Azure Security Scanner Skill

Purpose

Automated Azure security configuration scanning and hardening to identify misconfigurations, compliance violations, and security risks across Azure subscriptions and tenants.

Capabilities

Azure Security Center Assessments

• Run Microsoft Defender for Cloud security assessments
• Check secure score and recommendations
• Review security alerts and incidents
• Validate just-in-time VM access
• Check adaptive application controls
• Monitor regulatory compliance dashboards

Azure AD Security Analysis

• Analyze Azure AD conditional access policies
• Check MFA enforcement status
• Review privileged identity management (PIM)
• Identify risky sign-ins and users
• Analyze app registrations and service principals
• Check guest user access configurations

Network Security Group Analysis

• Review NSG rules for overly permissive access
• Check for open management ports (RDP, SSH)
• Validate application security groups
• Review Azure Firewall configurations
• Check DDoS protection status
• Analyze virtual network configurations

Storage Account Security

• Identify publicly accessible storage accounts
• Check encryption configurations (SSE, CMK)
• Review shared access signatures (SAS)
• Validate network access rules
• Check secure transfer requirements
• Review access keys rotation

Key Vault Security

• Check Key Vault access policies
• Validate network restrictions
• Review key expiration policies
• Check certificate configurations
• Verify soft-delete enablement
• Audit secret access patterns

Activity Logging Verification

• Validate Azure Activity Log configuration
• Check diagnostic settings on resources
• Review Log Analytics workspace security
• Verify Azure Monitor alert rules
• Check Azure Sentinel integration

Azure Policy Compliance

• Assess built-in policy compliance
• Check custom policy assignments
• Review policy exemptions
• Validate initiative assignments
• Generate compliance reports

Azure Services Covered

| Category | Services | |----------|----------| | Identity | Azure AD, PIM, Conditional Access | | Compute | VMs, App Services, Functions, AKS | | Storage | Storage Accounts, Blobs, Files | | Database | SQL Database, Cosmos DB, PostgreSQL | | Network | VNets, NSGs, Azure Firewall, WAF | | Security | Defender, Key Vault, Sentinel | | Monitoring | Monitor, Log Analytics, Application Insights |

Integrations

• Microsoft Defender for Cloud: Cloud security posture management
• Azure Policy: Governance and compliance
• Azure AD: Identity security
• ScoutSuite: Multi-cloud security auditing
• Azure Sentinel: SIEM and SOAR

Target Processes

• Cloud Security Architecture Review
• Compliance Monitoring
• Azure Subscription Hardening
• Security Posture Assessment

Input Schema

{
  "type": "object",
  "properties": {
    "scanType": {
      "type": "string",
      "enum": ["full", "cis", "pci", "hipaa", "iso27001", "custom"],
      "description": "Type of security scan"
    },
    "subscriptions": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Azure subscription IDs to scan"
    },
    "resourceGroups": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Specific resource groups to scan"
    },
    "services": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Specific services to scan"
    },
    "severityThreshold": {
      "type": "string",
      "enum": ["critical", "high", "medium", "low"]
    },
    "complianceFrameworks": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["CIS", "PCI-DSS", "HIPAA", "ISO27001", "SOC2", "NIST"]
      }
    },
    "includeAzureAD": {
      "type": "boolean",
      "description": "Include Azure AD security checks"
    }
  },
  "required": ["scanType"]
}

Output Schema

{
  "type": "object",
  "properties": {
    "scanId": {
      "type": "string"
    },
    "scanTimestamp": {
      "type": "string",
      "format": "date-time"
    },
    "subscriptionsScanned": {
      "type": "array"
    },
    "secureScore": {
      "type": "object",
      "properties": {
        "current": { "type": "number" },
        "max": { "type": "number" },
        "percentage": { "type": "number" }
      }
    },
    "summary": {
      "type": "object",
      "properties": {
        "totalChecks": { "type": "integer" },
        "passed": { "type": "integer" },
        "failed": { "type": "integer" },
        "warnings": { "type": "integer" }
      }
    },
    "findingsBySeverity": {
      "type": "object",
      "properties": {
        "critical": { "type": "integer" },
        "high": { "type": "integer" },
        "medium": { "type": "integer" },
        "low": { "type": "integer" }
      }
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "checkId": { "type": "string" },
          "severity": { "type": "string" },
          "service": { "type": "string" },
          "resourceId": { "type": "string" },
          "description": { "type": "string" },
          "remediation": { "type": "string" },
          "complianceMapping": { "type": "array" }
        }
      }
    },
    "azureAdFindings": {
      "type": "array"
    },
    "policyCompliance": {
      "type": "object"
    },
    "recommendations": {
      "type": "array",
      "items": { "type": "string" }
    }
  }
}

Usage Example

skill: {
  name: 'azure-security-scanner',
  context: {
    scanType: 'cis',
    subscriptions: ['subscription-id-1'],
    complianceFrameworks: ['CIS', 'SOC2'],
    includeAzureAD: true,
    severityThreshold: 'medium'
  }
}