Ensure Vulnerability Assessment Setting To Send Email Notifications To Admins And Subscription Owners Is Set

Using Console

To remediate this misconfiguration in Azure using the Azure console, follow these steps:

Log in to the Azure portal (https://portal.azure.com/).
Navigate to the Security Center dashboard.
Click on “Security policy” on the left-hand side of the screen.
Select the subscription you want to remediate.
Click on “Vulnerability assessment settings” in the “Security policy” window.
Ensure that the “Email notifications to subscription owners and admins” toggle is turned on.
If the toggle is not turned on, click on the toggle to turn it on.
Click on “Save” to save the changes.

Once you have completed these steps, the vulnerability assessment setting will be configured to send email notifications to subscription owners and admins in case of any security issues.

Using CLI

To remediate the misconfiguration “Ensure Vulnerability Assessment Setting To Send Email Notifications To Admins And Subscription Owners Is Set” for Azure using Azure CLI, follow the below steps:

Open the Azure CLI on your computer.
Login to your Azure account using the command: az login
Select the Azure subscription in which the misconfiguration exists using the command: az account set --subscription <subscription_id> Replace <subscription_id> with the ID of your Azure subscription.
Run the below command to enable email notifications for vulnerability assessment: az security va-notification-contacts create --email <email_address> --phone <phone_number> --alert-notifications true --security-contact-name <contact_name> Replace <email_address> with the email address of the admin or subscription owner who needs to receive the email notifications. Replace <phone_number> with the phone number of the admin or subscription owner who needs to receive the SMS notifications. Replace <contact_name> with the name of the contact to be created.
If you want to verify that the email notifications have been enabled, you can run the below command: az security va-notification-contacts list This command will list all the notification contacts that have been created.

By following the above steps, you can remediate the misconfiguration “Ensure Vulnerability Assessment Setting To Send Email Notifications To Admins And Subscription Owners Is Set” for Azure using Azure CLI.

Using Python

To remediate the misconfiguration “Ensure Vulnerability Assessment Setting To Send Email Notifications To Admins And Subscription Owners Is Set” for Azure using Python, follow the below steps:

Import the required libraries:

from azure.identity import DefaultAzureCredential
from azure.mgmt.security import SecurityCenter
from azure.mgmt.security.models import SecurityAssessmentMetadata, SecurityAssessmentStatus, EmailNotificationSubscription

Authenticate to Azure using the DefaultAzureCredential:

credential = DefaultAzureCredential()
security_center_client = SecurityCenter(credential, "your_subscription_id")

Get the current email notification settings:

email_notification_settings = security_center_client.settings.get("emailNotificationSettings")

Check if the email notification settings are configured to send notifications to admins and subscription owners:

if email_notification_settings.send_to_admins_and_subscription_owners is False:
    email_notification_settings.send_to_admins_and_subscription_owners = True
    security_center_client.settings.create_or_update("emailNotificationSettings", email_notification_settings)

Create a new email notification subscription:

email_notification_subscription = EmailNotificationSubscription(
    name="Your Subscription Name",
    email_addresses=["admin@example.com", "owner@example.com"],
    assessment_metadata=SecurityAssessmentMetadata(
        display_name="Security Assessment",
        description="This email notification is sent when a new security assessment is available.",
        severity="High"
    ),
    status=SecurityAssessmentStatus(
        new_assessment=True,
        updated_assessment=True,
        resolved_assessment=True
    )
)

security_center_client.notifications.create_email_subscription(email_notification_subscription)

Verify that the email notification subscription was created successfully:

email_notification_subscriptions = security_center_client.notifications.list_email_subscriptions()
for subscription in email_notification_subscriptions:
    print(subscription.name)

By following these steps, you can remediate the misconfiguration “Ensure Vulnerability Assessment Setting To Send Email Notifications To Admins And Subscription Owners Is Set” for Azure using Python.

Using Terraform

resource "azurerm_mssql_server" "sql_server" {
  name                         = "SQL_SERVER_NAME"
  resource_group_name          = azurerm_resource_group.rg.name
  location                     = azurerm_resource_group.rg.location
  version                      = "12.0"
  administrator_login          = "SQL_ADMIN_USERNAME"
  administrator_login_password = "SQL_ADMIN_PASSWORD"

  # ...any other required arguments...
}

# Vulnerability Assessment configuration with email notifications to admins/subscription owners
resource "azurerm_mssql_server_vulnerability_assessment" "sql_server_va" {
  server_id = azurerm_mssql_server.sql_server.id

  storage_container_path = "https://STORAGE_ACCOUNT_NAME.blob.core.windows.net/CONTAINER_NAME/"
  storage_account_access_key = "STORAGE_ACCOUNT_ACCESS_KEY" # or use a key vault reference instead

  recurring_scans {
    enabled                   = true
    email_subscription_admins = true   # This enables email notifications to admins and subscription owners
    # Optionally add additional recipients:
    # emails = ["SECURITY_TEAM_EMAIL@example.com"]
  }
}

This change does not replace the existing SQL server; it adds/enables the Vulnerability Assessment configuration on it. After applying, terraform plan should show creation or update of azurerm_mssql_server_vulnerability_assessment.sql_server_va with recurring_scans.email_subscription_admins = true.

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Ensure Vulnerability Assessment Setting To Send Email Notifications To Admins And Subscription Owners Is Set

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: