prowler 5.17.0__py3-none-any.whl → 5.18.0__py3-none-any.whl

prowler/providers/azure/services/defender/defender_ensure_defender_for_containers_is_on/defender_ensure_defender_for_containers_is_on.metadata.json

@@ -1,30 +1,36 @@
 {
   "Provider": "azure",
   "CheckID": "defender_ensure_defender_for_containers_is_on",
-  "CheckTitle": "Ensure That Microsoft Defender for Containers Is Set To 'On' ",
+  "CheckTitle": "Defender for Containers is set to On (Standard pricing tier)",
   "CheckType": [],
   "ServiceName": "defender",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "high",
-  "ResourceType": "AzureDefenderPlan",
+  "ResourceType": "microsoft.security/pricings",
   "ResourceGroup": "security",
-  "Description": "Ensure That Microsoft Defender for Containers Is Set To 'On' ",
-  "Risk": "Ensure that Microsoft Defender for Cloud is enabled for all your Azure containers. Turning on the Defender for Cloud service enables threat detection for containers, providing threat intelligence, anomaly detection, and behavior analytics.",
+  "Description": "**Azure subscriptions** are assessed to determine if the **Defender for Containers** plan is configured with pricing tier `Standard`.",
+  "Risk": "Without **Defender for Containers**, images and runtimes lack continuous **threat detection** and **vulnerability assessment**. Adversaries can ship malicious images, run **cryptomining**, exfiltrate secrets, and **move laterally**, degrading **confidentiality** and **availability** of container workloads.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/defender-container.html",
+    "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/defender-container.html",
-      "Terraform": "https://docs.prowler.com/checks/azure/azure-general-policies/ensure-that-azure-defender-is-set-to-on-for-container-registries#terraform"
+      "CLI": "az security pricing create --name Containers --tier Standard",
+      "NativeIaC": "```bicep\n// Subscription-level deployment to enable Defender for Containers\ntargetScope = 'subscription'\n\nresource <example_resource_name> 'Microsoft.Security/pricings@2023-01-01' = {\n  name: 'Containers'\n  properties: {\n    pricingTier: 'Standard' // Critical: sets Defender for Containers plan to ON (Standard)\n  }\n}\n```",
+      "Other": "1. In Azure Portal, go to Microsoft Defender for Cloud\n2. Select Environment settings > choose <subscription>\n3. Open Pricing & settings\n4. Find the Containers plan and set it to On (Standard)\n5. Click Save",
+      "Terraform": "```hcl\nresource \"azurerm_security_center_subscription_pricing\" \"<example_resource_name>\" {\n  resource_type = \"Containers\"   # Critical: targets Defender for Containers plan\n  tier          = \"Standard\"     # Critical: enables Standard (ON)\n}\n```"
     },
     "Recommendation": {
-      "Text": "By default, Microsoft Defender for Cloud is not enabled for your Azure cloud containers. Enabling the Defender security service for Azure containers allows for advanced security defense against threats, using threat detection capabilities provided by the Microsoft Security Response Center (MSRC).",
-      "Url": ""
+      "Text": "Enable the **Defender for Containers** plan at `Standard` for all relevant subscriptions. Apply **least privilege**, integrate alerts with response workflows, and use **defense in depth**: signed images, private registries, RBAC, network policies, and periodic reviews to maintain consistent coverage.",
+      "Url": "https://hub.prowler.com/check/defender_ensure_defender_for_containers_is_on"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "container-security"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/azure/services/defender/defender_ensure_defender_for_cosmosdb_is_on/defender_ensure_defender_for_cosmosdb_is_on.metadata.json

@@ -1,30 +1,36 @@
 {
   "Provider": "azure",
   "CheckID": "defender_ensure_defender_for_cosmosdb_is_on",
-  "CheckTitle": "Ensure That Microsoft Defender for Cosmos DB Is Set To 'On' ",
+  "CheckTitle": "Defender for Cosmos DB is set to On (Standard pricing tier)",
   "CheckType": [],
   "ServiceName": "defender",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "high",
-  "ResourceType": "AzureDefenderPlan",
+  "ResourceType": "microsoft.security/pricings",
   "ResourceGroup": "security",
-  "Description": "Ensure That Microsoft Defender for Cosmos DB Is Set To 'On' ",
-  "Risk": "In scanning Cosmos DB requests within a subscription, requests are compared to a heuristic list of potential security threats. These threats could be a result of a security breach within your services, thus scanning for them could prevent a potential security threat from being introduced.",
+  "Description": "**Microsoft Defender for Azure Cosmos DB** is enabled at the subscription using the `Standard` pricing tier for the `CosmosDbs` plan, covering all Cosmos DB accounts",
+  "Risk": "Without this protection, Cosmos DB activity lacks advanced threat detection and telemetry. Attacks such as **SQL injection**, credential abuse, and **anomalous access patterns** may go unnoticed, enabling data exfiltration and unauthorized changes, degrading **confidentiality** and **integrity**.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/th-th/Azure/defender-for-cloud/defender-for-databases-enable-cosmos-protections?tabs=azure-portal",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/CosmosDB/enable-advanced-threat-protection.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "az security pricing create -n CosmosDbs --tier Standard",
+      "NativeIaC": "```bicep\n// Set Defender for Cosmos DB plan to Standard at subscription scope\ntargetScope = 'subscription'\n\nresource example_resource_name 'Microsoft.Security/pricings@2023-01-01' = {\n  name: 'CosmosDbs'\n  properties: {\n    pricingTier: 'Standard' // Critical: enables Defender for Cosmos DB (ON) at Standard tier\n  }\n}\n```",
+      "Other": "1. In Azure portal, go to Microsoft Defender for Cloud > Environment settings\n2. Select the target subscription\n3. Open Defender plans (Pricing)\n4. Find Azure Cosmos DB and set the plan to On (Standard)\n5. Click Save",
+      "Terraform": "```hcl\n# Enable Microsoft Defender for Cosmos DB at Standard tier\nresource \"azurerm_security_center_subscription_pricing\" \"example_resource_name\" {\n  resource_type = \"CosmosDbs\"  # Critical: target Cosmos DB plan\n  tier          = \"Standard\"    # Critical: sets plan to ON (Standard)\n}\n```"
     },
     "Recommendation": {
-      "Text": "By default, Microsoft Defender for Cloud is not enabled for your App Service instances. Enabling the Defender security service for App Service instances allows for advanced security defense using threat detection capabilities provided by Microsoft Security Response Center.",
-      "Url": "Enable Microsoft Defender for Cosmos DB"
+      "Text": "Enable the `Standard` plan for **Microsoft Defender for Azure Cosmos DB** at the subscription to ensure full coverage. Enforce **least privilege**, route alerts to your SIEM, and tune detections. Use policy to require the plan across environments and regularly review findings to strengthen **defense in depth**.",
+      "Url": "https://hub.prowler.com/check/defender_ensure_defender_for_cosmosdb_is_on"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "vulnerabilities"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/azure/services/defender/defender_ensure_defender_for_databases_is_on/defender_ensure_defender_for_databases_is_on.metadata.json

@@ -1,30 +1,36 @@
 {
   "Provider": "azure",
   "CheckID": "defender_ensure_defender_for_databases_is_on",
-  "CheckTitle": "Ensure That Microsoft Defender for Databases Is Set To 'On' ",
+  "CheckTitle": "Defender for Databases is set to On (Standard pricing tier)",
   "CheckType": [],
   "ServiceName": "defender",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "high",
-  "ResourceType": "AzureDefenderPlan",
+  "ResourceType": "microsoft.security/pricings",
   "ResourceGroup": "security",
-  "Description": "Ensure That Microsoft Defender for Databases Is Set To 'On' ",
-  "Risk": "Enabling Microsoft Defender for Azure SQL Databases allows your organization more granular control of the infrastructure running your database software",
+  "Description": "**Azure subscription** is evaluated for **Defender for Databases** coverage: `Standard` pricing must be enabled for `SqlServers`, `SqlServerVirtualMachines`, `OpenSourceRelationalDatabases`, and `CosmosDbs`.",
+  "Risk": "Without this coverage, database workloads lack **advanced threat detection**, **vulnerability assessment**, and **behavior analytics**.\n\nAttacks like credential brute force, SQL injection, privilege abuse, and data exfiltration can go **undetected**, threatening **confidentiality, integrity**, and **availability**.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/defender-for-cloud/tutorial-enable-databases-plan",
+    "https://support.icompaas.com/support/solutions/articles/62000229826-ensure-that-microsoft-defender-for-databases-is-set-to-on-"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "# Enable all Defender for Databases plans (must run each command separately)\naz security pricing create --name SqlServers --tier Standard\naz security pricing create --name SqlServerVirtualMachines --tier Standard\naz security pricing create --name OpenSourceRelationalDatabases --tier Standard\naz security pricing create --name CosmosDbs --tier Standard",
