Member: Tom_Janetscheck | Microsoft Community Hub

Recent Discussions

Re: Exporting list of all vulnerabilities per machine
Hi guiqueiroz in Azure Security Center, with the Qualys VA integration you get when enabling Azure Defender for Servers, you can export VA findings as nested recommendations using our Continuous Export capability. However, you are mentioning Microsoft Defender for Endpoints (formerly known as MDATP) which is a different product with a different scope. For Microsoft Defender for Endpoints related questions, please refer to this forum. Best regards, Tom Janetscheck Senior Program Manager CxE | Azure Security Center
Nov 25, 2020 Place Microsoft Defender for Cloud
2.6KViews
0likes
0Comments
Re: Missing "Disk encryption should be applied on virtual machines" recommendations
Hi davemills, the recommendation you're mentioning has not been removed from ASC, as you can see in a current screenshot below. If you do not see it in your environment, someone might have disabled the corresponding policy in Azure Security Center. Best regards, Tom Janetscheck Senior Program Manager CxE | Azure Security Center
Nov 25, 2020 Place Microsoft Defender for Cloud
1.3KViews
0likes
1Comment
Re: How do I get 50 Azure Defender to protect windows servers on premise?
HPUbooker I think we need to clarify the wording: Azure Defender is the Cloud Workload Protection Platform (CWPP) built into Azure Security Center, whereas you seem to be referring to our antimalware solution (SCEP/Microsoft Antimalware/Microsoft Defender Antivirus). Antimalware for Azure VMs is part of Azure Security Center without additional cost. For on-prem servers, you will need to onboard them to Azure Defender. Best, Tom Janetscheck Senior Program Manager CxE | Azure Security Center
Oct 07, 2020 Place Microsoft Defender for Cloud
3.9KViews
0likes
2Comments
Re: How do I get 50 Azure Defender to protect windows servers on premise?
HPUbooker Hi Eulogio, Azure Defender for Servers is paid on a per node/per hour basis (currently $0.02 or €0.017 per server and per hour). There is no flat fee for onprem servers, and charges apply when a server is running, only. More details can be found in the pricing calculator. Features that are covered with Azure Defender on Windows servers are listed here. Best regards, Tom Janetscheck Senior Program Manager CxE | Azure Security Center
Oct 05, 2020 Place Microsoft Defender for Cloud
4KViews
0likes
4Comments
Re: Did I just stumble on a hidden gem?
Hi -Akos-, Endpoint Protection assessments (including SCEP/Microsoft Antimalware) for Azure resources are part of Azure Security Center without Azure Defender. More information about what features are included in ASC with and without Azure Defender can be found here. Best regards, Tom Janetscheck Senior Program Manager CxE | Azure Security Center
Oct 05, 2020 Place Microsoft Defender for Cloud
1.2KViews
0likes
1Comment
Re: ASC Security Policies & Compliance Wording
Erik_Snijder Hello Erik, thanks for asking. I'm glad you like this thread and the Secure Score feature. Regarding your questions: That's correct. As mentioned above, Regulatory Compliance standards are another view on existing (and additional) recommendations. The default set of recommendations and the compliance standards technically consist of Azure Policy Initiatives, that share a common set of policies. If you already see a recommendation that is also part of the Compliance Standard you activate additionally, the same policy is used and, therefore, no second recommendation is added. Yes, the Regulatory Compliance Standards API contains the number of passed, failed, and not applicable controls: I have published an automation artifact in our GitHub community, which will send a weekly compliance report per subscription by email. The email will contain the information gathered from the above mentioned API. Maybe you can use parts of this Playbook for your scenario? As long as you are using the builtin Policy Initiatives, they are automatically maintained. Have a great weekend and best regards, Tom Janetscheck Senior Program Manager CxE | Azure Security Center
Sep 11, 2020 Place Microsoft Defender for Cloud
14KViews
0likes
0Comments
Re: Deploying partner vulnerability scanners to virtual machines
Hello Sahitya95 we're currently working on providing a script that will enable you to attach the BYOL VA solution to existing VMs. Once it's finished, it will be published in our Azure Security Center GitHub. As a short cut, the REST API call to attach the VA solution to existing VMs is PUT https://management.azure.com/subscriptions/{SubscriptionId}/resourceGroups/{RG}/providers/Microsoft.Security/locations/{subscriptionLocation}/securitySolutions/{SolutionName}/protectedResources?{apiVersion } Best regards, Tom Janetscheck Senior Program Manager CxE | Azure Security Center
Sep 08, 2020 Place Microsoft Defender for Cloud
1.1KViews
0likes
0Comments
Re: Windows Server 2019 not supported for Windows Defender ATP ?
Hi PatrikHansson, You can find that information in the documentation about ASC/MDATP integration at https://docs.microsoft.com/en-us/azure/security-center/security-center-wdatp#platform-support. Best regards Tom Janetscheck Senior Program Manager CxE | Azure Security Center
Sep 08, 2020 Place Microsoft Defender for Cloud
9.3KViews
1like
1Comment
Re: Verify that Endpoint Protection on VM's are reporting.
Hi PatrikHansson , Azure Security Center will scan your VMs for an existing Endpoint Protection Solution and will also inform you in case there are health issues with the solution. We have explained the respective Security Control with all recommendations in one of our latest articles. The link you've mentioned refers to the Microsoft Defender Security Center. If you have enabled ASC/MDATP integration, all VMs that are monitored in ASC are automatically onboarded to MDATP (only for supported operating systems as defined in our documentation). Best regards, Tom Janetscheck Senior Program Manager CxE | Azure Security Center
Sep 08, 2020 Place Microsoft Defender for Cloud
1.5KViews
0likes
0Comments
Re: Automatically update newly released built-in policies
Hello gh91, there is no auto-notification option, but you'll find new policies mentioned in the Azure Security Center release notes, which are regularly updated every month. Best regards, Tom
Aug 24, 2020 Place Microsoft Defender for Cloud
2.6KViews
0likes
1Comment
Re: Automatically update newly released built-in policies
