Azure.Defender.Rule.yaml

# Copyright (c) Microsoft Corporation.
# Licensed under the MIT License.

#
# Rules for Microsoft Defender for Cloud
#

#region Rules

---
# Synopsis: Enable Microsoft Defender for Containers.
apiVersion: github.com/microsoft/PSRule/v1
kind: Rule
metadata:
  name: Azure.Defender.Containers
  ref: AZR-000290
  tags:
    release: GA
    ruleSet: 2022_09
    Azure.WAF/pillar: Security
  labels:
    Azure.MCSB.v1/control: LT-1
spec:
  level: Error
  where:
    name: '.'
    equals: Containers
  type:
  - Microsoft.Security/pricings
  condition:
    field: properties.pricingTier
    equals: Standard

---
# Synopsis: Consider enabling Defender for Servers
apiVersion: github.com/microsoft/PSRule/v1
kind: Rule
metadata:
  name: Azure.Defender.Servers
  ref: AZR-000293
  tags:
    release: GA
    ruleSet: 2022_09
    Azure.WAF/pillar: Security
  labels:
    Azure.MCSB.v1/control: LT-1
spec:
  level: Error
  where:
    name: '.'
    equals: VirtualMachines
  type:
  - Microsoft.Security/pricings
  condition:
    allOf:
      - field: properties.pricingTier
        equals: Standard
      - field: properties.subPlan
        equals: P2

---
# Synopsis: Consider enabling Defender for SQL
apiVersion: github.com/microsoft/PSRule/v1
kind: Rule
metadata:
  name: Azure.Defender.SQL
  ref: AZR-000294
  tags:
    release: GA
    ruleSet: 2022_09
    Azure.WAF/pillar: Security
  labels:
    Azure.MCSB.v1/control: [ 'DP-2', 'LT-1' ]
spec:
  level: Error
  where:
    name: '.'
    equals: SqlServers
  type:
  - Microsoft.Security/pricings
  condition:
    field: properties.pricingTier
    equals: Standard

---
# Synopsis: Consider enabling Defender for App Service
apiVersion: github.com/microsoft/PSRule/v1
kind: Rule
metadata:
  name: Azure.Defender.AppServices
  ref: AZR-000295
  tags:
    release: GA
    ruleSet: 2022_09
    Azure.WAF/pillar: Security
  labels:
    Azure.MCSB.v1/control: LT-1
spec:
  level: Error
  where:
    name: '.'
    equals: AppServices
  type:
  - Microsoft.Security/pricings
  condition:
    field: properties.pricingTier
    equals: Standard

---
# Synopsis: Enable Microsoft Defender for Storage.
apiVersion: github.com/microsoft/PSRule/v1
kind: Rule
metadata:
  name: Azure.Defender.Storage
  ref: AZR-000296
  tags:
    release: GA
    ruleSet: 2023_06
    Azure.WAF/pillar: Security
  labels:
    Azure.MCSB.v1/control: [ 'DP-2', 'LT-1' ]
spec:
  level: Error
  where:
    name: '.'
    equals: StorageAccounts
  type:
  - Microsoft.Security/pricings
  condition:
     allOf:
      - field: properties.pricingTier
        equals: Standard
      - field: properties.subPlan
        equals: DefenderForStorageV2

---
# Synopsis: Enable Microsoft Defender for SQL servers on machines.
apiVersion: github.com/microsoft/PSRule/v1
kind: Rule
metadata:
  name: Azure.Defender.SQLOnVM
  ref: AZR-000297
  tags:
    release: GA
    ruleSet: 2022_09
    Azure.WAF/pillar: Security
  labels:
    Azure.MCSB.v1/control: LT-1
spec:
  level: Error
  where:
    name: '.'
    equals: SqlServerVirtualMachines
  type:
  - Microsoft.Security/pricings
  condition:
    field: properties.pricingTier
    equals: Standard

