Description:
Turning on Azure Defender enables threat detection for Kubernetes, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center.
Rationale:
Enabling Azure Defender for Kubernetes allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).
Impact:
Turning on Azure Defender in Azure Security Center incurs an additional cost per resource.
Default Value:
By default, Azure Defender off is selected.
Audit:
Signin into your Azure account.
Go to Security Center
Select Pricing & settings blade
Click on the appropriate subscription name for which you wanted to turned on the defender on
Select the Azure Defender plans blade
Review the chosen pricing tier. For the Kubernetes resource type Plan should be set to On
Using Azure Command Line Interface 2.0
Ensure the output of the below command is Standard
az account get-access-token --query "{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X GET -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/pr icings?api-version=2018-06-01' | jq '.|.value[] | select(.name=="KubernetesService")'|jq '.properties.pricingTier'
Using Powershell:
Get-AzAccount
Get-AzSecurityPricing | Where-Object {$_.Name -eq 'KubernetesService'} | Select-Object Name, PricingTier
Remediation:
Pre-requisites:
An Azure account
An Azure Defender plan for Enhanced security plan (Azure Defender is free for the first 30 days. At the end of 30 days, if you choose to continue using the service, you’ll automatically charged for usage).
Implementation Steps:
Go to Security Center
Select Pricing & settings blade
Click on the subscription name
Select the Azure Defender plans blade
On the line in the table for Kubernetes Select On under Plan and click on save
Backout Plan:
Go to Security Center
Select Pricing & settings blade
Click on the subscription name
Select the Azure Defender plans blade
Ensure that Azure Defender is set to OFF for Kubernetes(how we can revoke the changes)
Using Azure Command-Line Interface 2.0
Use the below command to enable Standard pricing tier for Storage
az account get-access-token --query "{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json"
https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/pr icings/StorageAccounts?api-version=2018-06-01 -d@"input.json"'
Where input.json contains the Request body json data as mentioned below.
{
"id": "/subscriptions/<Your_Subscription_Id>/providers/Microsoft.Security/pricings/ StorageAccounts",
"name": "KubernetesService",
"type": "Microsoft.Security/pricings", "properties": {
"pricingTier": "Standard"
}
}