+      "NativeIaC": "```bicep\n// Enable Microsoft Defender for Databases plans at subscription scope\ntargetScope = 'subscription'\n\nresource sqlServers 'Microsoft.Security/pricings@2023-01-01' = {\n  name: 'SqlServers'\n  properties: {\n    pricingTier: 'Standard' // Critical: sets Defender for SQL servers to Standard (ON)\n  }\n}\n\nresource sqlServerVMs 'Microsoft.Security/pricings@2023-01-01' = {\n  name: 'SqlServerVirtualMachines'\n  properties: {\n    pricingTier: 'Standard' // Critical: sets Defender for SQL servers on machines to Standard (ON)\n  }\n}\n\nresource openSourceDBs 'Microsoft.Security/pricings@2023-01-01' = {\n  name: 'OpenSourceRelationalDatabases'\n  properties: {\n    pricingTier: 'Standard' // Critical: sets Defender for open-source databases to Standard (ON)\n  }\n}\n\nresource cosmosDbs 'Microsoft.Security/pricings@2023-01-01' = {\n  name: 'CosmosDbs'\n  properties: {\n    pricingTier: 'Standard' // Critical: sets Defender for Cosmos DB to Standard (ON)\n  }\n}\n```",
+      "Other": "1. In the Azure portal, go to Microsoft Defender for Cloud\n2. Select Environment settings > choose your subscription\n3. Open Defender plans\n4. Set these plans to On (Standard):\n   - SQL servers\n   - SQL servers on machines\n   - Open-source relational databases\n   - Cosmos DB\n5. Click Save",
+      "Terraform": "```hcl\n# Enable Microsoft Defender for Databases plans\nresource \"azurerm_security_center_subscription_pricing\" \"sqlservers\" {\n  resource_type = \"SqlServers\"\n  tier          = \"Standard\" # Critical: enables Defender (Standard)\n}\n\nresource \"azurerm_security_center_subscription_pricing\" \"sql_vm\" {\n  resource_type = \"SqlServerVirtualMachines\"\n  tier          = \"Standard\" # Critical: enables Defender (Standard)\n}\n\nresource \"azurerm_security_center_subscription_pricing\" \"oss_db\" {\n  resource_type = \"OpenSourceRelationalDatabases\"\n  tier          = \"Standard\" # Critical: enables Defender (Standard)\n}\n\nresource \"azurerm_security_center_subscription_pricing\" \"cosmos\" {\n  resource_type = \"CosmosDbs\"\n  tier          = \"Standard\" # Critical: enables Defender (Standard)\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enable Microsoft Defender for Azure SQL Databases",
-      "Url": ""
+      "Text": "Enable **Defender for Databases** at the `Standard` tier for all supported database types across subscriptions. Integrate alerts with monitoring, automate response, and enforce **least privilege** and **network segmentation** for defense in depth. Use policy to maintain continuous coverage for new resources.",
+      "Url": "https://hub.prowler.com/check/defender_ensure_defender_for_databases_is_on"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "vulnerabilities"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/azure/services/defender/defender_ensure_defender_for_dns_is_on/defender_ensure_defender_for_dns_is_on.metadata.json

@@ -1,30 +1,36 @@
 {
   "Provider": "azure",
   "CheckID": "defender_ensure_defender_for_dns_is_on",
-  "CheckTitle": "Ensure That Microsoft Defender for DNS Is Set To 'On' ",
+  "CheckTitle": "Defender for DNS is set to On (Standard pricing tier)",
   "CheckType": [],
   "ServiceName": "defender",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "high",
-  "ResourceType": "AzureDefenderPlan",
+  "ResourceType": "microsoft.security/pricings",
   "ResourceGroup": "security",
-  "Description": "Ensure That Microsoft Defender for DNS Is Set To 'On' ",
-  "Risk": "DNS lookups within a subscription are scanned and compared to a dynamic list of websites that might be potential security threats. These threats could be a result of a security breach within your services, thus scanning for them could prevent a potential security threat from being introduced.",
+  "Description": "**Microsoft Defender for DNS** is configured at the `Standard` tier for the subscription's Defender pricing",
+  "Risk": "Absent **Defender for DNS**, query telemetry isn't inspected, allowing **C2 callbacks**, **DNS tunneling**, and **malicious domains** to bypass detection. This increases risks to **confidentiality** (exfiltration), **integrity** (malware/DGA), and **availability** (poisoned or hijacked resolution).",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-dns-introduction",
+    "https://support.icompaas.com/support/solutions/articles/62000234089-ensure-that-microsoft-defender-for-dns-is-set-to-on-automated-"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "az security pricing create --name Dns --tier Standard",
+      "NativeIaC": "```bicep\n// Enable Microsoft Defender for DNS at subscription scope\ntargetScope = 'subscription'\n\nresource example_resource_name 'Microsoft.Security/pricings@2023-01-01' = {\n  name: 'Dns'\n  properties: {\n    pricingTier: 'Standard' // Critical: sets Defender for DNS to ON (Standard tier)\n  }\n}\n```",
