Deploy-ASC-SecurityContacts is always non-compliantBug Report #1627

NucLabs · 2024-04-25T10:43:10Z

Describe the bug
It appears to me that the same problem as #1477 is back.
Not only Deploy-ASC-SecurityContacts isn't evaluating correctly anymore: the same problem seems to be the case with the builtin policy Email notification for high severity alerts should be enabled (6e2593d9-add6-4083-9c9b-4b7d2188c899) that is non-compliant in all our subscriptions.

Steps to reproduce

Assign the policy definition Deploy-ASC-SecurityContacts to a subscription and define the Security contacts email address, Effect and Minimal severity (High) parameters
Wait for evaluation
Remediate, if necesarry
Wait for evaluation, the resource (subscription will be non-compliant. The reason reported is that Microsoft.Security/securityContacts/alertNotifications.minimalSeverity has no value while the Target value is "High"

Compare the screenshot below with the output of the api where minimalSeverity is set to High:

(Invoke-AzRestMethod -Method 'Get' -Path ('/subscriptions/9fa****************/providers/Microsoft.Security/securityContacts?api-version=2020-01-01-preview')).Content|ConvertFrom-Json -Depth 10|ConvertTo-Json -Depth 10
{
  "properties": {
    "alertNotifications": {
      "state": "On",
      "minimalSeverity": "High"
    },
    "notificationsByRole": {
      "state": "On",
      "roles": [
        "Owner"
      ]
    },
    "emails": "(redacted)",
    "phone": ""
  },
  "id": "/subscriptions/9fa**********/providers/Microsoft.Security/securityContacts/default",
  "name": "default",
  "type": "Microsoft.Security/securityContacts",
  "etag": "\"4300***************\"",
  "location": "West Europe"
}

Screenshots

The text was updated successfully, but these errors were encountered:

Springstone · 2024-04-26T05:16:45Z

@NucLabs I can confirm the same from my side. Can I ask that you open a support ticket for the built-in policy you mentioned above, as it involves the same logic that is failing.

Essentially:

Microsoft.Security/securityContacts/alertNotifications.minimalSeverity

is not evaluating properly in policy.
We'll investigate further, and try find someone in PG to help sort this out, but opening a support ticket might be a quicker path.

NucLabs · 2024-04-26T07:03:03Z

Support ticket #2404260050000291

donk-msft · 2024-05-03T08:25:48Z

@NucLabs I can confirm the same from my side as well.

Springstone · 2024-05-03T13:24:26Z

Just to update all on this issue. I've opened an internal support ticket for the same. It is a confirmed issue that has been escalated to the Defender team, as that is where the issue is (due to API changes affecting properties we are querying). Nothing we can do, but will keep this issue open for tracking.

itzkhayer · 2024-05-04T11:10:33Z

Same issue I have had for the past 2 weeks, got MS ticket opened and engineer provided me a script where it does show compliance but it doesn't actually do the job of deploying the security contact email. whats the point of that lol.

here the json script incase it helps anyone to figure it out

{
"mode": "All",
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Resources/subscriptions"
}
]
},
"then": {
"effect": "[parameters('effect')]",
"details": {
"type": "Microsoft.Security/securityContacts",
"deploymentScope": "subscription",
"existenceScope": "subscription",
"roleDefinitionIds": [
"/providers/Microsoft.Authorization/roleDefinitions/fb1c8493-542b-48eb-b624-b4c8fea62acd"
],
"existenceCondition": {
"not": {
"allOf": [
{
"field": "Microsoft.Security/securityContacts/alertsToAdmins",
"equals": "Off"
},
{
"field": "Microsoft.Security/securityContacts/email",
"notcontains": "[parameters('emailSecurityContact')]"
},
{
"anyOf": [
{
"field": "Microsoft.Security/securityContacts/alertNotifications.minimalSeverity",
"equals": "High"
},
{
"count": {
"field": "Microsoft.Security/securityContacts/notificationsSources[]",
"where": {
"allOf": [
{
"field": "Microsoft.Security/securityContacts/notificationsSources[].sourceType",
"equals": "Alert"
},
{
"field": "Microsoft.Security/securityContacts/notificationsSources[*].Alert.minimalSeverity",
"equals": "[parameters('minimalSeverity')]"
}
]
}
},
"equals": 1
}
]
}
]
}
},
"deployment": {
"location": "northeurope",
"properties": {
"mode": "incremental",
"parameters": {
"emailSecurityContact": {
"value": "[parameters('emailSecurityContact')]"
},
"minimalSeverity": {
"value": "[parameters('minimalSeverity')]"
}
},
"template": {
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"emailSecurityContact": {
"type": "string",
"metadata": {
"description": "Security contacts email address"
}
},
"minimalSeverity": {
"type": "string",
"metadata": {
"description": "Minimal severity level reported"
}
}
},
"variables": {},
"resources": [
{
"type": "Microsoft.Security/securityContacts",
"name": "default",
"apiVersion": "2020-01-01-preview",
"properties": {
"emails": "[parameters('emailSecurityContact')]",
"notificationsByRole": {
"state": "On",
"roles": [
"Owner"
]
},
"alertNotifications": {
"state": "On",
"minimalSeverity": "[parameters('minimalSeverity')]"
}
}
}
],
"outputs": {}
}
}
}
}
}
},
"parameters": {
"emailSecurityContact": {
"type": "String",
"metadata": {
"displayName": "Security contacts email address",
"description": "Provide email address for Azure Security Center contact details"
}
},
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"DeployIfNotExists",
"Disabled"
],
"defaultValue": "DeployIfNotExists"
},
"minimalSeverity": {
"type": "String",
"metadata": {
"displayName": "Minimal severity",
"description": "Defines the minimal alert severity which will be sent as email notifications"
},
"allowedValues": [
"High",
"Medium",
"Low"
],
"defaultValue": "High"
}
}
}

