Microsoft Defender for Cloud

https://learn.microsoft.com/en-us/azure/defender-for-cloud
Admin
Microsoft Defender for Cloud is a Cloud Native Application Protection Platform (CNAPP) that provides...
Tokens:1,098,228
Snippets:6,583
Trust Score:10
Update:1 day ago
Show doc for...
Tokens:
Raw
### Initiate malware scan - Example request

Source: https://learn.microsoft.com/en-us/azure/defender-for-cloud/on-demand-malware-scanning

Example POST request with a bearer token to start a malware scan on a specific storage account.

```http
POST https://management.azure.com/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myResourceGroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount/providers/Microsoft.Security/defenderForStorageSettings/current/StartMalwareScan?api-version=2024-10-01-preview
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOi...
```

--------------------------------

### Get-SqlVulnerabilityAssessmentBaselineRule example

Source: https://learn.microsoft.com/en-us/azure/defender-for-cloud/express-configuration-sql-commands

Gets a single baseline rule by its rule ID. The example uses `VA2065` as the rule ID and requires `$dbId` to be defined.

```powershell
Get-SqlVulnerabilityAssessmentBaselineRule -ResourceId $dbId -RuleId 'VA2065'
```

--------------------------------

### Run New-ASCVASolution.ps1 with placeholder values

Source: https://learn.microsoft.com/en-us/azure/defender-for-cloud/deploy-vulnerability-assessment-byol-vm

Command-line syntax to provision a Qualys or Rapid7 vulnerability assessment solution. Replace placeholders with actual values for subscription ID, resource group, solution name, type, auto-update flag, license code, and public key.

```powershell
.\New-ASCVASolution.ps1 -subscriptionId <Subscription Id> -resourceGroupName <RG Name>
-vaSolutionName <New solution name> -vaType <Qualys / Rapid7> -autoUpdate <true/false>
-licenseCode <License code from vendor> -publicKey <Public Key received from vendor>
```

--------------------------------

### Example deployment script for Qualys solution

Source: https://learn.microsoft.com/en-us/azure/defender-for-cloud/deploy-vulnerability-assessment-byol-vm

Example invocation of New-ASCVASolution.ps1 that creates a Qualys vulnerability assessment solution with explicit parameters. The license and public key are placeholders and not valid.

```powershell
.\New-ASCVASolution.ps1 -subscriptionId 'f4cx1b69-dtgb-4ch6-6y6f-ea2e95373d3b' -resourceGroupName 'DefaultResourceGroup-WEU' -vaSolutionName 'QualysVa001' -vaType 'Qualys' -autoUpdate 'false' `
-licenseCode 'eyJjaWQiOiJkZDg5OTYzXe4iMTMzLWM4NTAtODM5FD2mZWM1N2Q3ZGU5MjgiLCJgbTYuOiIyMmM5NDg3MS1lNTVkLTQ1OGItYjhlMC03OTRhMmM3YWM1ZGQiLCJwd3NVcmwiOiJodHRwczovL3FhZ3B1YmxpYy1wMDEuaW50LnF1YWx5cy5jb20vQ2xvdSKJY6VudC8iLCJwd3NQb3J0IjoiNDQzIn0=' `
-publicKey 'MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCOiOLXjOywMfLZIBGPZLwSocf1Q64GASLK9OHFEmanBl1nkJhZDrZ4YD5lM98fThYbAx1Rde2iYV1ze/wDlX4cIvFAyXuN7HbdkeIlBl6vWXEBZpUU17bOdJOUGolzEzNBhtxi/elEZLghq9Chmah82me/okGMIhJJsCiTtglVQIDAQAB'
```

--------------------------------

### Example invocation of MigratingToExpressConfiguration.ps1

Source: https://learn.microsoft.com/en-us/azure/defender-for-cloud/powershell-sample-vulnerability-assessment-azure-sql

Example PowerShell commands that set the server name, subscription ID, and resource group name, then run the MigratingToExpressConfiguration.ps1 script with those parameters.

```powershell
Write-Host "----------- Migrating To express configuration example -----------"

$ServerName = "<Your server name>"  # The server name.
$SubscriptionId = "<Your subscription>" # The subscription id that the servers belong to.
$ResourceGroupName = "<Your resource group name>" # The resource group name that the servers belong to.

.\MigratingToExpressConfiguration.ps1 -SubscriptionId $SubscriptionId -ResourceGroupName $ResourceGroupName -ServerName $ServerName

```

--------------------------------

### Get-SqlVulnerabilityAssessmentScanResult examples

Source: https://learn.microsoft.com/en-us/azure/defender-for-cloud/express-configuration-sql-commands

Shows how to list all rule results for a scan or get a single rule result. The -ScanId 'latest' option is supported.

```powershell
Get-SqlVulnerabilityAssessmentScanResult -ResourceId $dbId -ScanId 'latest'
Get-SqlVulnerabilityAssessmentScanResult -ResourceId $dbId -ScanId 'latest' -RuleId 'VA2065'
```

--------------------------------

### Join software inventory with security assessments

Source: https://learn.microsoft.com/en-us/azure/defender-for-cloud/asset-inventory

KQL query that joins software inventory data with security assessments to find machines that have a specific software product installed alongside an unhealthy security recommendation. This example finds machines with MySQL installed and exposed management ports by normalizing Azure VM IDs to lowercase for accurate joins.

```kql
securityresources
| where type == "microsoft.security/softwareinventories"
| extend vmId = tolower(properties.azureVmId)
| where properties.softwareName == "mysql"
| join (
    securityresources
| where type == "microsoft.security/assessments"
| where properties.displayName == "Management ports should be closed on your virtual machines" and properties.status.code == "Unhealthy"
| extend vmId = tolower(properties.resourceDetails.Id)
) on vmId
```
Tokens:
Raw