Hi gh91, if you are referring to the builtin policy initiative, Azure Security Center is using, then the answer is yes. The builtin (default) ASC policy initiative will automatically be updated with additional policies once they are published. If you are using a custom policy initiative, there are two different scenarios: if you are using builtin security policies in your custom initiative, these policies will also automatically be updated once there is a change. However, we will not update your policy initiative by adding additional policies once they are released. if you are exclusively using custom policies in your custom initiative, these policies will not automatically be updated. Best regards, Tom Janetscheck Senior Program Manager CxE | Azure Security Center
Aug 24, 2020 Place Microsoft Defender for Cloud
2.6KViews
0likes
3Comments
Re: ASC Security Policies & Compliance Wording
Hey marekatai, I'm not sure if I could entirely follow your argumentation, but let me try to divide and explain the different parts. Security Recommendations, which are part of Security Controls, and Regulatory Compliance are two different parts of the product. Security Controls combine Security Recommendations that belong together and influence your environment's Secure Score. These recommendations are based on the Security Policy Initiative, which you can customise. As you said, today you can only switch a security policy in this initiative on and off, but we are currently working on a resource exemption capability (no ETA, yet). It is correct that switching off a security policy in the security initiative will not influence the recommendations within the regulatory compliance policies, because they rely on separate compliance policies. Why is that? In the regulatory compliance part of the product, we take standard definitions like ISO27001, SOC TSP, or HITRUST/HIPAA and map their regulations to assessments that will then show you how compliant your Azure environment is in regards of these standards. If you decide that for your environment, you want to switch off some of the recommendations in the resource security hygiene part, than this is okay and you can do it - but from a compliance perspective, your environment then might never be compliant regarding a particular compliance policy. Let me give you an example: You might decide, to switch off the recommendation External accounts with owner permissions should be removed from your subscription. You can do it with a Custom Security Policy, so you don't need to take care of it when remediating recommendations. But what if your company needs to comply to the SOC TSP compliance standard? This compliance standard contains section C1.2: Confidential information within the boundaries of the system is protected against unauthorized access, use, and disclosure during input, processing, retention, output, and disposition in accordance with confidentiality commitments and requirements. And part of this compliance standard is the above mentioned assessment. So, if you'd switch it off because you decide you cannot remove external accounts with owner permissions and take the risk which is associated with it, your environment would never be compliant regarding this particular compliance standard. This is why you cannot switch off parts of compliance policies. In this example, in order to comply to SOC TSP, you would have to disable external ownership and think of a different process. I don't think that this leads to false positives. First of all, Secure Score is not part of Regulatory Compliance, but of resource security hygiene. That said, we don't score your achievements in the Regulatory Compliance towards the Secure Score, because it is a different idea behind. Of course, if you get your environment "green" regarding a particular compliance standard, your Secure Score might also have increased, because, at the same time, you'll have remediated some entire Security Controls when taking care of getting your environment compliant. But the main idea behind Regulatory Compliance in Azure Security Center is to give you an easy view on separate compliance rules and what assessments need to be remediated. Again, if you want to customise your Security Policy, you can do it. But compliance standards are not customisable because they simply demand several enforcements. It is not a false positive because the assessments belong to the standards. And your Secure Score will not decrease, but increase, once you switch off particular Security Controls or Recommendations. I hope this helps and clarifies it a bit more. Best regards, Tom Janetscheck Senior Program Manager CxE | Azure Security Center
Aug 21, 2020 Place Microsoft Defender for Cloud
14KViews
0likes
2Comments
Re: Confuguring Partner vulnerability solution
Thanks, Sahitya95 for bringing this up. We have an open GitHub issue for the automation artifact you're mentioning. You can track the status at https://github.com/Azure/Azure-Security-Center/issues/183. Best regards, Tom
Aug 19, 2020 Place Microsoft Defender for Cloud
1.3KViews
0likes
0Comments
Re: ASC Security Policies & Compliance Wording
Hey GlavniArhivator, they are grouped as vulnerabilities under the Vulnerabilities in security configuration on your machines should be remediated recommendation, which is part of the above mentioned security control. Best, Tom
Aug 07, 2020 Place Microsoft Defender for Cloud
14KViews
0likes
0Comments
Re: ASC Security Policies & Compliance Wording
Hi GlavniArhivator, you find it in the Resource Security Hygiene part of Azure Security Center: Best regards, Tom
Aug 07, 2020 Place Microsoft Defender for Cloud
14KViews
0likes
2Comments
Re: ASC Security Policies & Compliance Wording
Hi GlavniArhivator, it's all about the details Regarding your follow-up questions: The recommendations you see in the Resource Security Hygiene part of ASC, and which influence your secure score, are derived from several sources, benchmarks, and best practices. That said, if they apply to the CIS1.1.0 benchmark, they will also appear there. I currently don't have insights into what baselines are the source of AZ-500, but in the end, the learnings from this exam also reflect real-life best-practices (such as make sure your accounts are protected with MFA, NSGs are important for network security, and so on). You understand this correctly. Furthermore, if you take a look at the Azure Policy Initiative itself, you might see policies which appear as having non-compliant resources, but in ASC they are not shown. This is because ASC uses some other backend mechanisms besides Azure Policy only. For example, if a recommendation does not apply to a third-party firewall appliance which basically is a Linux VM, the Policy might say that this resource is non-compliant, whereas ASC will tell you that the recommendation does not apply to that resource. So, for your security policy, you should always look to ASC instead of the respective Azure Policy Initiative. Regarding the second part of your question: this is something many customers are asking for and this is why I've published a dedicated article to describe how Secure Score affects governance concepts. I would highly recommend to not only remediate security controls, but at the same time, to make sure you either have Deny or DINE (Deploy if not exists) policies or Azure Blueprints in place that will make sure your future resources are deployed secure by default, or to change your deployment pipeline (ARM templates, PowerShell scripts, Terraform templates,...) accordingly. You should make sure to have policies and deployment scripts in sync, not to create conflicts during deployment. We're currently working on a capability like this, but there's no ETA, yet. I hope, this helps? Thanks and best, Tom
Aug 06, 2020 Place Microsoft Defender for Cloud
14KViews
1like
10Comments
Re: ASC Security Policies & Compliance Wording
Hey GlavniArhivator, sorry for confusing you - let me try to explain it differently: The regulatory compliance part of ASC is another view to security risks. If you, for example, take a look at the CIS 1.1.0 control 7.1 Ensure that OS disks are encrypted, and you then go to the underlying recommendation "Disk encryption should be applied on virtual machines"; once you remediate this recommendation, you will gain credit towards your Secure Score if, besides this recommendation, you have made sure that all other recommendations in the same Security Control (Enable encryption at rest) have also been remediated. So, in order to increase your Secure Score, it's not enough to remediate the recommendation only, but from the perspective of the respective compliance standard, it is. If you then, for example, take a look at the SOC TSP set of controls, you will find CCE-numbers underneath C1.2. These refer to vulnerabilities that have been found on machines within the scope of the policy. There is no single recommendation or Security Control for these in the Resource Security Hygiene part of ASC, but you will find them underneath the Vulnerabilities in security configuration on your machines should be remediated recommendation, which is part of the Remediate security configurations security control. We have customers that need their resources to comply to different regulatory compliance standards. With the Regulatory Compliance dashboard, it is easy for them to find all settings that need to be configured so their resources will be compliant. We are mapping security recommendations to the topics that need to be taken care of when applying the compliance standard to an environment. So, with the compliance dashboard, it is easier to plan for which recommendations to focus on first in order to get the environment compliant, and then focus on remediating all the other recommendations and security controls. Once you remediate the recommendations from the Regulatory Compliance dashboard, they will also be remediated and count towards your Secure Score (but again: for receiving credits towards your Secure Score, all recommendations within a Security Control need to be remediated for a particular resource). So, to make sure your environment is as secure as possible, you should try to get the Secure Score to 100%. If you achieve this, your compliance assessments will also reflect this achievement. If you focus on increasing your Secure Score, the recommendations that pop up in the different regulatory compliance assessments will automatically show less non-compliant resources. At the end, Secure Score is the main KPI for how secure an environment is. The compliance dashboard gives you another view on your environment. Best regards, Tom
Aug 06, 2020 Place Microsoft Defender for Cloud
14KViews
0likes
8Comments
Azure Security Center GitHub Community
Dear Azure Security enthusiasts, we are currently working on improvements to our Azure Security Center GitHub Community. As Valon_Kolica pointed out in his post, we are looking for your feedback about how we're doing and what we can improve until 8/17/2020. In the meantime, we have already adjusted a few things to make our community more inclusive and engaging: As a first step, we have created a GitHub Wiki, which will help you to learn how to contribute, how to propose automation artifacts, how to connect, and where to find even more information. As of now, we will start to publish backlog items as GitHub issues, so you, the community, will always see, what is proposed and who is working on which automation artifact. Furthermore, if you want to contribute, you can pick items from the issue list, build an automation artifact around the feature, and submit it as a GitHub Pull Request, so we can merge your automation to our repository. You may, and are encouraged to, propose new automation artifacts or changes to existing ones using our Feature Request Template. If you find bugs in one of the artifacts, you can submit a new GitHub Issue using our Bug Report Template. Once you submit a new artifact, you will get public credit as the author by mentioning you at the beginning of the readme file. Now, it's your turn: respond to our survey, propose and submit your best automation artifacts, and let the community learn from your experience. Because #CommunityRocks and #SecurityRocks! Best regards, Tom Janetscheck Senior Program Manager CxE | Azure Security Center
Aug 06, 2020 Place Microsoft Defender for Cloud
1.9KViews
1like
0Comments
Re: ASC Security Policies & Compliance Wording
Hi GlavniArhivator, thanks for asking these great questions, I'll try to answer them in the respective order using a numbered list. Regulatory compliance is part of the ASC Standard tier, whereas Secure Score comes with the ASC free tier. Today, we do not map the compliance assessment results to your Secure Score. The Azure Security Benchmark is not exactly the same, as the CIS 1.1.0 benchmark we have integrated in ASC. However, its controls are consistent with other well-known security benchmarks, such as CIS 7.1. You can find more information about the Azure Security Benchmark at https://docs.microsoft.com/en-us/azure/security/benchmarks/overview. Benchmarks and Azure Policy are not the same. You can see Azure Policy as the tool for technically implementing auditing of security benchmarks. So, the recommendations you see in your Security Controls in the Resource Security Hygiene part of Azure Security Center are derived from well-known security benchmarks and the technical implementation under the hood is based on Azure Policy. In other words: we are using Azure Policy to create the recommendations you see in Azure Security Center, but these recommendations are based on industry-standard security best-practices. No, this is not possible today. The security policy Azure Security Center relies on is scoped to the Management Group or Subscription level. Best regards, Tom Janetscheck Senior Program Manager CxE | Azure Security Center
Aug 06, 2020 Place Microsoft Defender for Cloud
14KViews
1like
12Comments

