Skip to content

Commit ebc7d29

Browse files
authored
Merge pull request #1324 from MicrosoftDocs/main
Merge main to live, 4 AM
2 parents 5c1ceca + 2c9adf9 commit ebc7d29

7 files changed

+34
-26
lines changed

articles/defender-for-cloud/defender-for-storage-infrastructure-as-code-enablement.md

+12-12
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ resource "azurerm_security_center_subscription_pricing" "DefenderForStorage" {
2828
extension {
2929
name = "OnUploadMalwareScanning"
3030
additional_extension_properties = {
31-
CapGBPerMonthPerStorageAccount = "5000"
31+
CapGBPerMonthPerStorageAccount = "10000"
3232
}
3333
}
3434
@@ -40,7 +40,7 @@ resource "azurerm_security_center_subscription_pricing" "DefenderForStorage" {
4040

4141
**Modifying the monthly cap for malware scanning**:
4242

43-
To modify the monthly cap for malware scanning per storage account, adjust the `CapGBPerMonthPerStorageAccount` parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month per storage account. If you want to permit unlimited scanning, assign the value *-1*. The default limit is set at 5,000 GB.
43+
To modify the monthly cap for malware scanning per storage account, adjust the `CapGBPerMonthPerStorageAccount` parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month per storage account. If you want to permit unlimited scanning, assign the value *-1*. The default limit is set at 10,000 GB.
4444

4545
**Disabling features**:
4646

@@ -67,7 +67,7 @@ resource StorageAccounts 'Microsoft.Security/pricings@2023-01-01' = {
6767
name: 'OnUploadMalwareScanning'
6868
isEnabled: 'True'
6969
additionalExtensionProperties: {
70-
CapGBPerMonthPerStorageAccount: '5000'
70+
CapGBPerMonthPerStorageAccount: '10000'
7171
}
7272
}
7373
{
@@ -81,7 +81,7 @@ resource StorageAccounts 'Microsoft.Security/pricings@2023-01-01' = {
8181

8282
**Modifying the monthly cap for malware scanning**:
8383

84-
To modify the monthly cap for malware scanning per storage account, adjust the `CapGBPerMonthPerStorageAccount` parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month per storage account. If you want to permit unlimited scanning, assign the value -1. The default limit is set at 5,000 GB.
84+
To modify the monthly cap for malware scanning per storage account, adjust the `CapGBPerMonthPerStorageAccount` parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month per storage account. If you want to permit unlimited scanning, assign the value -1. The default limit is set at 10,000 GB.
8585

8686
**Disabling features**:
8787

@@ -110,7 +110,7 @@ To enable and configure Microsoft Defender for Storage at the subscription level
110110
"name": "OnUploadMalwareScanning",
111111
"isEnabled": "True",
112112
"additionalExtensionProperties": {
113-
"CapGBPerMonthPerStorageAccount": "5000"
113+
"CapGBPerMonthPerStorageAccount": "10000"
114114
}
115115
},
116116
{
@@ -124,7 +124,7 @@ To enable and configure Microsoft Defender for Storage at the subscription level
124124

125125
**Modifying the monthly cap for malware scanning**:
126126

127-
To modify the monthly threshold for malware scanning in your storage accounts, adjust the `CapGBPerMonthPerStorageAccount` parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value -1. The default limit is set at 5,000 GB.
127+
To modify the monthly threshold for malware scanning in your storage accounts, adjust the `CapGBPerMonthPerStorageAccount` parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value -1. The default limit is set at 10,000 GB.
128128

129129
**Disabling features**:
130130

@@ -156,7 +156,7 @@ resource "azapi_resource_action" "enable_defender_for_Storage" {
156156
malwareScanning = {
157157
onUpload = {
158158
isEnabled = true
159-
capGBPerMonth = 5000
159+
capGBPerMonth = 10000
160160
}
161161
}
162162
sensitiveDataDiscovery = {
@@ -173,7 +173,7 @@ resource "azapi_resource_action" "enable_defender_for_Storage" {
173173
174174
**Modifying the monthly cap for malware scanning**:
175175

176-
To modify the monthly threshold for malware scanning in your storage accounts, adjust the `capGBPerMonth` parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value *-1*. The default limit is set at 5,000 GB.
176+
To modify the monthly threshold for malware scanning in your storage accounts, adjust the `capGBPerMonth` parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value *-1*. The default limit is set at 10,000 GB.
177177

