Checks
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
defender_ensure_defender_cspm_is_on
Microsoft Defender for Cloud Cloud Security Posture Management (CSPM) plan is evaluated for standard tier activation. Defender CSPM provides advanced posture management capabilities including attack path analysis, cloud security explorer, agentless scanning, and governance rules.
defender_ensure_defender_for_app_services_is_on
Azure subscriptions are evaluated for Defender for App Service coverage by inspecting the AppServices pricing configuration. The finding indicates whether the plan is set to Standard, which applies protection to App Service resources at the subscription scope.
defender_ensure_defender_for_arm_is_on
Microsoft Defender for Cloud plan for Azure Resource Manager is configured at the Standard tier for the subscription
defender_ensure_defender_for_azure_sql_databases_is_on
Microsoft Defender for Cloud plan for Azure SQL Database Servers is evaluated at subscription scope, expecting the pricing_tier set to Standard for SqlServers. Non-standard tiers indicate the plan isn't enabled.
defender_ensure_defender_for_containers_is_on
Azure subscriptions are assessed to determine if the Defender for Containers plan is configured with pricing tier Standard.
defender_ensure_defender_for_cosmosdb_is_on
Microsoft Defender for Azure Cosmos DB is enabled at the subscription using the Standard pricing tier for the CosmosDbs plan, covering all Cosmos DB accounts
defender_ensure_defender_for_databases_is_on
Azure subscription is evaluated for Defender for Databases coverage: Standard pricing must be enabled for SqlServers, SqlServerVirtualMachines, OpenSourceRelationalDatabases, and CosmosDbs.
defender_ensure_defender_for_dns_is_on
Microsoft Defender for DNS is configured at the Standard tier for the subscription's Defender pricing
defender_ensure_defender_for_keyvault_is_on
Azure subscriptions are evaluated for the Defender for Key Vaults plan configured at the Standard tier. It identifies where Key Vault protection uses this tier versus where the Defender pricing for KeyVaults is not set accordingly.
defender_ensure_defender_for_os_relational_databases_is_on
Microsoft Defender for Cloud plan for Open-Source Relational Databases is evaluated for the Standard pricing tier at the subscription level.
defender_ensure_defender_for_server_is_on
Microsoft Defender for Servers subscription plan (VirtualMachines) is configured to the Standard tier. The evaluation checks whether the Servers plan is enabled at this level for all server workloads in the subscription.
defender_ensure_defender_for_sql_servers_is_on
Subscription pricing for Defender for SQL Server on Machines is configured to the Standard plan, covering SQL Server instances running on virtual machines.
defender_ensure_defender_for_storage_is_on
Azure subscription's Defender for Storage plan is set to Standard for Storage Accounts.
defender_ensure_iot_hub_defender_is_on
Microsoft Defender for IoT security solution exists in the subscription and reports status Enabled for monitored IoT Hub resources.
defender_ensure_mcas_is_enabled
Subscription settings contain the MCAS integration for Microsoft Defender for Cloud Apps, and the setting is enabled.
defender_ensure_notify_alerts_severity_is_high
Microsoft Defender for Cloud email notifications use a minimum alert severity of High or more inclusive (Medium/Low). The evaluation inspects security contacts to confirm a threshold is defined and not Critical.
defender_ensure_notify_emails_to_owners
Microsoft Defender for Cloud email notifications target subscription users in the Owner role through role-based recipients.
defender_ensure_system_updates_are_applied
Azure VMs are evaluated for:
defender_ensure_wdatp_is_enabled
Azure subscription integrates Microsoft Defender for Endpoint with Defender for Cloud via WDATP. The setting's presence and enabled state at the subscription scope are evaluated.
defenderidentity_health_issues_no_open
Microsoft Defender for Identity (MDI) monitors your hybrid identity infrastructure and detects advanced threats targeting Active Directory. This check verifies that MDI sensors are deployed and that there are no unresolved health issues that may affect the ability to detect identity-based attacks.
defender_malware_policy_common_attachments_filter_enabled
Microsoft Defender for Office 365 anti-malware policies use the Common Attachment Types Filter to block risky file formats regardless of extension. The evaluation checks whether this filter is enabled across default and custom policies and considers policy precedence that could override or bypass the protection.
defender_malware_policy_comprehensive_attachments_filter_applied
Microsoft Defender anti-malware policies use the Common Attachment Types Filter to block a comprehensive set of risky file extensions. It evaluates whether the filter is enabled and all recommended types are blocked across the default policy and any enabled custom policies, considering scope and precedence.
defender_malware_policy_notifications_internal_users_malware_enabled
Microsoft Defender for Office 365 anti-malware policies are checked for admin notifications on malware detected from internal senders, ensuring a valid notification address is defined (EnableInternalSenderAdminNotifications and InternalSenderAdminAddress).
Effective settings across default and custom policies are considered.
defender_priority_account_protection_enabled
Priority account protection applies enhanced monitoring and protection to high-value accounts. The tenant-level flag EnablePriorityAccountProtection (from Get-EmailTenantSettings) should be enabled. This check evaluates the tenant-level enablement flag; tagging priority accounts and configuring alert policies must be verified separately.