Custom recommendation I created doesn't get triggered as a recommendation in defender for cloud

Khanna, Keshav 0 Reputation points
2024-06-13T12:51:18.1+00:00

I am trying to make custom recommendations work. I created a custom recommendation that looks meta data of a keyvault and checks if PublicNetworkAccess is enabled if so then it finds "iprules" in meta data. If it can see the word "value" in array iprules it means that our keyvault has IP restrictions which is safe to use.

I didn't have any issues while creating it but the issue is that I can't see this recommendation being triggered even after 12 + hours. I know I'm alerting on something that is safe but just trying to test the tool before I use the actual use cases. I think custom recommendation follows a specific format or something? Please help if you know anything :)

Here's the kql -

RawEntityMetadata

| where Environment == 'Azure' and Identifiers.Type =~ 'Microsoft.KeyVault/vaults'

| parse Record with * 'publicNetworkAccess":"' publicNetworkAccess:string '"' *

| where publicNetworkAccess contains "Enabled"

| parse Record with * "ipRules" ipRules:string ',' *

//| where ipRules contains "value"

| extend ABC = ipRules

| project Name, Environment, Record, publicNetworkAccess, HealthStatus = "HEALTHY", ipRules, Identifiers, Id, AdditionalData
Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,250 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Akshay-MSFT 17,566 Reputation points Microsoft Employee
    2024-06-17T10:39:11.1933333+00:00

    @Khanna, Keshav

    I was able to build the custom recommendation in my lab and it targeted 3 Key Vault correctly.

    My recommendation here is to wait for 24 hours as any changes within defender for cloud could take up to 24 hours for execution.

    If you don't have any further queries and the suggestion above answers your ask, please "Accept the answer", This will help us and others in the community as well.

    Thanks,

    Akshay Kaushik