[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG8WAGWE5XWNECWNFZF5M1":3,"skill-same:01M6AG8WAGWE5XWNECWNFZF5M1":134},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":73,"commitSha":74,"skillDirectory":75,"forksCount":76,"repositoryHtmlUrl":77,"repositoryHomepageUrl":78,"ownerHtmlUrl":79,"ownerBlogUrl":80,"ownerDescription":81,"updatedAt":82,"install":83,"resources":96},"01M6AG8WAGWE5XWNECWNFZF5M1","securing-azure-with-microsoft-defender",null,"Deploys and configures Microsoft Defender for Cloud as a CNAPP for Azure, multi-cloud, and hybrid environments: enabling Defender plans for servers, containers, storage, and databases, configuring recommendations, and managing Secure Score via the unified Defender portal. Use when onboarding workloads to Defender for Cloud or setting up cloud workload protection and threat monitoring.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fsecuring-azure-with-microsoft-defender\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"securing azure with microsoft defender","microsoft","defender","azure","monitoring","cloud-workload-protection","secure-score","azure-security","cnapp","multi-cloud","t1078","Microsoft-Defender","cloud-security","containers","pr","secure","workload","storage","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: securing-azure-with-microsoft-defender\ndescription: 'Deploys and configures Microsoft Defender for Cloud as a CNAPP for\n  Azure, multi-cloud, and hybrid environments: enabling Defender plans for servers,\n  containers, storage, and databases, configuring recommendations, and managing Secure\n  Score via the unified Defender portal. Use when onboarding workloads to Defender\n  for Cloud or setting up cloud workload protection and threat monitoring.\n\n  '\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- microsoft-defender\n- azure-security\n- cnapp\n- secure-score\n- cloud-workload-protection\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1537\n- T1580\n- T1610\n---\n\n# Securing Azure with Microsoft Defender\n\n## When to Use\n\n- When deploying cloud workload protection across Azure subscriptions and resource groups\n- When establishing a Secure Score baseline and prioritizing security recommendations\n- When extending threat protection to multi-cloud environments including AWS and GCP\n- When enabling container security for AKS clusters and Azure Container Registry\n- When integrating AI workload security with the Data and AI security dashboard\n\n**Do not use** for AWS-only environments (see implementing-aws-security-hub), for identity provider configuration (see managing-cloud-identity-with-okta), or for network-level firewall rule management (see implementing-cloud-waf-rules).\n\n## Prerequisites\n\n- Azure subscription with Security Admin or Contributor role\n- Azure Policy initiative for Defender for Cloud enabled at the management group level\n- Log Analytics workspace provisioned for security data collection\n- Microsoft Defender for Cloud plans licensed (P1 or P2 for server protection)\n\n## Workflow\n\n### Step 1: Enable Defender for Cloud Plans\n\nActivate Defender plans for each workload type: Servers, Containers, App Service, Storage, Databases, Key Vault, Resource Manager, and DNS. Each plan provides specialized threat detection and vulnerability assessment.\n\n```powershell\n# Enable Defender for Servers Plan 2\naz security pricing create --name VirtualMachines --tier Standard --subplan P2\n\n# Enable Defender for Containers\naz security pricing create --name Containers --tier Standard\n\n# Enable Defender for Storage with malware scanning\naz security pricing create --name StorageAccounts --tier Standard \\\n  --extensions '[{\"name\":\"OnUploadMalwareScanning\",\"isEnabled\":\"True\",\n  \"additionalExtensionProperties\":{\"CapGBPerMonthPerStorageAccount\":\"5000\"}}]'\n\n# Enable Defender for Databases\naz security pricing create --name SqlServers --tier Standard\naz security pricing create --name CosmosDbs --tier Standard\n\n# Enable Defender for Key Vault\naz security pricing create --name KeyVaults --tier Standard\n\n# Verify all enabled plans\naz security pricing list --query \"[?pricingTier=='Standard'].{Plan:name, Tier:pricingTier, SubPlan:subPlan}\" -o table\n```\n\n### Step 2: Configure Environment Connectors for Multi-Cloud\n\nConnect AWS accounts and GCP projects to Defender for Cloud for unified security posture management across cloud providers.