+      "Other": "1. In the Azure portal, go to Microsoft Defender for Cloud\n2. Select Environment settings and choose your subscription\n3. Open Defender plans\n4. Find DNS and set the plan to Standard (On)\n5. Click Save",
+      "Terraform": "```hcl\nresource \"azurerm_security_center_subscription_pricing\" \"example_resource_name\" {\n  resource_type = \"Dns\"\n  tier          = \"Standard\" # Critical: enables Defender for DNS\n}\n```"
     },
     "Recommendation": {
-      "Text": "By default, Microsoft Defender for Cloud is not enabled for your App Service instances. Enabling the Defender security service for App Service instances allows for advanced security defense using threat detection capabilities provided by Microsoft Security Response Center.",
-      "Url": ""
+      "Text": "Enable **Defender for DNS** at the `Standard` tier across applicable subscriptions. Apply **defense in depth**: restrict outbound DNS, use private DNS where feasible, and log/monitor query activity. Route alerts to centralized monitoring. Enforce **least privilege** on security settings and review exclusions regularly.",
+      "Url": "https://hub.prowler.com/check/defender_ensure_defender_for_dns_is_on"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "forensics-ready"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/azure/services/defender/defender_ensure_defender_for_keyvault_is_on/defender_ensure_defender_for_keyvault_is_on.metadata.json

@@ -1,30 +1,36 @@
 {
   "Provider": "azure",
   "CheckID": "defender_ensure_defender_for_keyvault_is_on",
-  "CheckTitle": "Ensure That Microsoft Defender for KeyVault Is Set To 'On' ",
+  "CheckTitle": "Defender for Key Vaults is set to On (Standard pricing tier)",
   "CheckType": [],
   "ServiceName": "defender",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "high",
-  "ResourceType": "AzureDefenderPlan",
+  "ResourceType": "microsoft.security/pricings",
   "ResourceGroup": "security",
-  "Description": "Ensure That Microsoft Defender for KeyVault Is Set To 'On' ",
-  "Risk": "By default, Microsoft Defender for Cloud is disabled for Azure key vaults. Defender for Cloud detects unusual and potentially harmful attempts to access or exploit your Azure Key Vault data. This layer of protection allows you to address threats without being a security expert, and without the need to use and manage third-party security monitoring tools or services.",
+  "Description": "**Azure subscriptions** are evaluated for the **Defender for Key Vaults** plan configured at the `Standard` tier. It identifies where Key Vault protection uses this tier versus where the Defender pricing for `KeyVaults` is not set accordingly.",
+  "Risk": "Without **Defender for Key Vaults**, anomalous access and mass secret retrievals can go undetected, enabling:\n- Secret exfiltration (confidentiality)\n- Key/secret tampering (integrity)\n- Destructive actions like purge/delete (availability)\n\nLack of signals delays response and facilitates lateral movement.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/defender-key-vault.html",
+    "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-key-vault-introduction"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/defender-key-vault.html",
-      "Terraform": "https://docs.prowler.com/checks/azure/azure-general-policies/ensure-that-azure-defender-is-set-to-on-for-key-vault#terraform"
+      "CLI": "az security pricing update --name KeyVaults --tier Standard",
+      "NativeIaC": "```bicep\n// Enable Microsoft Defender for Key Vaults (Standard tier) at subscription scope\nresource example_pricing 'Microsoft.Security/pricings@2023-01-01' = {\n  name: 'KeyVaults'\n  properties: {\n    pricingTier: 'Standard' // Critical: sets the KeyVaults plan to Standard (ON)\n  }\n}\n```",
+      "Other": "1. In Azure Portal, go to Microsoft Defender for Cloud\n2. Select Environment settings, then choose your subscription\n3. Open Defender plans\n4. Find Key Vaults and set the plan to On/Standard\n5. Save",
+      "Terraform": "```hcl\n# Enable Microsoft Defender for Key Vaults (Standard)\nresource \"azurerm_security_center_subscription_pricing\" \"example_resource_name\" {\n  resource_type = \"KeyVaults\"\n  tier          = \"Standard\" # Critical: sets the plan to Standard (ON)\n}\n```"
     },
     "Recommendation": {
-      "Text": "Ensure that Microsoft Defender for Cloud is enabled for Azure key vaults. Key Vault is the Azure cloud service that safeguards encryption keys and secrets like certificates, connection-based strings, and passwords.",
-      "Url": ""
+      "Text": "Enable **Defender for Key Vaults** at the `Standard` tier across all subscriptions. Integrate alerts with monitoring and tune noise. Apply **least privilege** with **RBAC**, enforce purge protection and logging, and use **defense in depth** (private access and network restrictions) to prevent abuse and accelerate detection.",
+      "Url": "https://hub.prowler.com/check/defender_ensure_defender_for_keyvault_is_on"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "secrets"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/azure/services/defender/defender_ensure_defender_for_os_relational_databases_is_on/defender_ensure_defender_for_os_relational_databases_is_on.metadata.json

@@ -1,30 +1,36 @@
 {
   "Provider": "azure",
   "CheckID": "defender_ensure_defender_for_os_relational_databases_is_on",
-  "CheckTitle": "Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On' ",
+  "CheckTitle": "Defender for Open-Source Relational Databases is set to On (Standard pricing tier)",
   "CheckType": [],
   "ServiceName": "defender",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "high",
-  "ResourceType": "AzureDefenderPlan",
+  "ResourceType": "microsoft.security/pricings",
   "ResourceGroup": "security",
-  "Description": "Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On' ",
-  "Risk": "Turning on Microsoft Defender for Open-source relational databases enables threat detection for Open-source relational databases, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
+  "Description": "**Microsoft Defender for Cloud** plan for **Open-Source Relational Databases** is evaluated for the `Standard` pricing tier at the subscription level.",
+  "Risk": "Absent the `Standard` plan, open-source databases lack **threat detection** and **behavior analytics**, reducing **confidentiality** and **integrity**. SQL injection, brute-force logins, and data exfiltration may go unnoticed, delaying response and enabling **lateral movement**.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-databases-introduction",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/defender-relational-database.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "az security pricing create --name OpenSourceRelationalDatabases --tier Standard",
+      "NativeIaC": "```bicep\n// Deploy at subscription scope to set Defender pricing\ntargetScope = 'subscription'\n\nresource pricingOpenSource \"Microsoft.Security/pricings@2023-01-01\" = {\n  name: 'OpenSourceRelationalDatabases'\n  properties: {\n    pricingTier: 'Standard' // Critical: sets the plan to Standard (ON)\n  }\n}\n```",
+      "Other": "1. In Azure Portal, go to Microsoft Defender for Cloud\n2. Select Environment settings > your subscription\n3. Open Defender plans\n4. Find \"Open-source relational databases\" and set it to Standard/On\n5. Click Save",
+      "Terraform": "```hcl\nresource \"azurerm_security_center_subscription_pricing\" \"example_resource_name\" {\n  resource_type = \"OpenSourceRelationalDatabases\"\n  tier          = \"Standard\" # Critical: enables Defender (Standard tier)\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enabling Microsoft Defender for Open-source relational databases allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).",
-      "Url": ""
+      "Text": "Enable the plan at the `Standard` tier across relevant subscriptions. Apply **defense in depth**: enforce **least privilege**, isolate databases on private networks, require strong authentication, and route alerts to centralized monitoring for rapid triage. *Review coverage regularly*.",
+      "Url": "https://hub.prowler.com/check/defender_ensure_defender_for_os_relational_databases_is_on"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "vulnerabilities"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/azure/services/defender/defender_ensure_defender_for_server_is_on/defender_ensure_defender_for_server_is_on.metadata.json

@@ -1,30 +1,38 @@
 {
   "Provider": "azure",
   "CheckID": "defender_ensure_defender_for_server_is_on",
-  "CheckTitle": "Ensure That Microsoft Defender for Servers Is Set to 'On'",
+  "CheckTitle": "Defender for Servers is set to On (Standard pricing tier)",
   "CheckType": [],
   "ServiceName": "defender",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "high",
-  "ResourceType": "AzureDefenderPlan",
+  "ResourceType": "microsoft.security/pricings",
   "ResourceGroup": "security",
-  "Description": "Ensure That Microsoft Defender for Servers Is Set to 'On'",
-  "Risk": "Turning on Microsoft Defender for Servers enables threat detection for Servers, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
+  "Description": "**Microsoft Defender for Servers** subscription plan (`VirtualMachines`) is configured to the `Standard` tier. The evaluation checks whether the Servers plan is enabled at this level for all server workloads in the subscription.",
