Share via

Standard Recommendations with Source "Defender for Cloud"

Tropo Bridge 0 Reputation points
2024-05-23T20:55:59.75+00:00

Recommendations under Compliance Standards (e.g. Azure CSPM (Preview) Standard) are tagged with source field as "Policy" or "Defender for Cloud".

  1. whats the difference between recommendations that are sourced from policy vs defender for cloud?
  2. How can I get programmatic API access to 1) list all standards whose recommendations have a source "Defender for Cloud", 2) find out enablement status of such standards, 3) enable/disable such standards having recommendations with source "Defender for Cloud"
Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,235 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Sandeep G-MSFT 15,336 Reputation points Microsoft Employee
    2024-05-28T06:48:27.3866667+00:00

    @Tropo Bridge

    Thank you for posting this in Microsoft Q&A.

    As I understand you want to know the difference between recommendations that are sourced from policy vs defender for cloud.

    Sol: The recommendations that are sourced from policy and Defender for Cloud are both part of the Azure Security Center service, but they differ in their focus and scope.

    Policy-based recommendations are based on Azure Policy, which is a service that allows you to create and enforce policies across your Azure resources. Policy-based recommendations are focused on ensuring that your Azure resources are configured according to best practices and compliance requirements. These recommendations are based on a set of pre-defined policies that are provided by Azure Security Center, and they are designed to help you identify and remediate security issues in your Azure environment.

    Defender for Cloud-based recommendations are based on the analysis of security data from your Azure resources. Defender for Cloud is a cloud-native security solution that provides advanced threat protection for your Azure resources. Defender for Cloud-based recommendations are focused on identifying and remediating security threats and vulnerabilities in your Azure environment. These recommendations are based on the analysis of security data from your Azure resources, and they are designed to help you detect and respond to security threats in real-time.

    In summary, policy-based recommendations are focused on ensuring that your Azure resources are configured according to best practices and compliance requirements, while Defender for Cloud-based recommendations are focused on identifying and remediating security threats and vulnerabilities in your Azure environment. Both types of recommendations are important for maintaining the security of your Azure environment, and they should be used together to provide comprehensive security coverage.

    About your questions in second part, you can check below articles,

    https://learn.microsoft.com/en-us/rest/api/defenderforcloud/standards/list?view=rest-defenderforcloud-2021-08-01-preview&tabs=HTTP

    https://learn.microsoft.com/en-us/defender-cloud-apps/api-introduction

    To make changes using API on Defender for cloud recommendations, you can try to use the patch operation on the same endpoints mentioned in the article.

    Let me know if you have any further questions.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.