\n\n```powershell\n# Create AWS connector for CSPM\naz security security-connector create \\\n  --name aws-production-connector \\\n  --resource-group security-rg \\\n  --environment-name AWS \\\n  --hierarchy-identifier \"123456789012\" \\\n  --offerings '[{\n    \"offeringType\": \"CspmMonitorAws\",\n    \"nativeCloudConnection\": {\"cloudRoleArn\": \"arn:aws:iam::123456789012:role\u002FDefenderForCloudRole\"}\n  }]'\n\n# Create GCP connector\naz security security-connector create \\\n  --name gcp-production-connector \\\n  --resource-group security-rg \\\n  --environment-name GCP \\\n  --hierarchy-identifier \"my-gcp-project-id\" \\\n  --offerings '[{\"offeringType\": \"CspmMonitorGcp\"}]'\n```\n\n### Step 3: Review and Prioritize Secure Score Recommendations\n\nAnalyze the Secure Score across all subscriptions. Each recommendation includes a risk priority based on asset exposure, internet exposure, and threat intelligence context.\n\n```powershell\n# Get current Secure Score\naz security secure-score list \\\n  --query \"[].{Name:displayName, Score:current, Max:max, Percentage:percentage}\" -o table\n\n# List unhealthy recommendations sorted by severity\naz security assessment list \\\n  --query \"[?properties.status.code=='Unhealthy'].{Name:properties.displayName, Severity:properties.metadata.severity, Resources:properties.resourceDetails.id}\" \\\n  --output table\n\n# Get specific recommendation details\naz security assessment show \\\n  --assessment-name \"4fb67663-9ab9-475d-b026-8c544cced439\" \\\n  --query \"{Name:properties.displayName, Description:properties.metadata.description, Remediation:properties.metadata.remediationDescription}\"\n```\n\n### Step 4: Configure Adaptive Application Controls and JIT Access\n\nEnable Just-In-Time VM access to reduce the attack surface by opening management ports only when needed, and deploy adaptive application controls to whitelist approved executables.\n\n```powershell\n# Enable JIT VM access policy\naz security jit-policy create \\\n  --resource-group production-rg \\\n  --location eastus \\\n  --name default \\\n  --virtual-machines '[{\n    \"id\": \"\u002Fsubscriptions\u002Fsub-id\u002FresourceGroups\u002Fproduction-rg\u002Fproviders\u002FMicrosoft.Compute\u002FvirtualMachines\u002Fweb-server-01\",\n    \"ports\": [\n      {\"number\": 22, \"protocol\": \"TCP\", \"allowedSourceAddressPrefix\": \"10.0.0.0\u002F8\", \"maxRequestAccessDuration\": \"PT3H\"},\n      {\"number\": 3389, \"protocol\": \"TCP\", \"allowedSourceAddressPrefix\": \"10.0.0.0\u002F8\", \"maxRequestAccessDuration\": \"PT1H\"}\n    ]\n  }]'\n\n# Request JIT access\naz security jit-policy initiate \\\n  --resource-group production-rg \\\n  --location eastus \\\n  --name default \\\n  --virtual-machines '[{\n    \"id\": \"\u002Fsubscriptions\u002Fsub-id\u002FresourceGroups\u002Fproduction-rg\u002Fproviders\u002FMicrosoft.Compute\u002FvirtualMachines\u002Fweb-server-01\",\n    \"ports\": [{\"number\": 22, \"duration\": \"PT1H\", \"allowedSourceAddressPrefix\": \"203.0.113.10\"}]\n  }]'\n```\n\n### Step 5: Set Up Security Alerts and Workflow Automation\n\nConfigure workflow automation to trigger Logic Apps or Azure Functions when security alerts are generated. Set up email notifications for Critical and High severity alerts.\n\n```powershell\n# Create workflow automation for high severity alerts\naz security automation create \\\n  --name high-severity-alert-automation \\\n  --resource-group security-rg \\\n  --scopes '[{\"description\": \"Production subscription\", \"scopePath\": \"\u002Fsubscriptions\u002F\u003Csub-id>\"}]' \\\n  --sources '[{\n    \"eventSource\": \"Alerts\",\n    \"ruleSets\": [{\"rules\": [{\"propertyJPath\": \"Severity\", \"propertyType\": \"String\", \"expectedValue\": \"High\", \"operator\": \"Equals\"}]}]\n  }]' \\\n  --actions '[{\n    \"logicAppResourceId\": \"\u002Fsubscriptions\u002F\u003Csub-id>\u002FresourceGroups\u002Fsecurity-rg\u002Fproviders\u002FMicrosoft.Logic\u002Fworkflows\u002Falert-handler\",\n    \"actionType\": \"LogicApp\"\n  }]'\n\n# Configure email notifications\naz security contact create \\\n  --name default \\\n  --email \"soc-team@company.com\" \\\n  --alert-notifications \"on\" \\\n  --alerts-to-admins \"on\"\n```\n\n### Step 6: Enable Cloud Security Graph and Attack Path Analysis\n\nUse the cloud security graph to visualize attack paths that adversaries could exploit to reach critical assets. Prioritize remediation based on actual exploitability rather than individual finding severity.