178178
**Disabling features**:
179179

@@ -218,7 +218,7 @@ resource defenderForStorageSettings 'Microsoft.Security/DefenderForStorageSettin
218218
    malwareScanning: {
219219
      onUpload: {
220220
        isEnabled: true
221-
        capGBPerMonth: 5000
221+
        capGBPerMonth: 10000
222222
      }
223223
    }
224224
    sensitiveDataDiscovery: {
@@ -231,7 +231,7 @@ resource defenderForStorageSettings 'Microsoft.Security/DefenderForStorageSettin
231231

232232
**Modifying the monthly cap for malware scanning**:
233233

234-
To modify the monthly threshold for malware scanning in your storage accounts, adjust the `capGBPerMonth parameter` to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value -1. The default limit is set at 5,000 GB.
234+
To modify the monthly threshold for malware scanning in your storage accounts, adjust the `capGBPerMonth parameter` to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value -1. The default limit is set at 10,000 GB.
235235

236236
**Disabling features**:
237237

@@ -262,7 +262,7 @@ To enable and configure Microsoft Defender for Storage at the storage account le
262262
"malwareScanning": {
263263
"onUpload": {
264264
"isEnabled": true,
265-
"capGBPerMonth": 5000
265+
"capGBPerMonth": 10000
266266
}
267267
},
268268
"sensitiveDataDiscovery": {
@@ -276,7 +276,7 @@ To enable and configure Microsoft Defender for Storage at the storage account le
276276

277277
**Modifying the monthly cap for malware scanning**:
278278

279-
To modify the monthly threshold for malware scanning in your storage accounts, adjust the `capGBPerMonth` parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value *-1*. The default limit is set at 5,000 GB.
279+
To modify the monthly threshold for malware scanning in your storage accounts, adjust the `capGBPerMonth` parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value *-1*. The default limit is set at 10,000 GB.
280280

281281
**Disabling features**:
282282

articles/defender-for-cloud/defender-for-storage-introduction.md

+2-4
Original file line numberDiff line numberDiff line change
@@ -83,9 +83,7 @@ Defender for Storage also processes internal transactions, including Azure Blob
8383

8484
Malware scanning is charged on a per-gigabyte basis for scanned data. To ensure cost predictability, a monthly cap can be established for each storage account's scanned data volume. This cap can be set subscription-wide, affecting all storage accounts within the subscription, or applied to individual storage accounts. Under protected subscriptions, you can set specific storage accounts with different limits.
8585

86-
By default, the limit is set to 5,000 GB per month per storage account. Once this threshold is exceeded, scanning ceases for the remaining blobs, with a 20-GB confidence interval. For configuration details, see [configure Defender for Storage](/azure/storage/common/azure-defender-storage-configure).
87-
88-
By default, the limit is set to 5,000 GB per month per storage account. Once this threshold is exceeded, scanning ceases for the remaining blobs, with a 20-GB confidence interval. For configuration details, see [configure Defender for Storage](/azure/storage/common/azure-defender-storage-configure).
86+
By default, the limit is set to 10,000 GB per month per storage account. Once this threshold is exceeded, scanning ceases for the remaining blobs, with a 20-GB confidence interval. For configuration details, see [configure Defender for Storage](/azure/storage/common/azure-defender-storage-configure).
8987

9088
> [!IMPORTANT]
9189
> Malware scanning in Defender for Storage isn't included for free in the first 30-day trial and is charged from the first day in accordance with the pricing scheme available on the Defender for Cloud [pricing page](https://azure.microsoft.com/pricing/details/defender-for-cloud/). Malware scanning incurs additional charges for other Azure services: Azure Storage read operations, Azure Storage blob indexing, and Azure Event Grid notifications.
@@ -96,7 +94,7 @@ Microsoft Defender for Storage secures your data at scale with granular controls
9694