+  "Risk": "Without **Defender for Servers**, endpoints lack unified EDR, hardening, and threat analytics. This enables silent malware, credential theft, and lateral movement, driving data exfiltration (C), ransomware/tampering (I), and outages or cryptomining abuse (A).",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers-select-plan",
+    "https://learn.microsoft.com/en-us/azure/defender-for-cloud/faq-defender-for-servers",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/microsoft-defender-vm-server.html",
+    "https://learn.microsoft.com/en-us/answers/questions/1131575/defender-for-servers-policy-definitions.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/microsoft-defender-vm-server.html",
-      "Terraform": "https://docs.prowler.com/checks/azure/azure-general-policies/ensure-that-azure-defender-is-set-to-on-for-servers#terraform"
+      "CLI": "az security pricing create --name VirtualMachines --tier Standard",
+      "NativeIaC": "```bicep\n// Enable Defender for Servers (Standard) at subscription scope\n@description('Enable Microsoft Defender for Servers (Standard)')\ntargetScope = 'subscription'\n\nresource <example_resource_name> 'Microsoft.Security/pricings@2024-01-01' = {\n  name: 'VirtualMachines'\n  properties: {\n    pricingTier: 'Standard' // Critical: sets Defender for Servers to ON (Standard)\n  }\n}\n```",
+      "Other": "1. In Azure Portal, go to Microsoft Defender for Cloud\n2. Select Environment settings, then your <subscription>\n3. On Defender plans, set Servers to On (Standard)\n4. Click Save",
+      "Terraform": "```hcl\n# Enable Defender for Servers (Standard) on the subscription\nresource \"azurerm_security_center_subscription_pricing\" \"<example_resource_name>\" {\n  resource_type = \"VirtualMachines\"\n  tier          = \"Standard\" # Critical: sets Defender for Servers to ON (Standard)\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enabling Microsoft Defender for Cloud standard pricing tier allows for better security assessment with threat detection provided by the Microsoft Security Response Center (MSRC), advanced security policies, adaptive application control, network threat detection, and regulatory compliance management.",
-      "Url": ""
+      "Text": "Enable the **Defender for Servers** plan at the **subscription** scope with tier `Standard`, choosing P1 or P2 per asset risk. Ensure all Azure VMs and Arc-enabled servers are covered for EDR integration. Apply **defense in depth** and **least privilege**, and continuously monitor and tune alerts.",
+      "Url": "https://hub.prowler.com/check/defender_ensure_defender_for_server_is_on"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "vulnerabilities"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/azure/services/defender/defender_ensure_defender_for_sql_servers_is_on/defender_ensure_defender_for_sql_servers_is_on.metadata.json

@@ -1,30 +1,36 @@
 {
   "Provider": "azure",
   "CheckID": "defender_ensure_defender_for_sql_servers_is_on",
-  "CheckTitle": "Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On' ",
+  "CheckTitle": "Defender for SQL servers on machines is set to On (Standard pricing tier)",
   "CheckType": [],
   "ServiceName": "defender",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "high",
-  "ResourceType": "AzureDefenderPlan",
+  "ResourceType": "microsoft.security/pricings",
   "ResourceGroup": "security",
-  "Description": "Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On' ",
-  "Risk": "Turning on Microsoft Defender for SQL servers on machines enables threat detection for SQL servers on machines, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
+  "Description": "**Subscription pricing** for **Defender for SQL Server on Machines** is configured to the `Standard` plan, covering SQL Server instances running on virtual machines.",
+  "Risk": "Without **Defender for SQL Server on Machines**, attacks on SQL Server VMs can go **undetected**-including SQL injection, brute-force logons, and privilege abuse.\n\nThis risks data exfiltration (C), schema or record tampering (I), and outages or ransomware impact (A), while reducing visibility and delaying response.",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-sql-introduction",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/defender-sql-server-virtual-machines.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/defender-sql-server-virtual-machines.html",
-      "Terraform": "https://docs.prowler.com/checks/azure/azure-general-policies/ensure-that-azure-defender-is-set-to-on-for-sql-servers-on-machines#terraform"
+      "CLI": "az security pricing create -n SqlServerVirtualMachines --tier Standard",
+      "NativeIaC": "```bicep\n// Enable Microsoft Defender for SQL servers on machines at subscription scope\ntargetScope = 'subscription'\n\nresource pricing 'Microsoft.Security/pricings@2022-03-01' = {\n  name: 'SqlServerVirtualMachines'\n  properties: {\n    pricingTier: 'Standard' // Critical: sets Defender plan to Standard (ON) for SQL Server VMs\n  }\n}\n```",
+      "Other": "1. In the Azure Portal, go to Microsoft Defender for Cloud\n2. Click Environment settings and select the target subscription\n3. Open Defender plans (Plans)\n4. Find SQL servers on machines and set it to Standard (On)\n5. Click Save",
+      "Terraform": "```hcl\nresource \"azurerm_security_center_subscription_pricing\" \"<example_resource_name>\" {\n  resource_type = \"SqlServerVirtualMachines\" # Critical: target the SQL Server VMs Defender plan\n  tier          = \"Standard\"                 # Critical: enable Standard (ON)\n}\n```"
     },
     "Recommendation": {
-      "Text": "By default, Microsoft Defender for Cloud is disabled for the Microsoft SQL servers running on virtual machines. Defender for Cloud for SQL Server virtual machines continuously monitors your SQL database servers for threats such as SQL injection, brute-force attacks, and privilege abuse. The security service provides security alerts together with details of the suspicious activity and guidance on how to mitigate to the security threats.",
-      "Url": ""
+      "Text": "Enable the **Defender for SQL Server on Machines** plan at the `Standard` tier for subscriptions hosting SQL Server VMs.\n\nApply defense-in-depth: enforce least privilege and strong authentication, segment networks, keep SQL patched, enable auditing, and route alerts to a SIEM for rapid containment.",
+      "Url": "https://hub.prowler.com/check/defender_ensure_defender_for_sql_servers_is_on"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "vulnerabilities"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/azure/services/defender/defender_ensure_defender_for_storage_is_on/defender_ensure_defender_for_storage_is_on.metadata.json

@@ -1,30 +1,36 @@
 {
   "Provider": "azure",
   "CheckID": "defender_ensure_defender_for_storage_is_on",
-  "CheckTitle": "Ensure That Microsoft Defender for Storage Is Set To 'On' ",
+  "CheckTitle": "Defender for Storage is set to On (Standard pricing tier)",
   "CheckType": [],
   "ServiceName": "defender",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "high",
-  "ResourceType": "AzureDefenderPlan",
+  "ResourceType": "microsoft.security/pricings",
   "ResourceGroup": "security",
-  "Description": "Ensure That Microsoft Defender for Storage Is Set To 'On' ",
-  "Risk": "Ensure that Microsoft Defender for Cloud is enabled for your Microsoft Azure storage accounts. Defender for storage accounts is an Azure-native layer of security intelligence that detects unusual and potentially harmful attempts to access or exploit your Azure cloud storage accounts.",
+  "Description": "Azure subscription's **Defender for Storage** plan is set to `Standard` for Storage Accounts.",
+  "Risk": "Without **Defender for Storage**, suspicious access to blobs, files, and queues may go undetected. Compromised keys or `SAS` tokens can enable data exfiltration (**confidentiality**), object tampering (**integrity**), and mass deletion or ransomware-like encryption (**availability**).",
   "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/defender-storage.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/defender-storage.html",
-      "Terraform": "https://docs.prowler.com/checks/azure/azure-general-policies/ensure-that-azure-defender-is-set-to-on-for-storage#terraform"
+      "CLI": "az security pricing create -n StorageAccounts --tier Standard",
+      "NativeIaC": "```bicep\n// Enable Microsoft Defender for Storage at subscription level\nresource example_resource_name 'Microsoft.Security/pricings@2023-01-01' = {\n  name: 'StorageAccounts'\n  properties: {\n    pricingTier: 'Standard' // CRITICAL: sets the plan to Standard (ON) for Storage\n  }\n}\n```",
+      "Other": "1. In Azure portal, open Microsoft Defender for Cloud\n2. Go to Environment settings > select <subscription>\n3. Open Defender plans\n4. Set Storage to On (Standard)\n5. Click Save",
+      "Terraform": "```hcl\n# Enable Microsoft Defender for Storage at subscription level\nresource \"azurerm_security_center_subscription_pricing\" \"example_resource_name\" {\n  resource_type = \"StorageAccounts\"\n  tier          = \"Standard\" # CRITICAL: sets Storage plan to Standard (ON)\n}\n```"
     },
     "Recommendation": {
-      "Text": "By default, Microsoft Defender for Cloud is disabled for your storage accounts. Enabling the Defender security service for Azure storage accounts allows for advanced security defense using threat detection capabilities provided by the Microsoft Security Response Center (MSRC). MSRC investigates all reports of security vulnerabilities affecting Microsoft products and services, including Azure cloud services.",