\n\n```\n# Query attack paths via Resource Graph\naz graph query -q \"\n  securityresources\n  | where type == 'microsoft.security\u002Fattackpaths'\n  | extend riskLevel = properties.riskLevel\n  | extend entryPoint = properties.attackPathDisplayName\n  | where riskLevel == 'Critical'\n  | project entryPoint, riskLevel, properties.description\n  | limit 20\n\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Secure Score | A numerical measure of an organization's security posture based on the percentage of implemented security recommendations, scored per subscription and aggregated at the management group level |\n| Cloud Security Graph | A graph database mapping relationships between cloud resources, identities, network exposure, and vulnerabilities to identify exploitable attack paths |\n| Attack Path Analysis | Visualization of multi-step attack chains an adversary could follow from an entry point to a high-value target, prioritized by real-world exploitability |\n| Just-In-Time Access | Security control that blocks management ports by default and opens them temporarily upon approved request, reducing the VM attack surface |\n| Adaptive Application Controls | Machine-learning-based allowlisting that recommends which applications should run on VMs and alerts on deviations |\n| Defender CSPM | Enhanced cloud security posture management plan providing agentless scanning, attack path analysis, and cloud security graph capabilities |\n| Security Connector | Integration point connecting AWS or GCP environments to Defender for Cloud for multi-cloud posture management |\n\n## Tools & Systems\n\n- **Microsoft Defender for Cloud**: Core CNAPP platform providing CSPM, CWP, and threat protection across Azure, AWS, and GCP\n- **Azure Resource Graph**: Query engine for exploring cloud security graph data and attack paths at scale\n- **Azure Logic Apps**: Workflow automation platform for building remediation playbooks triggered by Defender alerts\n- **Microsoft Defender Portal**: Unified security operations console integrating Defender for Cloud with XDR, Sentinel, and threat intelligence\n- **Azure Policy**: Governance engine for enforcing Defender for Cloud recommendations as compliance requirements\n\n## Common Scenarios\n\n### Scenario: Internet-Exposed SQL Server with Known Vulnerability\n\n**Context**: Defender for Cloud identifies an Azure SQL Server with a public endpoint, an unpatched critical CVE, and a service principal with database owner permissions that also has access to a Key Vault containing production encryption keys.\n\n**Approach**:\n1. Review the attack path in the cloud security graph showing: Internet -> SQL Server (CVE) -> Service Principal -> Key Vault\n2. Immediately restrict the SQL Server firewall to private endpoints only\n3. Apply the SQL Server security patch through Azure Update Management\n4. Rotate the service principal credentials and scope its permissions to only the required database operations\n5. Add a Key Vault access policy requiring the service principal to authenticate via managed identity rather than secret-based credentials\n6. Verify the attack path is resolved in Defender CSPM within 24 hours\n\n**Pitfalls**: Focusing on the SQL vulnerability alone misses the lateral movement path to Key Vault. Restricting the endpoint without updating application connection strings causes an outage.\n\n## Output Format\n\n```\nMicrosoft Defender for Cloud Security Report\n=============================================\nTenant: acme-corp.onmicrosoft.com\nSubscriptions Monitored: 12\nReport Date: 2025-02-23\n\nSECURE SCORE: 72\u002F100\n\nDEFENDER PLANS STATUS:\n  Servers (P2):     ENABLED - 156 VMs covered\n  Containers:       ENABLED - 8 AKS clusters covered\n  Storage:          ENABLED - 342 storage accounts, malware scanning active\n  Databases:        ENABLED - 23 SQL servers, 5 Cosmos DB accounts\n  Key Vault:        ENABLED - 18 vaults monitored\n  AWS Connector:    ENABLED - 3 accounts connected\n  GCP Connector:    ENABLED - 2 projects connected\n\nCRITICAL ATTACK PATHS:\n  [AP-001] Internet -> VM (RDP open) -> Managed Identity -> Storage (PII data)\n    Risk: Critical | Affected Resources: 3 | Remediation: Close RDP, restrict MI scope\n  [AP-002] Internet -> App Service (SQLi vuln) -> SQL DB -> Service Principal -> Key Vault\n    Risk: Critical | Affected Resources: 5 | Remediation: Patch app, private endpoint\n\nALERT SUMMARY (Last 30 Days):\n  Critical: 5 | High: 23 | Medium: 67 | Low: 134\n  Top Alert Types:\n    - Suspicious login activity (18)\n    - Malware detected in storage (7)\n    - Anomalous resource deployment (12)\n```\n","# Securing Azure with Microsoft Defender\n\n## When to Use\n\n- When deploying cloud workload protection across Azure subscriptions and resource groups\n- When establishing a Secure Score baseline and prioritizing security recommendations\n- When extending threat protection to multi-cloud environments including AWS and GCP\n- When enabling container security for AKS clusters and Azure Container Registry\n- When integrating AI workload security with the Data and AI security dashboard\n\n**Do not use** for AWS-only environments (see implementing-aws-security-hub), for identity provider configuration (see managing-cloud-identity-with-okta), or for network-level firewall rule management (see implementing-cloud-waf-rules).\n\n## Prerequisites\n\n- Azure subscription with Security Admin or Contributor role\n- Azure Policy initiative for Defender for Cloud enabled at the management group level\n- Log Analytics workspace provisioned for security data collection\n- Microsoft Defender for Cloud plans licensed (P1 or P2 for server protection)\n\n## Workflow\n\n### Step 1: Enable Defender for Cloud Plans\n\nActivate Defender plans for each workload type: Servers, Containers, App Service, Storage, Databases, Key Vault, Resource Manager, and DNS. Each plan provides specialized threat detection and vulnerability assessment.\n\n```powershell\n# Enable Defender for Servers Plan 2\naz security pricing create --name VirtualMachines --tier Standard --subplan P2\n\n# Enable Defender for Containers\naz security pricing create --name Containers --tier Standard\n\n# Enable Defender for Storage with malware scanning\naz security pricing create --name StorageAccounts --tier Standard \\\n  --extensions '[{\"name\":\"OnUploadMalwareScanning\",\"isEnabled\":\"True\",\n  \"additionalExtensionProperties\":{\"CapGBPerMonthPerStorageAccount\":\"5000\"}}]'\n\n# Enable Defender for Databases\naz security pricing create --name SqlServers --tier Standard\naz security pricing create --name CosmosDbs --tier Standard\n\n# Enable Defender for Key Vault\naz security pricing create --name KeyVaults --tier Standard\n\n# Verify all enabled plans\naz security pricing list --query \"[?pricingTier=='Standard'].{Plan:name, Tier:pricingTier, SubPlan:subPlan}\" -o table\n```\n\n### Step 2: Configure Environment Connectors for Multi-Cloud\n\nConnect AWS accounts and GCP projects to Defender for Cloud for unified security posture management across cloud providers.\n\n```powershell\n# Create AWS connector for CSPM\naz security security-connector create \\\n  --name aws-production-connector \\\n  --resource-group security-rg \\\n  --environment-name AWS \\\n  --hierarchy-identifier \"123456789012\" \\\n  --offerings '[{\n    \"offeringType\": \"CspmMonitorAws\",\n    \"nativeCloudConnection\": {\"cloudRoleArn\": \"arn:aws:iam::123456789012:role\u002FDefenderForCloudRole\"}\n  }]'\n\n# Create GCP connector\naz security security-connector create \\\n  --name gcp-production-connector \\\n  --resource-group security-rg \\\n  --environment-name GCP \\\n  --hierarchy-identifier \"my-gcp-project-id\" \\\n  --offerings '[{\"offeringType\": \"CspmMonitorGcp\"}]'\n```\n\n### Step 3: Review and Prioritize Secure Score Recommendations\n\nAnalyze the Secure Score across all subscriptions. Each recommendation includes a risk priority based on asset exposure, internet exposure, and threat intelligence context.\n\n```powershell\n# Get current Secure Score\naz security secure-score list \\\n  --query \"[].{Name:displayName, Score:current, Max:max, Percentage:percentage}\" -o table\n\n# List unhealthy recommendations sorted by severity\naz security assessment list \\\n  --query \"[?properties.status.code=='Unhealthy'].