azureSecurity.json

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "securitySettings": {
            "type": "string",
            "allowedValues": [
                "On",
                "Off"
            ],
            "metadata": {
                "description": "Turn security settings On or Off."
            }
        },
        "emailContact": {
            "type": "string",
            "metadata": {
                "description": "Add one or more e-mail addresses for notifications."
            }
        },
        "securityPhoneNumber": {
            "type": "string",
            "metadata": {
                "description": "Add a phone number for security related incidents."
            }
        },
        "logAnalyticsSubscriptionID": {
            "type": "string",
            "metadata": {
                "description": "Specify the subscriptionId where the Log Analytics workspace is deployed."
            }
        },
        "logAnalyticsResourceGroup": {
            "type": "string",
            "metadata": {
                "description": "Specify the resource group where the Log Analytics workspace is deployed."
            }
        },
        "logAnalyticsWorkspaceName": {
            "type": "string",
            "metadata": {
                "description": "Specify the name of your Log Analytics workspace to collect ASC data."
            }
        }
    },
    "variables": {},
    "resources": [
        {
            "type": "Microsoft.Security/policies",
            "apiVersion": "2015-06-01-preview",
            "name": "default",
            "properties": {
                "policyLevel": "Subscription",
                "name": "default",
                "unique": "Off",
                "logCollection": "Off",
                "recommendations": {
                    "patch": "[parameters('securitySettings')]",
                    "baseline": "[parameters('securitySettings')]",
                    "antimalware": "[parameters('securitySettings')]",
                    "diskEncryption": "[parameters('securitySettings')]",
                    "acls": "[parameters('securitySettings')]",
                    "nsgs": "[parameters('securitySettings')]",
                    "waf": "[parameters('securitySettings')]",
                    "sqlAuditing": "[parameters('securitySettings')]",
                    "sqlTde": "[parameters('securitySettings')]",
                    "ngfw": "[parameters('securitySettings')]",
                    "vulnerabilityAssessment": "[parameters('securitySettings')]",
                    "storageEncryption": "[parameters('securitySettings')]",
                    "jitNetworkAccess": "[parameters('securitySettings')]"
                },
                "securityContactConfiguration": {
                    "securityContactEmails": [
                        "[parameters('emailContact')]"
                    ],
                    "securityContactPhone": "[parameters('securityPhoneNumber')]",
                    "areNotificationsOn": true,
                    "sendToAdminOn": false
                },
                "pricingConfiguration": {
                    "selectedPricingTier": "Free"
                }
            }
        },
        {
            "type": "Microsoft.Security/workspaceSettings",
            "apiVersion": "2017-08-01-preview",
            "name": "default",
            "dependsOn": [
                "[resourceId('Microsoft.Security/policies/', 'default')]"
            ],
            "properties": {
                "workspaceId": "[concat('/subscriptions/', parameters('logAnalyticsSubscriptionID'), '/resourceGroups/', parameters('logAnalyticsResourceGroup'), '/providers/Microsoft.OperationalInsights/workspaces/', parameters('logAnalyticsWorkspaceName'))]",
                "scope": "[subscription().id]"
            }
        },
        {
            "type": "Microsoft.Security/autoProvisioningSettings",
            "apiVersion": "2017-08-01-preview",
            "name": "default",
            "dependsOn": [
                "[resourceId('Microsoft.Security/policies/', 'default')]"
            ],
            "properties": {
                "autoProvision": "[parameters('securitySettings')]"
            }
        }
    ],
    "outputs": {}
}