# Cis Azure Foundations 8.1.5.1

> Cis Azure Foundations 8.1.5.1 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure That Microsoft Defender for Storage Is Set To 'On'

- Skill name: `cis-azure-foundations-8.1.5.1`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/Microsoft_Azure/CIS_Microsoft_Azure_Foundations_Benchmark_v5.0.0/cis-azure-foundations-8.1.5.1/SKILL.md
- Repository: CyberStrikeus/CyberStrike (1,211 GitHub stars when collected)

## SKILL.md

# 8.1.5.1 Ensure That Microsoft Defender for Storage Is Set To 'On' (Automated)

## Description

Turning on Microsoft Defender for Storage enables threat detection for Storage, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.

## Rationale

Enabling Microsoft Defender for Storage allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).

## Impact

Turning on Microsoft Defender for Storage incurs an additional cost per resource.

## Audit Procedure

**From Azure Portal:**

1. Go to `Microsoft Defender for Cloud`.
2. Under `Management`, select `Environment Settings`.
3. Click on the subscription name.
4. Select the `Defender plans` blade.
5. Ensure `Status` is set to `On` for `Storage`.

**From Azure CLI:**

```
az security pricing show -n StorageAccounts
```

Ensure the output is `Standard`.

**From PowerShell:**

```
Get-AzSecurityPricing -Name 'StorageAccounts' | Select-Object Name,PricingTier
```

Ensure output for `Name PricingTier` is `StorageAccounts Standard`.

**From Azure Policy:**

- Policy ID: `640d2586-54d2-465f-877f-9ffc1d2109f4` - Name: 'Microsoft Defender for Storage should be enabled'

## Expected Result

The pricing tier for StorageAccounts should be `Standard`.

## Remediation

**From Azure Portal:**

1. Go to `Microsoft Defender for Cloud`.
2. Under `Management`, select `Environment Settings`.
3. Click on the subscription name.
4. Select the `Defender plans` blade.
5. Set `Status` to `On` for `Storage`.
6. Select `Save`.

**From Azure CLI:**

```
az security pricing create -n StorageAccounts --tier 'standard'
```

**From PowerShell:**

```
Set-AzSecurityPricing -Name 'StorageAccounts' -PricingTier 'Standard'
```

## Default Value

By default, Microsoft Defender plan is off.

## References

1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-overview
2. https://learn.microsoft.com/en-us/rest/api/defenderforcloud/pricings/list
3. https://learn.microsoft.com/en-us/rest/api/defenderforcloud/pricings/update
4. https://learn.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing

## Profile

- Level 2

---

Source: https://www.openparable.com/skill/devops-security/cis-azure-foundations-8-1-5-1 (OpenParable). Cite the canonical URL above.