{Name:properties.displayName, Severity:properties.metadata.severity, Resources:properties.resourceDetails.id}\" \\\n  --output table\n\n# Get specific recommendation details\naz security assessment show \\\n  --assessment-name \"4fb67663-9ab9-475d-b026-8c544cced439\" \\\n  --query \"{Name:properties.displayName, Description:properties.metadata.description, Remediation:properties.metadata.remediationDescription}\"\n```\n\n### Step 4: Configure Adaptive Application Controls and JIT Access\n\nEnable Just-In-Time VM access to reduce the attack surface by opening management ports only when needed, and deploy adaptive application controls to whitelist approved executables.\n\n```powershell\n# Enable JIT VM access policy\naz security jit-policy create \\\n  --resource-group production-rg \\\n  --location eastus \\\n  --name default \\\n  --virtual-machines '[{\n    \"id\": \"\u002Fsubscriptions\u002Fsub-id\u002FresourceGroups\u002Fproduction-rg\u002Fproviders\u002FMicrosoft.Compute\u002FvirtualMachines\u002Fweb-server-01\",\n    \"ports\": [\n      {\"number\": 22, \"protocol\": \"TCP\", \"allowedSourceAddressPrefix\": \"10.0.0.0\u002F8\", \"maxRequestAccessDuration\": \"PT3H\"},\n      {\"number\": 3389, \"protocol\": \"TCP\", \"allowedSourceAddressPrefix\": \"10.0.0.0\u002F8\", \"maxRequestAccessDuration\": \"PT1H\"}\n    ]\n  }]'\n\n# Request JIT access\naz security jit-policy initiate \\\n  --resource-group production-rg \\\n  --location eastus \\\n  --name default \\\n  --virtual-machines '[{\n    \"id\": \"\u002Fsubscriptions\u002Fsub-id\u002FresourceGroups\u002Fproduction-rg\u002Fproviders\u002FMicrosoft.Compute\u002FvirtualMachines\u002Fweb-server-01\",\n    \"ports\": [{\"number\": 22, \"duration\": \"PT1H\", \"allowedSourceAddressPrefix\": \"203.0.113.10\"}]\n  }]'\n```\n\n### Step 5: Set Up Security Alerts and Workflow Automation\n\nConfigure workflow automation to trigger Logic Apps or Azure Functions when security alerts are generated. Set up email notifications for Critical and High severity alerts.\n\n```powershell\n# Create workflow automation for high severity alerts\naz security automation create \\\n  --name high-severity-alert-automation \\\n  --resource-group security-rg \\\n  --scopes '[{\"description\": \"Production subscription\", \"scopePath\": \"\u002Fsubscriptions\u002F\u003Csub-id>\"}]' \\\n  --sources '[{\n    \"eventSource\": \"Alerts\",\n    \"ruleSets\": [{\"rules\": [{\"propertyJPath\": \"Severity\", \"propertyType\": \"String\", \"expectedValue\": \"High\", \"operator\": \"Equals\"}]}]\n  }]' \\\n  --actions '[{\n    \"logicAppResourceId\": \"\u002Fsubscriptions\u002F\u003Csub-id>\u002FresourceGroups\u002Fsecurity-rg\u002Fproviders\u002FMicrosoft.Logic\u002Fworkflows\u002Falert-handler\",\n    \"actionType\": \"LogicApp\"\n  }]'\n\n# Configure email notifications\naz security contact create \\\n  --name default \\\n  --email \"soc-team@company.com\" \\\n  --alert-notifications \"on\" \\\n  --alerts-to-admins \"on\"\n```\n\n### Step 6: Enable Cloud Security Graph and Attack Path Analysis\n\nUse the cloud security graph to visualize attack paths that adversaries could exploit to reach critical assets. Prioritize remediation based on actual exploitability rather than individual finding severity.\n\n```\n# Query attack paths via Resource Graph\naz graph query -q \"\n  securityresources\n  | where type == 'microsoft.security\u002Fattackpaths'\n  | extend riskLevel = properties.riskLevel\n  | extend entryPoint = properties.attackPathDisplayName\n  | where riskLevel == 'Critical'\n  | project entryPoint, riskLevel, properties.description\n  | limit 20\n\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Secure Score | A numerical measure of an organization's security posture based on the percentage of implemented security recommendations, scored per subscription and aggregated at the management group level |\n| Cloud Security Graph | A graph database mapping relationships between cloud resources, identities, network exposure, and vulnerabilities to identify exploitable attack paths |\n| Attack Path Analysis | Visualization of multi-step attack chains an adversary could follow from an entry point to a high-value target, prioritized by real-world exploitability |\n| Just-In-Time Access | Security control that blocks management ports by default and opens them temporarily upon approved request, reducing the VM attack surface |\n| Adaptive Application Controls | Machine-learning-based allowlisting that recommends which applications should run on VMs and alerts on deviations |\n| Defender CSPM | Enhanced cloud security posture management