01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:
az account list
--query '[*].id'
02 The command output should return the requested subscription identifiers (IDs):
[
"abcdabcd-1234-abcd-1234-abcdabcdabcd",
"abcd1234-abcd-1234-abcd-abcd1234abcd"
]
03 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):
az account set
--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd
04 Define the configuration parameters for the account get-access-token command in order to enable attack path alert notifications for Microsoft Defender for Cloud in the selected Azure subscription, by adding the following configuration object: {"sourceType": "AttackPath", "minimalRiskLevel": "Medium"} to the "notificationsSources" array, as shown in the configuration file listed below. To change the risk level, modify the "minimalRiskLevel" attribute value (supported values: "Low", "Medium", "High", and "Critical"). Save the configuration document to a JSON file named enable-attack-path-notifications.json:
{
"id": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/providers/Microsoft.Security/securityContacts/default",
"name": "default",
"type": "Microsoft.Security/securityContacts",
"location": "West Europe",
"properties": {
"isEnabled": true,
"emails": "user@domain.com",
"phone": "",
"notificationsByRole": {
"state": "On",
"roles": [
"Owner"
]
},
"notificationsSources": [
{
"sourceType": "Alert",
"minimalSeverity": "Medium"
},
{
"sourceType": "AttackPath",
"minimalRiskLevel": "Medium"
}
]
}
}
05 Run account get-access-token command (Windows/macOS/Linux) with the configuration document defined at the previous step (i.e., enable-attack-path-notifications.json file), to enable Microsoft Defender for Cloud to send attack path alert notifications to the subscription owners and/or administrators:
az account get-access-token
--query "{subscription:subscription,accessToken:accessToken}"
--out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/securityContacts/default?api-version=2023-12-01-preview -d@"enable-attack-path-notifications.json"'
06 The output should return the notification configuration applied to Microsoft Defender for Cloud:
{
"id": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/providers/Microsoft.Security/securityContacts/default",
"name": "default",
"type": "Microsoft.Security/securityContacts",
"location": "West Europe",
"properties": {
"isEnabled": true,
"emails": "user@domain.com",
"phone": "",
"notificationsByRole": {
"state": "On",
"roles": [
"Owner"
]
},
"notificationsSources": [
{
"sourceType": "Alert",
"minimalSeverity": "Medium"
},
{
"sourceType": "AttackPath",
"minimalRiskLevel": "Medium"
}
]
}
}
07 Repeat steps no. 4 – 3 for each Azure subscription created within your Microsoft Azure account.
Security