azure.defender-setting

Top-level Microsoft Defender settings for a subscription.

example:

Check that the MCAS integration with Microsoft Defender is enabled.

policies:
  - name: azure-defender-mcas-enabled
    resource: azure.defender-setting
    filters:
    - name: MCAS
    - kind: DataExportSettings
    - properties.enabled: True

Filters

advisor-recommendation

Filter resources by Azure Advisor Recommendations

Select all categories with ‘all’

example:

policies:
  - name: disks-with-cost-recommendations
    resource: azure.disk
    filters:
      - type: advisor-recommendation
        category: Cost
        key: '[].properties.recommendationTypeId'
        op: contains
        value: '48eda464-1485-4dcf-a674-d0905df5054a'

Actions