User Profile

Tom_Janetscheck

User Widgets

Recent Discussions

Re: Exporting list of all vulnerabilities per machine

Re: Missing "Disk encryption should be applied on virtual machines" recommendations

Re: How do I get 50 Azure Defender to protect windows servers on premise?

Re: How do I get 50 Azure Defender to protect windows servers on premise?

Re: Did I just stumble on a hidden gem?

Re: ASC Security Policies & Compliance Wording

Re: Deploying partner vulnerability scanners to virtual machines

Re: Windows Server 2019 not supported for Windows Defender ATP ?

Re: Verify that Endpoint Protection on VM's are reporting.

Re: Automatically update newly released built-in policies

Re: Automatically update newly released built-in policies

Re: ASC Security Policies & Compliance Wording

Re: Confuguring Partner vulnerability solution

Re: ASC Security Policies & Compliance Wording

Re: ASC Security Policies & Compliance Wording

Re: ASC Security Policies & Compliance Wording

Re: ASC Security Policies & Compliance Wording

Azure Security Center GitHub Community

Re: ASC Security Policies & Compliance Wording

Recent Blog Articles

Prepare for upcoming transitions in Defender for Servers

Agentless malware scanning for servers with Defender for Cloud

How to keep track of Defender for Cloud Coverage

Microsoft Defender for Endpoint for Linux and Microsoft Defender for Servers

Defender for Servers Plan 2 now integrates with Defender for Endpoint unified solution

Microsoft Defender for Cloud Server Monitoring Dashboard

Microsoft Defender for Cloud PoC Series - Microsoft Defender for Container Registries

Time indicators in Microsoft Defender for Cloud assessments

How to keep track of Resource Exemptions in Microsoft Defender for Cloud

Resource exemption in Microsoft Defender for Cloud