rules/findings/azure/defender/azure-defender-esam-disabled.json
|
{
"provider": "Azure", "serviceType": "Defender for Cloud", "serviceName": "Subscription", "displayName": "Ensure that Microsoft Defender External Attack Surface Monitoring (EASM) is enabled", "description": "An organization\u0027s attack surface is the collection of assets with a public network identifier or URI that an external threat actor can see or access from outside your cloud.\u003Cbr/\u003E\u003Cbr/\u003EIt is the set of points on the boundary of a system, a system element, system component, or an environment where an attacker can try to enter, cause an effect on, or extract data from, that system, system element, system component, or environment.\u003Cbr/\u003E\u003Cbr/\u003EThe larger the attack surface, the harder it is to protect.\u003Cbr/\u003E\u003Cbr/\u003EThis tool can be configured to scan your organization\u0027s online infrastructure such as specified domains, hosts, CIDR blocks, and SSL certificates, and store them in an Inventory. Inventory items can be added, reviewed, approved, and removed, and may contain enrichments (\u0022insights\u0022) and additional information collected from the tool\u0027s different scan engines and open-source intelligence sources.\u003Cbr/\u003E\u003Cbr/\u003EA Defender EASM workspace will generate an Inventory of publicly exposed assets by crawling and scanning the internet using Seeds you provide when setting up the tool.\u003Cbr/\u003E\u003Cbr/\u003ESeeds can be FQDNs, IP CIDR blocks, and WHOIS records.\u003Cbr/\u003E\u003Cbr/\u003EDefender EASM will generate Insights within 24-48 hours after Seeds are provided, and these insights include vulnerability data (CVEs), ports and protocols, and weak or expired SSL certificates that could be used by an attacker for reconnaissance or exploitation.\u003Cbr/\u003E\u003Cbr/\u003EResults are classified High/Medium/Low and some of them include proposed mitigations.", "rationale": "This tool can monitor the externally exposed resources of an organization, provide valuable insights, and export these findings in a variety of formats (including CSV) for use in vulnerability management operations and red/purple team exercises.", "impact": "Microsoft Defender EASM workspaces are currently available as Azure Resources with a 30-day free trial period but can quickly accrue significant charges. The costs are calculated daily as (Number of \u0022billable\u0022 inventory items) x (item cost per day).\u003Cbr/\u003E\u003Cbr/\u003EEstimated cost is not provided within the tool, and users are strongly advised to contact their Microsoft sales representative for pricing and set a calendar reminder for the end of the trial period.\u003Cbr/\u003E\u003Cbr/\u003EIf the workspace is deleted by the last day of a free trial period, no charges are billed.", "remediation": { "text": "Remediate from Azure Portal 1. Go to Microsoft Defender EASM. 2. Click \u002B Create. 3. Under Project details, select a subscription. 4. Select or create a resource group. 5. Under Instance details, enter a name for the workspace. 6. Select a region. 7. Click Review \u002B create. 8. Click Create. 9. Once the deployment has completed, go to Microsoft Defender EASM. 10. Click the workspace name. 11. Configure the workspace appropriately for your environment and organization.", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/external-attack-surface-management/", "https://learn.microsoft.com/en-us/azure/external-attack-surface-management/deploying-the-defender-easm-azure-resource", "https://www.microsoft.com/en-us/security/blog/2022/08/02/microsoft-announces-new-solutions-for-threat-intelligence-and-attack-surface-management/" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "8.1.16", "profile": [ "Level 2" ] } ], "level": "info", "tags": [], "rule": { "path": "", "subPath": null, "selectCondition": {}, "query": [ { "filter": [ { "conditions": [] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": {}, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": {}, "expandObject": null }, "status": { "keyName": [], "message": "", "defaultMessage": null }, "properties": { "resourceName": null, "resourceId": null, "resourceType": null }, "onlyStatus": false } }, "idSuffix": "azure_defender_esam_disabled", "notes": [], "categories": [], "immutableProperties": [], "id": "azure_defender_022" } |