$ show Azure/Microsoft-Defender-for-Cloud
This repository is a community-maintained toolkit for Microsoft Defender for Cloud (MDC), providing automation, configuration, and operational assets to extend and manage MDC capabilities. It contains hundreds of Azure Policy definitions, Logic App playbooks, PowerShell scripts, Azure Workbooks, and infrastructure-as-code templates (ARM, Bicep, Terraform) for enabling security controls, remediating recommendations, exporting security data, and integrating with external systems like Azure DevOps, ServiceNow, and Microsoft Sentinel. The repository also includes a production-grade connector (MDC Recommendations to Azure DevOps) built with Python Durable Functions, managed identity authentication, and modular Bicep infrastructure. Architecturally, the repo is a collection of loosely coupled, deployable artifacts rather than a single application. The most sophisticated component is the MDC-to-ADO connector, which uses an HTTP-triggered Durable Function to orchestrate enrichment (via Azure Resource Graph, Microsoft Graph, and MDC APIs), deduplication, and work item creation/update in Azure DevOps. It employs a consistent client pattern with tenacity retry, token caching, and OpenTelemetry tracing. Other notable patterns include DeployIfNotExists Azure Policies that create security automations, Logic Apps with managed identity for alert response, and PowerShell scripts for bulk operations and cost estimation. While the repository is actively maintained and contains several high-quality, reusable components, it also exhibits technical drift: many artifacts reference the deprecated 'Azure Security Center' name, use preview API versions, or contain hardcoded placeholder values. The overall quality is functional but uneven, with some components being production-ready and others requiring manual configuration or updates. The repository is best suited for security engineers and cloud architects looking for battle-tested automation patterns and reference implementations for Microsoft Defender for Cloud.
The LLM identified 5 files worth highlighting for reuse:
HTTP starter for a Durable Functions orchestration that processes MDC recommendations. It uses deterministic instance IDs (SHA256 of assessment/resource ID) for deduplication, fans out enrichment activities (ARG, Graph, ADO), and creates/updates Azure DevOps work items with churn control via material hash. Demonstrates a robust, production-ready pattern for event-driven security automation.
Async context manager for Azure Resource Graph queries using Managed Identity authentication. Implements token caching, tenacity retry with exponential backoff, and OpenTelemetry spans. This client pattern is reusable for any Azure REST API and demonstrates secure, observable service-to-service communication without secrets.
Modular Bicep deployment for the MDC-to-ADO connector, composing managed identity, storage account (identity-based access), App Insights, Function App (Flex Consumption), Logic App, and optional Key Vault. Uses user-assigned managed identity for all Azure resource access, eliminating connection strings. A reusable pattern for deploying secure, serverless integrations.
PowerShell script that estimates Defender for Storage costs by querying Azure Monitor metrics in parallel (ForEach-Object -Parallel with ConcurrentDictionary). Processes multiple storage accounts efficiently, applies pricing logic, and outputs CSV. Demonstrates a reusable pattern for bulk Azure cost analysis with throttling and error handling.
A KQL query and workbook template that identifies high-severity, low-effort security recommendations from Defender for Cloud. Uses Azure Resource Graph to join assessments with secure score controls and filter by remediation effort. This query pattern is reusable for building custom security dashboards and prioritization views.