plan providing agentless scanning, attack path analysis, and cloud security graph capabilities |\n| Security Connector | Integration point connecting AWS or GCP environments to Defender for Cloud for multi-cloud posture management |\n\n## Tools & Systems\n\n- **Microsoft Defender for Cloud**: Core CNAPP platform providing CSPM, CWP, and threat protection across Azure, AWS, and GCP\n- **Azure Resource Graph**: Query engine for exploring cloud security graph data and attack paths at scale\n- **Azure Logic Apps**: Workflow automation platform for building remediation playbooks triggered by Defender alerts\n- **Microsoft Defender Portal**: Unified security operations console integrating Defender for Cloud with XDR, Sentinel, and threat intelligence\n- **Azure Policy**: Governance engine for enforcing Defender for Cloud recommendations as compliance requirements\n\n## Common Scenarios\n\n### Scenario: Internet-Exposed SQL Server with Known Vulnerability\n\n**Context**: Defender for Cloud identifies an Azure SQL Server with a public endpoint, an unpatched critical CVE, and a service principal with database owner permissions that also has access to a Key Vault containing production encryption keys.\n\n**Approach**:\n1. Review the attack path in the cloud security graph showing: Internet -> SQL Server (CVE) -> Service Principal -> Key Vault\n2. Immediately restrict the SQL Server firewall to private endpoints only\n3. Apply the SQL Server security patch through Azure Update Management\n4. Rotate the service principal credentials and scope its permissions to only the required database operations\n5. Add a Key Vault access policy requiring the service principal to authenticate via managed identity rather than secret-based credentials\n6. Verify the attack path is resolved in Defender CSPM within 24 hours\n\n**Pitfalls**: Focusing on the SQL vulnerability alone misses the lateral movement path to Key Vault. Restricting the endpoint without updating application connection strings causes an outage.\n\n## Output Format\n\n```\nMicrosoft Defender for Cloud Security Report\n=============================================\nTenant: acme-corp.onmicrosoft.com\nSubscriptions Monitored: 12\nReport Date: 2025-02-23\n\nSECURE SCORE: 72\u002F100\n\nDEFENDER PLANS STATUS:\n  Servers (P2):     ENABLED - 156 VMs covered\n  Containers:       ENABLED - 8 AKS clusters covered\n  Storage:          ENABLED - 342 storage accounts, malware scanning active\n  Databases:        ENABLED - 23 SQL servers, 5 Cosmos DB accounts\n  Key Vault:        ENABLED - 18 vaults monitored\n  AWS Connector:    ENABLED - 3 accounts connected\n  GCP Connector:    ENABLED - 2 projects connected\n\nCRITICAL ATTACK PATHS:\n  [AP-001] Internet -> VM (RDP open) -> Managed Identity -> Storage (PII data)\n    Risk: Critical | Affected Resources: 3 | Remediation: Close RDP, restrict MI scope\n  [AP-002] Internet -> App Service (SQLi vuln) -> SQL DB -> Service Principal -> Key Vault\n    Risk: Critical | Affected Resources: 5 | Remediation: Patch app, private endpoint\n\nALERT SUMMARY (Last 30 Days):\n  Critical: 5 | High: 23 | Medium: 67 | Low: 134\n  Top Alert Types:\n    - Suspicious login activity (18)\n    - Malware detected in storage (7)\n    - Anomalous resource deployment (12)\n```\n",{"name":5,"tags":49,"author":51,"domain":42,"license":15,"version":52,"nist_csf":53,"subdomain":36,"description":58,"nist_ai_rmf":59,"mitre_attack":63,"atlas_techniques":69},[50,31,32,30,29],"microsoft-defender","mahipal","1.0.0",[54,55,56,57],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01","Deploys and configures Microsoft Defender for Cloud as a CNAPP for Azure, multi-cloud, and hybrid environments: enabling Defender plans for servers, containers, storage, and databases, configuring recommendations, and managing Secure Score via the unified Defender portal. Use when onboarding workloads to Defender for Cloud or setting up cloud workload protection and threat monitoring.