Checks

Azure MySQL Flexible Server is evaluated for geo-redundant backup. Geo-redundant backup stores backup copies in a paired Azure region, enabling restore and recovery from a full regional outage.

Azure MySQL Flexible Server is evaluated for high availability mode. Zone-redundant or same-zone HA provisions a standby replica and provides automatic failover during planned and unplanned outages.

Azure Database for MySQL Flexible Server uses the tls_version setting to permit only modern TLS for client connections, requiring TLSv1.2+ and excluding TLSv1.0 and TLSv1.1.

Azure Database for MySQL Flexible Server uses the require_secure_transport parameter to enforce encrypted connections. This evaluation determines whether the server is configured to require TLS/SSL for all client sessions.

Azure subscription contains an Azure Bastion host for secure RDP/SSH brokering over TLS on 443/TCP to virtual machines using private IPs. The assessment identifies whether such a bastion is available.

Azure Network Watcher has flow logs enabled for supported targets, such as virtual networks and network security groups, and configured with Traffic Analytics to forward records to a centralized Log Analytics workspace

Azure Network Watcher has flow logs enabled for supported targets, such as virtual networks and network security groups, and configured to retain for at least 90 days (or 0 for unlimited). The evaluation checks that flow logging is enabled and that the retention policy meets the required duration for each configured log.

Azure NSG are evaluated for inbound rules that allow public HTTP access on TCP 80, including cases where 80 is covered by a port range, from 0.0.0.0/0, Internet, or *.

Azure Public IP addresses are detected as indexed by Shodan, indicating Internet-visible services with open ports and service banner metadata.

Azure NSG inbound rules are evaluated for public RDP exposure. The finding flags rules that Allow TCP traffic to port 3389 from broad sources like 0.0.0.0/0, Internet, or *, including ranges that cover 3389.

Azure NSG inbound rules that allow SSH on TCP 22 from 0.0.0.0/0, Internet, or * are identified, including rules where port ranges include 22 and protocol is TCP or *.

Indicates NSGs exposing SSH to the Internet.

Azure Virtual Network subnets are evaluated for Network Security Group (NSG) association. Each subnet should have an NSG to enforce inbound and outbound traffic filtering rules. Subnets without NSGs allow all traffic by default.

Azure NSG rules are assessed for inbound UDP exposure to the public Internet (e.g., 0.0.0.0/0, *, Internet). The finding identifies allow rules that permit unsolicited UDP traffic from any external source to attached resources.

Azure Virtual Networks are evaluated for DDoS Network Protection. When enabled, Azure DDoS Protection provides enhanced mitigation against volumetric, protocol, and application-layer DDoS attacks targeting resources deployed in the virtual network.

Azure Network Watcher presence across the subscription's regions. The assessment checks that a Network Watcher instance exists in every subscription location where resources may be deployed.

Defender for Cloud default policy assignment (SecurityCenterBuiltIn) uses enforcement mode Default rather than DoNotEnforce

Azure Database for PostgreSQL Flexible Server firewall should not include the rule that allows connections from any Azure service, represented by start_ip=0.0.0.0 and end_ip=0.0.0.0.

Azure PostgreSQL flexible servers where the connection_throttling parameter is set to ON

Azure Database for PostgreSQL flexible servers are evaluated for encrypted in-transit connections, specifically whether require_secure_transport is set to ON to force TLS for all client sessions.

PostgreSQL Flexible Servers must set authConfig.activeDirectoryAuth to Enabled and keep at least one Microsoft Entra administrator assigned so database sessions inherit centrally governed identities instead of unmanaged PostgreSQL accounts.

Azure PostgreSQL Flexible Server is evaluated for geo-redundant backup. Geo-redundant backup stores backup copies in a paired Azure region, enabling restore and cross-region disaster recovery.

Azure PostgreSQL Flexible Server is evaluated for high availability mode. Zone-redundant or same-zone HA provisions a standby replica and provides automatic failover during planned and unplanned outages.

Azure PostgreSQL Flexible Server has checkpoint logging enabled when log_checkpoints=on, recording each checkpoint in the server logs

Azure Database for PostgreSQL Flexible Server evaluates the log_connections setting that controls logging of client connection attempts and authentication results.

The finding indicates whether this parameter is set to ON.