How to set Microsoft Defender (Security Center) settings via the Azure.ResourceManager SDK

Jason Looney 0 Reputation points
2024-05-09T16:46:23.4766667+00:00

We have the following code that enables Microsoft Defender for Cloud for an Azure subscription using the Azure.ResourceManager C# SDK. However, when we view the settings for Defender in the Azure portal, a couple of items aren't turned on that we would like to be.

Under the Defender plan for "Servers", only "Endpoint protection" is turned on. We'd like to also turn on "Vulnerability assessment for machines" and "Agentless scanning for machines". And under the plan for "Databases", we want to turn on "Azure Monitoring Agent for SQL server on machines".

using Azure;
using Azure.Identity;
using Azure.ResourceManager;
using Azure.ResourceManager.Resources;
using Azure.ResourceManager.SecurityCenter;
using Azure.ResourceManager.SecurityCenter.Models;

public async Task<FrameworkData.Response<CloudResourceStatus?>> VerifySubscription(Request<Subscription> request)
{
    return await patterns.Try<CloudResourceStatus?>(request, async response =>
    {
        try
        {
            var subscriptionId = request.Value.Id.GetValueOrDefault();

            var subscriptionResource = await FetchSubscriptionResource(subscriptionId);

            // Ensure Microsoft Defender for Cloud is enabled for the services we use
            var standardTier = new SecurityCenterPricingTier("Standard");

            var services = new List<String>
            {
                "AppServices",
                "KeyVaults",
                "SqlServers",
                "SqlServerVirtualMachines",
                "StorageAccounts",
                "VirtualMachines",
            };

            foreach (var service in services)
            {
                var securityPricing = await subscriptionResource.GetSecurityCenterPricingAsync(service);
                var data = securityPricing.Value.Data;

                if (data.PricingTier is null || !data.PricingTier.Equals(standardTier))
                {
                    data.PricingTier = standardTier;
                    await securityPricing.Value.UpdateAsync(WaitUntil.Completed, data);
                }
            }

            return new() { State = CloudResourceStatus.States.Verified };
        }
        catch (Exception ex)
        {
            return new()
            {
                State = CloudResourceStatus.States.Error,
                Message = $"Unexpected exception. {ex.Message}",
            };
        }
    });
}
Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,211 questions
{count} votes