\n",[60,61,62],"MEASURE-2.7","MAP-5.1","MANAGE-2.4",[64,65,66,67,68],"T1078.004","T1530","T1537","T1580","T1610",[70,71,72],"AML.T0070","AML.T0066","AML.T0082","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fsecuring-azure-with-microsoft-defender",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":84,"prompt":94,"zipAvailable":95},[85,88,91],{"tool":86,"command":87},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill securing-azure-with-microsoft-defender",{"tool":89,"command":90},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill securing-azure-with-microsoft-defender",{"tool":92,"command":93},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill securing-azure-with-microsoft-defender","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fsecuring-azure-with-microsoft-defender\u002FSKILL.md",true,[97,103,107,111,116,120,126,130],{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"examples\u002Fconsole_logging.py","SCRIPT","脚本",1027,"https:\u002F\u002Fgithub.com\u002Fjleechanorg\u002Fjleechan-skills\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fwebapp-testing\u002Fexamples\u002Fconsole_logging.py",{"path":104,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":105,"sourceHtmlUrl":106},"examples\u002Felement_discovery.py",1463,"https:\u002F\u002Fgithub.com\u002Fjleechanorg\u002Fjleechan-skills\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fwebapp-testing\u002Fexamples\u002Felement_discovery.py",{"path":108,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":109,"sourceHtmlUrl":110},"examples\u002Fstatic_html_automation.py",953,"https:\u002F\u002Fgithub.com\u002Fjleechanorg\u002Fjleechan-skills\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fwebapp-testing\u002Fexamples\u002Fstatic_html_automation.py",{"path":112,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fsecuring-azure-with-microsoft-defender\u002FLICENSE",{"path":117,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":118,"sourceHtmlUrl":119},"LICENSE.txt",11357,"https:\u002F\u002Fgithub.com\u002Fjleechanorg\u002Fjleechan-skills\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fwebapp-testing\u002FLICENSE.txt",{"path":121,"resourceType":122,"resourceTypeDesc":123,"sizeBytes":124,"sourceHtmlUrl":125},"references\u002Fapi-reference.md","REFERENCE","参考文档",2017,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fsecuring-azure-with-microsoft-defender\u002Freferences\u002Fapi-reference.md",{"path":127,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":128,"sourceHtmlUrl":129},"scripts\u002Fagent.py",6933,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fsecuring-azure-with-microsoft-defender\u002Fscripts\u002Fagent.py",{"path":131,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":132,"sourceHtmlUrl":133},"scripts\u002Fwith_server.py",3693,"https:\u002F\u002Fgithub.com\u002Fjleechanorg\u002Fjleechan-skills\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fwebapp-testing\u002Fscripts\u002Fwith_server.py",[135,160,184,211,237,264],{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":142,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[141],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[143,144,145,146,43,42,147,148,38,149,150,151,152,153,154,155,156,157,158,159],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":167,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[166],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[168,156,169,170,43,171,42,38,172,173,174,175,176,177,178,179,180,181,182,183],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":194,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[190,193],{"categoryNo":191,"categoryName":192,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[178,195,196,197,198,42,199,200,172,201,202,203,204,205,206,34,207,208,209,210],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":218,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[217],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[219,220,221,42,222,223,224,225,226,227,228,229,230,231,232,233,175,234,235,236],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":238,"name":239,"nameZh":6,"description":240,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":241,"categories":242,"keywords":244,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[243],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[245,246,247,42,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":265,"name":266,"nameZh":6,"description":267,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":268,"categories":269,"keywords":271,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[270],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[43,272,42,273,274,275,276,277,278,279,280,34,281,207,282,283,284,285,286,287],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]