscription:subscription,accessToken:accessToken}' --out tsv | xargs -L1 bash -c 'curl -X PUT -H 'Authorization: Bearer $1' -H 'Content-Type: application/json' https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/pricings/AppServices?api-version=2018-06-01 [email protected]'input.json''

Where input.json contains the Request body json data as mentioned below.

{
'id': '/subscriptions/<Your_Subscription_Id>/providers/Microsoft.Security/pricings/AppServices',
'name': 'AppServices',
'type': 'Microsoft.Security/pricings',
'properties': {
'pricingTier': 'Standard'
}
}

Default Value:

By default, Azure Defender off is selected.

See Also

https://workbench.cisecurity.org/files/3459

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-3, CSCv7|8

Plugin: microsoft_azure

Control ID: 1f9611b4d9bb12ee6dac911011f60f89ec8a20c41efbc8ed0753b3e4e065f5f5