Microsoft-Defender-for-Cloud/Remediation scripts
..
Access to management ports on your Virtual Machines should be restricted
Advanced data security should be enabled on your SQL servers
Advanced data security should be enabled on your managed instances
Automation account variables should be encrypted
Create Azure RBAC Role based on CIEM access report
Customize Endpoint Protection Recommendation
DDoS Protection Standard should be enabled
Diagnostic Logs should be enabled on your resource
Disk encryption should be applied on virtual machines
Enable Network Security Groups on subnets
Enable auditing for the Keyvault/Logic App
Enable auditing for the SQL server
Enable the built-in vulnerability assessment solution on ARC virtual machines (powered by Qualys)/Azure Policy
Enable the built-in vulnerability assessment solution on virtual machines
Enable the built-in vulnerability assessment solution on virtual machines (powered by Qualys)
Enable transparent data encryption on SQL databases
Endpoint protection solution should be installed on virtual machine scale sets
Endpoint protection solution should be installed on virtual machines
Function App should only be accessible over HTTPs
IP forwarding on your virtual machine should be disabled
Install Monitring Agent on VMSS
Install monitoring agent on VMSS
Install monitoring agent on your machines
Managed identity should be used in function apps
Management ports of virtual machines should be protected with just-in-time network access control
Only secure connections to your Redis Cache should be enabled
Provision an Azure AD Administrator on SQL Server
Remove External Accounts
Remove deprecated accounts from subscriptions
Require secure transfer to storage account
Restrict access to App Services
Restrict access to storage accounts with firewall and virtual network configurations
Storage Account - Deny Network Access DefaultAction
Storage Account - Disable Blob Public Access
Storage Account - Disable Public Network Access
Storage Account - Enable Secure Transfer
TLS should be updated to the latest version for function apps
TLS should be updated to the latest version for web apps
The 'ClusterProtectionLevel' property to EncryptAndSign in Service Fabric should be set
Vulnerability assessment should be enabled on your SQL managed instances
Vulnerability assessment should be enabled on your SQL servers
Web Application should only be accessible over HTTPS
README.md

README.md

Programmatic remediation tools

This section contains several samples to help you programmatic remediate your Security Center recommendations, and thus improving your Secure score.

These samples are officially not supported by Microsoft and are meant for you to explore, test and adopt where applicable in your organization.

The samples that are provided are from the following type:

  • Azure Policy definitions - allow you to deny, enforce and remediate the configuration of your Azure resources
  • Logic Apps playbooks - allow you to remediate non-compliant resources using orchestration automation
  • PowerShell scripts - allow you to remediate non-compliant resources using PowerShell

Questions

You can submit any questions or requests here. Please also refer to our Wiki, as it will provide you with further information.

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.

When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.