Creating Sentinel Incidents for Subscription-Based Security Score Recommendations

Question

I am looking for a way to generate Sentinel incidents based on security score recommendations for subscriptions (as shown in the attached example). Is there a method to achieve this so that we can receive real-time notifications and take immediate action instead of identifying these issues later?

Any insights or recommendations would be greatly appreciated!

Answer 1

There is no native email service for recommendations but you do have the option of setting governances rules. https://learn.microsoft.com/en-us/azure/defender-for-cloud/governance-rules

If you look at the Secure Score Over Time workbook it also has instructions for exporting recommendations to Log Analytics. From there you could create custom emails or alerts using Logic Apps. https://learn.microsoft.com/en-us/azure/defender-for-cloud/custom-dashboards-azure-workbooks#secure-score-over-time-workbook

Consider that these are security posture recommendations for your Azure cloud infrastructure. You will find similar recommendations in the Defender XDR portal for other security solutions like MDE and MDI. Security Operation teams tend to focus on reactive security incidents vs. proactive posture improvements. Mixing reactive and proactive in the same incident queue could be confusing if they are not separated in some way like a naming standard or tag. That is why you often see security posture recommendations as a dashboard or email. They are more subjective, lower priority, and take much longer to resolve.