Custom recommendation I created doesn't get triggered as a recommendation in defender for cloud

Question

I am trying to make custom recommendations work. I created a custom recommendation that looks meta data of a keyvault and checks if PublicNetworkAccess is enabled if so then it finds "iprules" in meta data. If it can see the word "value" in array iprules it means that our keyvault has IP restrictions which is safe to use.

I didn't have any issues while creating it but the issue is that I can't see this recommendation being triggered even after 12 + hours. I know I'm alerting on something that is safe but just trying to test the tool before I use the actual use cases. I think custom recommendation follows a specific format or something? Please help if you know anything :)

Here's the kql -

RawEntityMetadata

| where Environment == 'Azure' and Identifiers.Type =~ 'Microsoft.KeyVault/vaults'

| parse Record with * 'publicNetworkAccess":"' publicNetworkAccess:string '"' *

| where publicNetworkAccess contains "Enabled"

| parse Record with * "ipRules" ipRules:string ',' *

//| where ipRules contains "value"

| extend ABC = ipRules

| project Name, Environment, Record, publicNetworkAccess, HealthStatus = "HEALTHY", ipRules, Identifiers, Id, AdditionalData

Answer 1

@Khanna, Keshav

I was able to build the custom recommendation in my lab and it targeted 3 Key Vault correctly.

My recommendation here is to wait for 24 hours as any changes within defender for cloud could take up to 24 hours for execution.

If you don't have any further queries and the suggestion above answers your ask, please "Accept the answer", This will help us and others in the community as well.

Thanks,

Akshay Kaushik