defender-for-cloud-hardening

Name: defender-for-cloud-hardening
Author: vinayaklatthe

54installs34forks

How to install defender-for-cloud-hardening?

vinayaklatthe/microsoft-security-skills/defender-for-cloud-hardening

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-for-cloud-hardening

Installs into the current project.

Summary

Guidance for Microsoft Defender for Cloud — cloud security posture management (CSPM) and cloud workload protection (CWPP) across Azure, AWS, and GCP. Covers Foundational vs Defender CSPM, Secure Score, Defender plans (Servers, Storage, Containers, Databases, App Service, Key Vaul

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender for Cloud (Hardening)
2
3	Microsoft Defender for Cloud is a cloud-native application protection platform (CNAPP)
4	combining CSPM (posture, Secure Score, attack paths) and CWPP (threat protection for
5	servers, containers, databases, storage, APIs, AI) across Azure, AWS, and GCP.
6
7	## When to use
8	Assessing and improving cloud security posture, and enabling workload threat protection across
9	a multicloud estate. Use this skill to choose which Defender plans to enable, how to prioritise
10	remediation, and how to operationalise findings.
11
12	Do not use this skill for SaaS posture (`cloud-app-security-posture`), Sentinel SIEM
13	(`sentinel`), or extending Azure management to on-prem (`azure-arc`).
14
15	## Pick the Defender plan by workload
16
17	\| Workload \| Plan \| Enable when \|
18	\|---\|---\|---\|
19	\| Subscriptions / accounts (posture) \| Foundational CSPM (free) \| Always; everywhere \|
20	\| Multicloud + attack paths + agentless scanning \| Defender CSPM \| Tier 1+ environments \|
21	\| Windows / Linux servers (EDR, file integrity, JIT) \| Defender for Servers Plan 2 \| Production servers \|
22	\| Storage accounts (malware, sensitive-data scanning) \| Defender for Storage \| Public-facing / sensitive data \|
23	\| AKS / EKS / GKE clusters \| Defender for Containers \| Any production cluster \|
24	\| SQL, Cosmos DB, open-source DBs \| Defender for Databases \| Internet-exposed or sensitive \|
25	\| App Service apps \| Defender for App Service \| Internet-facing apps \|
26	\| Key Vault \| Defender for Key Vault \| Tier 0 / regulated \|
27	\| APIs behind APIM \| Defender for APIs \| Public APIs \|
28	\| Azure AI / OpenAI workloads \| Defender for AI Services \| AI workloads handling org data \|
29
30	> Rule of thumb: Foundational CSPM everywhere on day one (it's free). Then enable
31	> Defender for Servers Plan 2 + Defender CSPM in production - those two unlock the most
32	> value (attack paths, EDR integration). Other plans by risk and budget.
33
34	## Approach
35
36	1. Connect all clouds — Onboard Azure (auto), AWS (connector + CloudFormation), GCP
37	(connector + service account). Without all clouds connected, attack paths can't trace
38	across them.
39	*Verify: AWS / GCP connectors show "Connected"; recommendations appearing within 24
40	hours.*
41
42	2. Foundational CSPM baseline — Get Secure Score, recommendations mapped to **Microsoft
43	Cloud Security Benchmark (MCSB)**, and asset inventory. Use as the universal baseline.
44	*Verify: Secure Score baseline captured for each subscription; recommendation count by
45	severity logged.*
46
47	3. Enable Defender plans by workload risk — Use the picker table. Don't enable every
48	plan on day one - cost spikes and alert fatigue. Production-first.
49
50	4. Tag critical assets so the cloud security graph weights them appropriately —
51	`criticality=high`, `environment=prod`, `data-classification=sensitive`. Attack path
52	analysis uses these to rank.
53	Verify: critical assets tagged consistently; attack paths page shows them weighted.
54
55	5. Remediate by attack path, not by raw count — Use attack path analysis to find
56	chains from internet → workload → sensitive asset. Fix the chain breakers first.
57	Secure Score % is a vanity metric without attack-path context.
58	*Verify: top 5 attack paths reviewed weekly; chain-breaker fixes tracked separately
59	from generic recommendation count.*
60
61	6. Enforce with Azure Policy — Drive recommendations via Azure Policy `DeployIfNotExists`
62	or `Audit`. Assign workload-owner accountability with governance rules + SLA.
63
64	7. Operate — Stream alerts and recommendations to Sentinel for SOC correlation. Use
65	workflow automation (Logic Apps) for auto-response (e.g. open ticket, notify owner).
66
67	## Guardrails
68	- **Start with foundational CSPM everywhere; enable paid plans where workload risk justifies
69	cost.** Don't blanket-enable every Defender plan on every subscription.
70	- **Use attack path analysis to focus effort - Secure Score alone can mislead
71	prioritisation.** A 95% Secure Sc

