Cis Azure Foundations 8.1.7.2
DevOps & Securitycis-azure-foundations-8.1.7.2Cis Azure Foundations 8.1.7.2 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On'
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/Microsoft_Azure/CIS_Microsoft_Azure_Foundations_Benchmark_v5.0.0/cis-azure-foundations-8.1.7.2/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-azure-foundations-8-1-7-2, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
8.1.7.2 Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On' (Automated)
Description
Turning on Microsoft Defender for Open-source relational databases enables threat detection for Open-source relational databases, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.
Rationale
Enabling Microsoft Defender for Open-source relational databases allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).
Impact
Turning on Microsoft Defender for Open-source relational databases incurs an additional cost per resource.
Audit Procedure
From Azure Portal:
- Go to
Microsoft Defender for Cloud. - Under
Management, selectEnvironment Settings. - Click on the subscription name.
- Select the
Defender plansblade. - Click
Select types >in the row forDatabases. - Ensure the toggle switch next to
Open-source relational databasesis set toOn.
From Azure CLI:
az security pricing show -n OpenSourceRelationalDatabases --query pricingTier
From PowerShell:
Get-AzSecurityPricing | Where-Object {$_.Name -eq 'OpenSourceRelationalDatabases'} | Select-Object Name, PricingTier
Ensure output for Name PricingTier is OpenSourceRelationalDatabases Standard.
From Azure Policy:
- Policy ID:
0a9fbe0d-c5c4-4da8-87d8-f4fd77338835- Name: 'Azure Defender for open-source relational databases should be enabled'
Expected Result
The pricing tier for OpenSourceRelationalDatabases should be Standard.
Remediation
From Azure Portal:
- Go to
Microsoft Defender for Cloud. - Under
Management, selectEnvironment Settings. - Click on the subscription name.
- Select the
Defender plansblade. - Click
Select types >in the row forDatabases. - Set the toggle switch next to
Open-source relational databasestoOn. - Select
Continue. - Select
Save.
From Azure CLI:
az security pricing create -n 'OpenSourceRelationalDatabases' --tier 'standard'
From PowerShell:
set-azsecuritypricing -name "OpenSourceRelationalDatabases" -pricingtier "Standard"
Default Value
By default, Microsoft Defender plan is off.
References
- https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-overview
- https://learn.microsoft.com/en-us/rest/api/defenderforcloud/pricings/update
- https://learn.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing
Profile
- Level 2