9795
### Monitor your malware scanning cap
9896

99-
To ensure uninterrupted protection while effectively managing costs, there are two security alerts related to malware scanning cap usage. The first alert, `Malware scanning will stop soon: 75% of monthly gigabytes scan cap reached (Preview)`, is triggered as your usage approaches 75% of the set monthly cap, offering a heads-up to adjust your cap if needed. The second alert, `Malware scanning stopped: monthly gigabytes scan cap reached (Preview)`, notifies you when the cap is reached and scanning is paused for the month, potentially leaving new uploads unscanned. Both alerts include details on affected storage accounts to prompt and inform action, ensuring you maintain your desired level of security without unexpected expenses.
97+
To ensure uninterrupted protection while effectively managing costs, there are two security alerts related to malware scanning cap usage. The first alert, `Malware scanning will stop soon: 75% of monthly gigabytes scan cap reached`, is triggered as your usage approaches 75% of the set monthly cap, offering a heads-up to adjust your cap if needed. The second alert, `Malware scanning stopped: monthly gigabytes scan cap reached`, notifies you when the cap is reached and scanning is paused for the month, potentially leaving new uploads unscanned. Both alerts include details on affected storage accounts to prompt and inform action, ensuring you maintain your desired level of security without unexpected expenses.
10098

10199
## Understand the differences between malware scanning and hash reputation analysis
102100

articles/defender-for-cloud/defender-for-storage-powershell-enablement.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ Set-AzSecurityPricing -Name "StorageAccounts" -PricingTier "Standard" -SubPlan "
3535
"name": "OnUploadMalwareScanning",
3636
"isEnabled": "True",
3737
"additionalExtensionProperties": {
38-
"CapGBPerMonthPerStorageAccount": "6000"
38+
"CapGBPerMonthPerStorageAccount": "10000"
3939
}
4040
},
4141
{
@@ -44,9 +44,9 @@ Set-AzSecurityPricing -Name "StorageAccounts" -PricingTier "Standard" -SubPlan "
4444
}]'
4545
```
4646

47-
If no extension properties are provided for the cmdlet, both malware scanning and sensitive data discovery are enabled by default. The default monthly threshold per storage account for malware scanning is 5,000 GB.
47+
If no extension properties are provided for the cmdlet, both malware scanning and sensitive data discovery are enabled by default. The default monthly threshold per storage account for malware scanning is 10,000 GB.
4848

49-
To modify the monthly threshold for on-upload malware scanning in your storage accounts, adjust the `CapGBPerMonthPerStorageAccount` property to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value -1. The default limit is set at 5,000 GB.
49+
To modify the monthly threshold for on-upload malware scanning in your storage accounts, adjust the `CapGBPerMonthPerStorageAccount` property to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value -1. The default limit is set at 10,000 GB.
5050

5151
If you want to turn off the on-upload malware scanning or sensitive data threat detection features, you can change the `isEnabled` value to `False` on the `OnUploadMalwareScanning` or `SensitiveDataDiscovery` extension properties respectively. To disable the entire Defender plan, set the `-PricingTier` property value to `Free` and remove the `-SubPlan` and extension properties.
5252

@@ -66,7 +66,7 @@ Update-AzSecurityDefenderForStorage -ResourceId "/subscriptions/<SubscriptionId>
6666
> [!NOTE]
6767
> With Defender for Storage enabled at the subscription level, the `-OverrideSubscriptionLevelSetting` parameter is necessary to override the settings at the subscription level. If the override parameter is not used, the extensions will be set according to the subscription level settings, regardless of the parameter values supplied in the cmdlet.
6868
69-
To modify the monthly threshold for malware scanning the storage account, adjust the `-OnUploadCapGBPerMonth` parameter to your preferred value. This parameter sets a cap on the maximum data to be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value -1. The default limit is set at 5,000 GB.
69+
To modify the monthly threshold for malware scanning the storage account, adjust the `-OnUploadCapGBPerMonth` parameter to your preferred value. This parameter sets a cap on the maximum data to be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value -1. The default limit is set at 10,000 GB.
7070

7171
The malware scan results can be sent to the Event Grid by supplying the Event Grid topic resource ID in the parameter `-MalwareScanningScanResultsEventGridTopicResourceId "<resourceId>"`.
7272

articles/defender-for-cloud/defender-for-storage-rest-api-enablement.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ And add the following request body:
3232
"name": "OnUploadMalwareScanning",
3333
"isEnabled": "True",
3434
"additionalExtensionProperties": {
35-
"CapGBPerMonthPerStorageAccount": "5000"
35+
"CapGBPerMonthPerStorageAccount": "10000"
3636
}
3737
},
3838
{
@@ -46,7 +46,7 @@ And add the following request body:
4646
}
4747
```
4848

49-
To modify the monthly threshold for malware scanning in your storage accounts, adjust the `CapGBPerMonthPerStorageAccount` parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value -1. The default limit is set at 5,000 GB.
49+
To modify the monthly threshold for malware scanning in your storage accounts, adjust the `CapGBPerMonthPerStorageAccount` parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value -1. The default limit is set at 10,000 GB.
5050