People who liked this also viewed

6 picks

Type

defender-for-cloud-hardening

54installs34forks

View on GitHub

How to install defender-for-cloud-hardening?

vinayaklatthe/microsoft-security-skills/defender-for-cloud-hardening

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-for-cloud-hardening

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender for Cloud (Hardening)
2
3	Microsoft Defender for Cloud is a cloud-native application protection platform (CNAPP)
4	combining CSPM (posture, Secure Score, attack paths) and CWPP (threat protection for
5	servers, containers, databases, storage, APIs, AI) across Azure, AWS, and GCP.
6
7	## When to use
8	Assessing and improving cloud security posture, and enabling workload threat protection across
9	a multicloud estate. Use this skill to choose which Defender plans to enable, how to prioritise
10	remediation, and how to operationalise findings.
11
12	Do not use this skill for SaaS posture (`cloud-app-security-posture`), Sentinel SIEM
13	(`sentinel`), or extending Azure management to on-prem (`azure-arc`).
14
15	## Pick the Defender plan by workload
16
17	\| Workload \| Plan \| Enable when \|
18	\|---\|---\|---\|
19	\| Subscriptions / accounts (posture) \| Foundational CSPM (free) \| Always; everywhere \|
20	\| Multicloud + attack paths + agentless scanning \| Defender CSPM \| Tier 1+ environments \|
21	\| Windows / Linux servers (EDR, file integrity, JIT) \| Defender for Servers Plan 2 \| Production servers \|
22	\| Storage accounts (malware, sensitive-data scanning) \| Defender for Storage \| Public-facing / sensitive data \|
23	\| AKS / EKS / GKE clusters \| Defender for Containers \| Any production cluster \|
24	\| SQL, Cosmos DB, open-source DBs \| Defender for Databases \| Internet-exposed or sensitive \|
25	\| App Service apps \| Defender for App Service \| Internet-facing apps \|
26	\| Key Vault \| Defender for Key Vault \| Tier 0 / regulated \|
27	\| APIs behind APIM \| Defender for APIs \| Public APIs \|
28	\| Azure AI / OpenAI workloads \| Defender for AI Services \| AI workloads handling org data \|
29
30	> Rule of thumb: Foundational CSPM everywhere on day one (it's free). Then enable
31	> Defender for Servers Plan 2 + Defender CSPM in production - those two unlock the most
32	> value (attack paths, EDR integration). Other plans by risk and budget.
33
34	## Approach
35
36	1. Connect all clouds — Onboard Azure (auto), AWS (connector + CloudFormation), GCP
37	(connector + service account). Without all clouds connected, attack paths can't trace
38	across them.
39	*Verify: AWS / GCP connectors show "Connected"; recommendations appearing within 24
40	hours.*
41
42	2. Foundational CSPM baseline — Get Secure Score, recommendations mapped to **Microsoft
43	Cloud Security Benchmark (MCSB)**, and asset inventory. Use as the universal baseline.
44	*Verify: Secure Score baseline captured for each subscription; recommendation count by
45	severity logged.*
46
47	3. Enable Defender plans by workload risk — Use the picker table. Don't enable every
48	plan on day one - cost spikes and alert fatigue. Production-first.
49
50	4. Tag critical assets so the cloud security graph weights them appropriately —
51	`criticality=high`, `environment=prod`, `data-classification=sensitive`. Attack path
52	analysis uses these to rank.
53	Verify: critical assets tagged consistently; attack paths page shows them weighted.
54
55	5. Remediate by attack path, not by raw count — Use attack path analysis to find
56	chains from internet → workload → sensitive asset. Fix the chain breakers first.
57	Secure Score % is a vanity metric without attack-path context.
58	*Verify: top 5 attack paths reviewed weekly; chain-breaker fixes tracked separately
59	from generic recommendation count.*
60
61	6. Enforce with Azure Policy — Drive recommendations via Azure Policy `DeployIfNotExists`
62	or `Audit`. Assign workload-owner accountability with governance rules + SLA.
63
64	7. Operate — Stream alerts and recommendations to Sentinel for SOC correlation. Use
65	workflow automation (Logic Apps) for auto-response (e.g. open ticket, notify owner).
66
67	## Guardrails
68	- **Start with foundational CSPM everywhere; enable paid plans where workload risk justifies
69	cost.** Don't blanket-enable every Defender plan on every subscription.
70	- **Use attack path analysis to focus effort - Secure Score alone can mislead
71	prioritisation.** A 95% Secure Sc

People who liked this also viewed

6 picks

Type