itzkhayer · 2024-05-04T12:51:47Z

I fixed it myself!!! I changed environment setting email and alert purposely.. then deleted policy. remade new policy with my own script and it deployed email and alert and compliance status approved!!

{
"mode": "All",
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Resources/subscriptions"
}
]
},
"then": {
"effect": "[parameters('effect')]",
"details": {
"type": "Microsoft.Security/securityContacts",
"deploymentScope": "subscription",
"existenceScope": "subscription",
"roleDefinitionIds": [
"/providers/Microsoft.Authorization/roleDefinitions/fb1c8493-542b-48eb-b624-b4c8fea62acd"
],
"existenceCondition": {
"allOf": [
{
"field": "Microsoft.Security/securityContacts/alertsToAdmins",
"equals": "On"
},
{
"field": "Microsoft.Security/securityContacts/email",
"contains": "[parameters('emailSecurityContact')]"
},
{
"anyOf": [
{
"field": "Microsoft.Security/securityContacts/alertNotifications.minimalSeverity",
"equals": "High"
},
{
"count": {
"field": "Microsoft.Security/securityContacts/notificationsSources[]",
"where": {
"allOf": [
{
"field": "Microsoft.Security/securityContacts/notificationsSources[].sourceType",
"equals": "Alert"
},
{
"field": "Microsoft.Security/securityContacts/notificationsSources[*].Alert.minimalSeverity",
"equals": "[parameters('minimalSeverity')]"
}
]
}
},
"equals": 1
}
]
}
]
},
"deployment": {
"location": "northeurope",
"properties": {
"mode": "incremental",
"parameters": {
"emailSecurityContact": {
"value": "[parameters('emailSecurityContact')]"
},
"minimalSeverity": {
"value": "[parameters('minimalSeverity')]"
}
},
"template": {
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"emailSecurityContact": {
"type": "string",
"metadata": {
"description": "Security contacts email address"
}
},
"minimalSeverity": {
"type": "string",
"metadata": {
"description": "Minimal severity level reported"
}
}
},
"variables": {},
"resources": [
{
"type": "Microsoft.Security/securityContacts",
"name": "default",
"apiVersion": "2020-01-01-preview",
"properties": {
"emails": "[parameters('emailSecurityContact')]",
"notificationsByRole": {
"state": "On",
"roles": [
"Owner"
]
},
"alertNotifications": {
"state": "On",
"minimalSeverity": "[parameters('minimalSeverity')]"
}
}
}
],
"outputs": {}
}
}
}
}
}
},
"parameters": {
"emailSecurityContact": {
"type": "String",
"metadata": {
"displayName": "Security contacts email address",
"description": "Provide email address for Azure Security Center contact details"
}
},
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"DeployIfNotExists",
"Disabled"
],
"defaultValue": "DeployIfNotExists"
},
"minimalSeverity": {
"type": "String",
"metadata": {
"displayName": "Minimal severity",
"description": "Defines the minimal alert severity which will be sent as email notifications"
},
"allowedValues": [
"High",
"Medium",
"Low"
],
"defaultValue": "High"
}
}
}

itzkhayer · 2024-05-04T12:53:30Z

I might try work on and get this setting turned on ''Notify about attack paths with the following risk level (or higher):''

itzkhayer · 2024-05-09T13:59:30Z

Any news on when ''Email notification for high severity alerts should be enabled'' audit will be solved? I could create custom and solve it but would rather have this auto solved as it falls in CIS initiative

Springstone · 2024-05-13T21:33:50Z

Any news on when ''Email notification for high severity alerts should be enabled'' audit will be solved? I could create custom and solve it but would rather have this auto solved as it falls in CIS initiative

According to PG, they have published an updated version of that policy that should always work. If it doesn't, PLEASE open a support ticket!!

NucLabs · 2024-05-14T07:28:18Z

@Springstone From my holiday address in Italy I can confirm that the builtin policy is fixed indeed.

neok-g · 2024-05-22T07:10:44Z

@Springstone I can confirm that the built-in policy Email notification for high severity alerts should be enabled (6e2593d9-add6-4083-9c9b-4b7d2188c899) is now compliant. However the Enterprise Scale custom policy Deploy Microsoft Defender for Cloud Security Contacts (Deploy-ASC-SecurityContacts) is still non-compliant.

Springstone · 2024-06-06T11:05:54Z

Hi all, this is correct. Looks like PG went and made some fundamental changes to the API, and published a new version, deprecating "alertNotifications" and replacing it with "NotificationSources" as per the latest API documentation here: https://learn.microsoft.com/en-us/rest/api/defenderforcloud/security-contacts/create?view=rest-defenderforcloud-2023-12-01-preview&tabs=HTTP

Now that we've completed the policy refresh, we'll address the issue for our custom policy asap.

Springstone · 2024-06-06T13:51:45Z

@neok-g @NucLabs @itzkhayer @donk-msft I've worked on updating this and ask you to please confirm my positive results. Latest version of the policy is here in this PR : #1663

donk-msft · 2024-06-07T08:27:49Z

@Springstone I left some comments in the PR, but once those issues are resolved the policy is working for me.

Springstone · 2024-06-07T08:57:44Z

@donk-msft can't find your comments in the PR, could you share here or on Teams :D

donk-msft · 2024-06-07T09:50:32Z

@Springstone that's strange... My comments are:

77: Double [[ in "[[parameters('emailSecurityContact')]"
85: Double [[ in "[[parameters('minimalSeverity')]"
125: Double [[ in "[[parameters('emailSecurityContact')]"
126: Should be 'isEnabled' according to link

Springstone · 2024-06-07T09:57:00Z

For 126, well spotted! The [[ is required due to how we package the policies into a single ARM template, so its by design. Many thanks for your input!

NucLabs · 2024-06-07T10:35:41Z

@Springstone
I copy/pasted the code into the policy editor the portal.
The editor complained about a few parameter types that are defined als lowercase "string", but should be pascal-cased "String"

"minimalSeverity": { "type": "string",

"minimalSeverity": { "type": "String",

I also had to fix the double [['s, I already found out one (long) day that it is some kind of escape sequence :-)

Despite the 'isEnable' issue spotted by @donk-msft the evaluation and remediation are working OK for me

Springstone · 2024-06-08T16:44:53Z

Fixed in PR #1663

neok-g · 2024-06-12T05:59:27Z

Great! When will these changes be synced to ALZ-bicep repo?

Springstone · 2024-06-12T11:16:47Z

@neok-g should be arriving sometime next week.

NucLabs added the bug Something isn't working label Apr 25, 2024

Springstone added Area: MDFC 🔒 Issues / PR's related to Microsoft Defender for Cloud Area: Policy 📝 Issues / PR's related to Policy labels May 17, 2024

Springstone mentioned this issue May 21, 2024

Policy Deploy-ASC-SecurityContacts is always non-compliant #1637

Closed

jtracey93 mentioned this issue Jun 7, 2024

chore: Update Deploy-ASC-SecurityContacts version to 2.0.0 #1663

Merged

7 tasks

Springstone closed this as completed Jun 8, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deploy-ASC-SecurityContacts is always non-compliantBug Report #1627

Deploy-ASC-SecurityContacts is always non-compliantBug Report #1627

NucLabs commented Apr 25, 2024

Springstone commented Apr 26, 2024

NucLabs commented Apr 26, 2024

donk-msft commented May 3, 2024

Springstone commented May 3, 2024

itzkhayer commented May 4, 2024

itzkhayer commented May 4, 2024

itzkhayer commented May 4, 2024

itzkhayer commented May 9, 2024

Springstone commented May 13, 2024

NucLabs commented May 14, 2024

neok-g commented May 22, 2024

Springstone commented Jun 6, 2024

Springstone commented Jun 6, 2024

donk-msft commented Jun 7, 2024

Springstone commented Jun 7, 2024 •

edited

Loading

donk-msft commented Jun 7, 2024

Springstone commented Jun 7, 2024

NucLabs commented Jun 7, 2024 •

edited

Loading

Springstone commented Jun 8, 2024

neok-g commented Jun 12, 2024 •

edited

Loading

Springstone commented Jun 12, 2024

Deploy-ASC-SecurityContacts is always non-compliantBug Report #1627

Deploy-ASC-SecurityContacts is always non-compliantBug Report #1627

Comments

NucLabs commented Apr 25, 2024

Springstone commented Apr 26, 2024

NucLabs commented Apr 26, 2024

donk-msft commented May 3, 2024

Springstone commented May 3, 2024

itzkhayer commented May 4, 2024

itzkhayer commented May 4, 2024

itzkhayer commented May 4, 2024

itzkhayer commented May 9, 2024

Springstone commented May 13, 2024

NucLabs commented May 14, 2024

neok-g commented May 22, 2024

Springstone commented Jun 6, 2024

Springstone commented Jun 6, 2024

donk-msft commented Jun 7, 2024

Springstone commented Jun 7, 2024 • edited Loading

donk-msft commented Jun 7, 2024

Springstone commented Jun 7, 2024

NucLabs commented Jun 7, 2024 • edited Loading

Springstone commented Jun 8, 2024

neok-g commented Jun 12, 2024 • edited Loading

Springstone commented Jun 12, 2024

Springstone commented Jun 7, 2024 •

edited

Loading

NucLabs commented Jun 7, 2024 •

edited

Loading

neok-g commented Jun 12, 2024 •

edited

Loading