-      "Url": ""
+      "Text": "Enable **Defender for Storage** at the `Standard` tier for subscriptions with storage workloads. Apply **defense in depth**: restrict network exposure, enforce **least privilege** on keys and `SAS`, use short-lived tokens and rotation, and route alerts to centralized monitoring for rapid response.",
+      "Url": "https://hub.prowler.com/check/defender_ensure_defender_for_storage_is_on"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "forensics-ready"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/azure/services/defender/defender_ensure_iot_hub_defender_is_on/defender_ensure_iot_hub_defender_is_on.metadata.json

@@ -1,30 +1,36 @@
 {
   "Provider": "azure",
   "CheckID": "defender_ensure_iot_hub_defender_is_on",
-  "CheckTitle": "Ensure That Microsoft Defender for IoT Hub Is Set To 'On'",
+  "CheckTitle": "Defender for IoT Hub is set to On",
   "CheckType": [],
   "ServiceName": "defender",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "high",
-  "ResourceType": "DefenderIoT",
+  "ResourceType": "microsoft.security/iotsecuritysolutions",
   "ResourceGroup": "security",
-  "Description": "Microsoft Defender for IoT acts as a central security hub for IoT devices within your organization.",
-  "Risk": "IoT devices are very rarely patched and can be potential attack vectors for enterprise networks. Updating their network configuration to use a central security hub allows for detection of these breaches.",
-  "RelatedUrl": "https://azure.microsoft.com/en-us/services/iot-defender/#overview",
+  "Description": "**Microsoft Defender for IoT security solution** exists in the subscription and reports status `Enabled` for monitored **IoT Hub** resources.",
+  "Risk": "Without **Defender for IoT**, device activity lacks telemetry and alerting, degrading CIA:\n- Compromised devices join botnets and exfiltrate data\n- Abused device identities alter cloud twins and commands\n- Lateral movement from IoT networks to Azure workloads\nThis blind spot increases dwell time and blast radius.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/quickstart-onboard-iot-hub",
+    "https://support.icompaas.com/support/solutions/articles/62000229850-ensure-that-microsoft-defender-for-iot-hub-is-set-to-on-"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "NativeIaC": "```bicep\n// Enable Defender for IoT by creating an IoT Security Solution\nresource iotDefender 'Microsoft.Security/iotSecuritySolutions@2019-08-01' = {\n  name: '<example_resource_name>'\n  location: '<LOCATION>'\n  properties: {\n    displayName: '<example_resource_name>'\n    iotHubs: ['<IOT_HUB_RESOURCE_ID>']  // CRITICAL: links the IoT Hub; creating this solution enables Defender for IoT\n    status: 'Enabled'                   // CRITICAL: ensures the solution is enabled\n  }\n}\n```",
+      "Other": "1. In the Azure portal, go to IoT hubs and open your hub\n2. Select Defender for IoT > Overview\n3. Click Secure your IoT solution and complete onboarding (select the hub if prompted)\n4. If you see a toggle, set Enable Microsoft Defender for IoT to On and Save\n5. Verify the IoT Security Solution shows as Enabled under Defender for IoT",
+      "Terraform": "```hcl\n# Enable Defender for IoT by creating an IoT Security Solution\nresource \"azurerm_iot_security_solution\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  resource_group_name = \"<example_resource_name>\"\n  location            = \"<LOCATION>\"\n  display_name        = \"<example_resource_name>\"\n  iothub_ids          = [\"<IOT_HUB_RESOURCE_ID>\"]  # CRITICAL: links the IoT Hub; creating this solution enables Defender\n}\n```"
     },
     "Recommendation": {
-      "Text": "1. Go to IoT Hub. 2. Select a IoT Hub to validate. 3. Select Overview in Defender for IoT. 4. Click on Secure your IoT solution, and complete the onboarding.",
-      "Url": "https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/quickstart-onboard-iot-hub"
+      "Text": "Enable **Defender for IoT** on all IoT Hubs and keep it `Enabled`. Route security data to a central workspace and your SIEM. Apply **least privilege** to IoT identities, enforce **network segmentation** and private access, and use **defense in depth** with continuous monitoring, alert tuning, and periodic coverage reviews.",
+      "Url": "https://hub.prowler.com/check/defender_ensure_iot_hub_defender_is_on"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "vulnerabilities"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": "Enabling Microsoft Defender for IoT will incur additional charges dependent on the level of usage."