| name | cis-azure-foundations-8.1.12 |
| description | Ensure the Microsoft Defender for Cloud 'Security alert emails' is configured |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","security","defender","email-notifications"] |
| cis_id | 8.1.12 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
8.1.12 Ensure the Microsoft Defender for Cloud 'Security alert emails' is configured (Automated)
Description
Ensure that Microsoft Defender for Cloud is configured to send security alert email notifications to a designated security contact, enabling prompt response to security incidents.
Rationale
Configuring security alert email notifications ensures that the appropriate personnel are informed when security alerts are generated by Microsoft Defender for Cloud. Without email notifications, critical security alerts may go unnoticed, delaying incident response and potentially allowing threats to persist or escalate. Designating a security contact ensures accountability and timely action on security events.
Impact
Configuring email notifications has minimal impact. The designated recipients will receive email alerts for security events, which may result in a high volume of emails depending on the environment size and activity. Organizations should ensure the designated recipients can manage the alert volume effectively.
Audit Procedure
From Azure Portal:
- Go to
Microsoft Defender for Cloud.
- Under
Management, click Environment settings.
- Click the name of a subscription.
- Select the
Email notifications blade.
- Verify that a valid email address is configured in the
Email recipients field.
- Ensure
Notify about alerts with the following severity (or higher) is enabled.
From Azure CLI:
az account get-access-token --query "{subscription:subscription,token:accessToken}" -o tsv
Then query the security contacts API:
az rest --method get --url "https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/securityContacts?api-version=2020-01-01-preview"
Verify that emails field contains valid email addresses.
From PowerShell:
Get-AzSecurityContact | Select-Object Name, Email, AlertNotifications
Ensure Email contains a valid address and AlertNotifications is On.
Expected Result
A valid security contact email address should be configured and alert notifications should be enabled.
Remediation
From Azure Portal:
- Go to .
