turbot/azure_compliance

Query: securitycenter_azure_defender_on_for_resource_manager

Usage

powerpipe query azure_compliance.query.securitycenter_azure_defender_on_for_resource_manager

SQL

select
sub_pricing.id as resource,
case
when pricing_tier = 'Standard' then 'ok'
else 'alarm'
end as status,
case
when pricing_tier = 'Standard' then 'Azure Defender on for Resource Manager.'
else 'Azure Defender off for Resource Manager.'
end as reason,
sub.display_name as subscription
from
azure_security_center_subscription_pricing sub_pricing
right join azure_subscription sub on sub_pricing.subscription_id = sub.subscription_id
where
name = 'Arm';

Controls

The query is being used by the following controls: