For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/default_rules/def-000-wsd.md. A documentation index is available at /llms.txt.

Azure should be configured to send email notifications about security alerts with High severity

azure.security

Description

Azure subscriptions should turn on Microsoft Defender for Cloud email notifications for security alerts, so the subscription owner or security contacts learn about issues promptly. Set the minimum severity to High, Medium, or Low so that High severity alerts are always sent. This rule passes when the subscription’s security contact has alert notifications turned on and a minimum severity selected.

Remediation

In the subscription’s Defender for Cloud Email notifications settings, select Notify about alerts with the following severity (or higher) and choose a severity. See Configure email notifications for alerts and attack paths.

References