5151
If you want to turn off the on-upload malware scanning or Sensitive data threat detection features, you can change the isEnabled value to **False** under Sensitive data discovery.
5252

@@ -73,7 +73,7 @@ And add the following request body:
7373
"malwareScanning": {
7474
"onUpload": {
7575
"isEnabled": true,
76-
"capGBPerMonth": 5000
76+
"capGBPerMonth": 10000
7777
},
7878
"scanResultsEventGridTopicResourceId": "/subscriptions/<Subscription>/resourceGroups/<resourceGroup>/providers/Microsoft.EventGrid/topics/<topicName>"
7979
},
@@ -86,7 +86,7 @@ And add the following request body:
8686
}
8787
```
8888

89-
To modify the monthly threshold for malware scanning in your storage accounts, adjust the `capGBPerMonth` parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value -1. The default limit is set at 5,000 GB.
89+
To modify the monthly threshold for malware scanning in your storage accounts, adjust the `capGBPerMonth` parameter to your preferred value. This parameter sets a cap on the maximum data that can be scanned for malware each month, per storage account. If you want to permit unlimited scanning, assign the value -1. The default limit is set at 10,000 GB.
9090

9191
If you want to turn off the on-upload malware scanning or sensitive data threat detection features, you can change the `isEnabled` value to **False** under the `malwareScanning` or `sensitiveDataDiscovery` properties sections.
9292

articles/defender-for-cloud/on-upload-malware-scanning.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ Malware scanning is billed per GB scanned. To provide cost predictability, malwa
6363
6464
The [capping mechanism](tutorial-enable-storage-plan.md#set-up-and-configure-microsoft-defender-for-storage) sets a monthly scanning limit, measured in gigabytes (GB), for each storage account. This serves as an effective cost control measure. If a predefined scanning limit is reached for a storage account within a single calendar month, the scanning operation automatically halts. This halt occurs once the threshold is reached, with up to a 20-GB deviation. Files aren't scanned for malware beyond this point. The cap resets at the end of every month at midnight UTC. Updating the cap typically takes up to an hour to take effect.
6565

66-
By default, a limit of 5 TB (5,000 GB) is established if no specific capping mechanism is defined.
66+
By default, a limit of 10 TB (10,000 GB) is established if no specific capping mechanism is defined.
6767

6868
> [!TIP]
6969
> You can set the capping mechanism on either individual storage accounts or across an entire subscription (every storage account on the subscription will be allocated the limit defined on the subscription level).

articles/defender-for-cloud/release-notes.md

+9
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,17 @@ This article summarizes what's new in Microsoft Defender for Cloud. It includes
3131

3232
|Date | Category | Update|
3333
| -------- | -------- | -------- |
34+
| April 24 | GA| [General Availability of API Security Posture Management native integration within Defender CSPM Plan](#general-availability-of-api-security-posture-management-native-integration-within-defender-cspm-plan) |
3435
| April 7 | Upcoming Change| [Enhancements for Defender for app service alerts](#enhancements-for-defender-for-app-service-alerts) |
3536

37+
### General Availability of API Security Posture Management native integration within Defender CSPM Plan
38+
39+
April 24, 2025
40+
41+
API Security Posture Management is now generally available as part of the Defender CSPM plan. This release introduces a unified inventory of your APIs along with posture insights, helping you identify and prioritize API risks more effectively directly from your Defender CSPM plan. You can enable this capability through the Environment Settings page by turning on the API Security Posture extension.
42+
43+
With this update, new risk factors have been added, including risk factors for unauthenticated APIs (AllowsAnonymousAccess) and APIs lacking encryption (UnencryptedAccess). Additionally, APIs published through Azure API Management now allow mapping back to any connected Kubernetes Ingresses and VMs, providing end-to-end visibility into API exposure and support risk remediation through Attack path analysis.
44+
3645
### Enhancements for Defender for app service alerts
3746

3847
On April 30, 2025, Defender for App Service alerting capabilities will be enhanced. We will add alerts for suspicious code executions and access to internal or remote endpoints. Additionally, we have improved coverage and reduced noise from relevant alerts by expanding our logic and removing alerts that were causing unnecessary noise. As part of this process, the alert "Suspicious WordPress theme invocation detected" will be deprecated.

0 commit comments

Comments
 (0)