---
# Synopsis: Enable Microsoft Defender for Key Vault.
apiVersion: github.com/microsoft/PSRule/v1
kind: Rule
metadata:
  name: Azure.Defender.KeyVault
  ref: AZR-000352
  tags:
    release: GA
    ruleSet: 2023_03
    Azure.WAF/pillar: Security
  labels:
    Azure.MCSB.v1/control: LT-1
spec:
  level: Error
  where:
    name: '.'
    equals: KeyVaults
  type:
  - Microsoft.Security/pricings
  condition:
    field: properties.pricingTier
    equals: Standard

---
# Synopsis: Enable Microsoft Defender for DNS.
apiVersion: github.com/microsoft/PSRule/v1
kind: Rule
metadata:
  name: Azure.Defender.Dns
  ref: AZR-000353
  tags:
    release: GA
    ruleSet: 2023_03
    Azure.WAF/pillar: Security
  labels:
    Azure.MCSB.v1/control: LT-1
spec:
  level: Error
  where:
    name: '.'
    equals: Dns
  type:
  - Microsoft.Security/pricings
  condition:
    field: properties.pricingTier
    equals: Standard

---
# Synopsis: Enable Microsoft Defender for Azure Resource Manager (ARM).
apiVersion: github.com/microsoft/PSRule/v1
kind: Rule
metadata:
  name: Azure.Defender.Arm
  ref: AZR-000354
  tags:
    release: GA
    ruleSet: 2023_03
    Azure.WAF/pillar: Security
  labels:
    Azure.MCSB.v1/control: LT-1
spec:
  level: Error
  where:
    name: '.'
    equals: Arm
  type:
  - Microsoft.Security/pricings
  condition:
    field: properties.pricingTier
    equals: Standard

---
# Synopsis: Enable Microsoft Defender Cloud Security Posture Management Standard plan.
apiVersion: github.com/microsoft/PSRule/v1
kind: Rule
metadata:
  name: Azure.Defender.Cspm
  ref: AZR-000372
  tags:
    release: GA
    ruleSet: 2023_06
    Azure.WAF/pillar: Security
  labels:
    Azure.MCSB.v1/control: LT-1
spec:
  level: Error
  where:
    name: '.'
    equals: CloudPosture
  type:
  - Microsoft.Security/pricings
  condition:
    field: properties.pricingTier
    equals: Standard

---
# Synopsis: Enable Microsoft Defender for APIs.
apiVersion: github.com/microsoft/PSRule/v1
kind: Rule
metadata:
  name: Azure.Defender.Api
  ref: AZR-000377
  tags:
    release: GA
    ruleSet: 2023_12
    Azure.WAF/pillar: Security
  labels:
    Azure.MCSB.v1/control: LT-1
spec:
  level: Error
  where:
    name: '.'
    equals: Api
  type:
  - Microsoft.Security/pricings
  condition:
    allOf:
      - field: properties.pricingTier
        equals: Standard
      - field: properties.subPlan
        hasValue: true

---
# Synopsis: Enable Microsoft Defender for Azure Cosmos DB.
apiVersion: github.com/microsoft/PSRule/v1
kind: Rule
metadata:
  name: Azure.Defender.CosmosDb
  ref: AZR-000379
  tags:
    release: GA
    ruleSet: 2023_06
    Azure.WAF/pillar: Security
  labels:
    Azure.MCSB.v1/control: [ 'DP-2', 'LT-1' ]
spec:
  level: Error
  where:
    name: '.'
    equals: CosmosDbs
  type:
  - Microsoft.Security/pricings
  condition:
    field: properties.pricingTier
    equals: Standard

---
# Synopsis: Enable Microsoft Defender for open-source relational databases.
apiVersion: github.com/microsoft/PSRule/v1
kind: Rule
metadata:
  name: Azure.Defender.OssRdb
  ref: AZR-000381
  tags:
    release: GA
    ruleSet: 2023_06
    Azure.WAF/pillar: Security
  labels:
    Azure.MCSB.v1/control: LT-1
spec:
  level: Error
  where:
    name: '.'
    equals: OpenSourceRelationalDatabases
  type:
  - Microsoft.Security/pricings
  condition:
    field: properties.pricingTier
    equals: Standard

#endregion Rules