lacework-global-607
2.1.10 Ensure That Microsoft Defender for Key Vault Is Set To 'On' (Manual)
Profile Applicability
• Level 2
Description
Turning on Microsoft Defender for Key Vault enables threat detection for Key Vault, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.
Rationale
Enabling Microsoft Defender for Key Vault allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).
Impact
Turning on Microsoft Defender for Key Vault incurs an additional cost per resource.
Audit
From Azure Portal
- Go to
Microsoft Defender for Cloud
- Select
Environment Settings
blade - Click on the subscription name
- Select the
Defender plans
blade - Review the chosen pricing tier. For the
Key Vault
resource typePlan
should be set toOn
.
From Azure CLI
Ensure the output of the below command is Standard
az security pricing show -n 'KeyVaults' --query 'PricingTier'
From Azure Powershell
Get-AzSecurityPricing -Name 'KeyVaults' | Select-Object Name,PricingTier
Ensure output for PricingTier
is Standard
Remediation
From Azure Portal
- Go to
Microsoft Defender for Cloud
- Select
Environment Settings
blade - Click on the subscription name
- Select the
Defender plans
blade - On the line in the table for
Key Vault
SelectOn
underPlan
. - Select
Save
From Azure CLI
Use the below command to enable Standard pricing tier for Storage
az security pricing create -n 'KeyVaults' --tier 'Standard'
From Azure PowerShell
Set-AzSecurityPricing -Name 'KeyVaults' -PricingTier 'Standard'
References
https://docs.microsoft.com/en-us/azure/security-center/security-center-detection-capabilities
https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/list
https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/update
https://docs.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-1-enable-threat-detection-capabilities