Azure Security Center

Azure Security Center Integration with DefectDojo

Azure Security Center — now unified under the Microsoft Defender for Cloud brand — is the central security posture management and workload protection platform for Azure environments. It continuously assesses Azure resources against security best practices, surfaces vulnerability findings from integrated services like Microsoft Defender for Servers (powered by Qualys or Microsoft Defender Vulnerability Management), evaluates compliance posture against CIS, NIST, PCI DSS, and Azure Security Benchmark standards, and provides threat protection signals across compute, containers, databases, storage, and networking. For teams operating in Azure, it provides a comprehensive view of cloud security risk in a single platform. What it doesn't provide is the cross-functional vulnerability management workflow that security programs need to operate at scale: SLA enforcement with breach tracking, remediation ownership assignment across multiple engineering teams, risk acceptance decisions with auditable rationale, and longitudinal posture reporting that outlasts the Azure portal's built-in retention. Integrating Azure Security Center with DefectDojo closes that operational gap — turning Azure security signal into a managed, accountable remediation program.

Why Azure Security Center Matters

Microsoft Defender for Cloud has evolved into one of the most deeply integrated cloud security platforms available for Azure workloads, combining posture management with active workload protection across a broad range of Azure services.

• Security recommendations cover hundreds of Azure resource types — virtual machines, storage accounts, SQL databases, App Service instances, Key Vault configurations, network security groups, Kubernetes clusters, container registries, and more — assessed continuously as resource configurations change
• The Secure Score system provides a quantified view of security posture at the subscription and management group level, making it straightforward to communicate progress and regression to both technical and executive audiences
• Microsoft Defender for Servers integrates vulnerability assessment for OS and application packages on Azure VMs using either the Microsoft Defender Vulnerability Management engine or the integrated Qualys scanner — bringing workload-level CVE findings into the same platform as configuration recommendations
• Regulatory compliance dashboards map Azure Security Center findings to CIS, PCI DSS v3.2.1 and v4.0, NIST SP 800-53, ISO 27001, SOC 2, FedRAMP, and Azure Security Benchmark controls out of the box — providing compliance gap visibility without manual control mapping
• Multi-subscription and management group support allows a central security team to view findings across all Azure subscriptions in an organization from a single console, supporting enterprise-scale governance
• Findings are exportable via the Azure REST API, Azure Security Center's continuous export to Log Analytics and Event Hub, and direct API queries — giving teams multiple options for building automated pipelines into DefectDojo

Advantages of This Integration

Azure Security Center surfaces cloud and workload security risk. DefectDojo operationalizes the response with the accountability structures that enterprise security programs require.

• Persistent finding records beyond Azure's retention window: Azure Security Center retains recommendation history for a limited period, and resolved findings are not retained indefinitely. DefectDojo's reimport workflow creates a permanent record of every finding — when it was first detected, when it resolved, and whether it re-emerged after remediation — giving security teams an audit-ready history that outlasts Azure portal retention.
• SLA enforcement across recommendation and vulnerability types: Security recommendations, VM vulnerability findings, and compliance violations have different remediation owners and urgency profiles. DefectDojo applies configurable SLA policies by severity, tracks breach dates, and surfaces overdue findings in dashboards — turning Azure Security Center severity ratings into enforceable deadlines with documented breach history.
• Multi-subscription portfolio visibility in a single platform: Organizations with dozens of Azure subscriptions use Security Center's aggregation to collect cross-subscription findings, then import them into DefectDojo to apply lifecycle management. DefectDojo's product structure maps to subscriptions or business units, giving security leadership an aggregated posture view with assignment and SLA tracking attached.
• Risk acceptance with documented audit trail: Many Azure Security Center recommendations reflect architectural decisions that are intentional — a publicly accessible storage account serving a CDN, a network security group rule with broad access for a specific integration pattern. DefectDojo captures risk acceptance decisions with justification, approver identity, and expiration dates — persistent across reimports and available for auditor review without navigating Azure portal exemption records.
• Cross-team remediation routing: Azure recommendations span multiple owners — VM vulnerability findings go to the workload engineering team, storage account configuration findings go to the data platform team, network security group findings go to network engineering, Kubernetes findings go to platform engineering. DefectDojo's assignment model routes each finding to the right owner with context, without a manual triage meeting per export cycle.
• Compliance posture tracking over time: Azure Security Center's compliance framework mappings carry through into DefectDojo findings. Reimport history enables longitudinal analysis of which controls are consistently failing, which regressed after remediation, and how overall compliance posture trends across quarters — data that Azure Security Center's built-in dashboards don't retain with the same durability.
• Ticketing integration for remediation handoff: Triaged Azure Security Center findings push from DefectDojo to Jira, ServiceNow, or GitHub Issues with recommendation name, affected resource, severity, and Microsoft's remediation guidance included — giving infrastructure teams actionable tickets without requiring Azure portal access.

How This Integration Works

Azure Security Center findings are exported via the Azure REST API or Azure CLI and imported into DefectDojo using the Azure Security Center parser.

Step 1 — Export findings from Azure Security Center

Using the Azure CLI to export security assessments:

# Login to Azure

az login

# Export all security assessments for a subscription

az security assessment list \

--subscription <subscription-id> \

--output json \

> azure-security-center-findings.json

# Export assessments filtered to unhealthy resources only

az security assessment list \

--subscription <subscription-id> \

--query "[?status.code=='Unhealthy']" \

--output json \

> azure-sc-unhealthy.json

# Export sub-assessments (VM vulnerability findings from Defender for Servers)

az security sub-assessment list \

--subscription <subscription-id> \

--output json \

> azure-sc-vulnerabilities.json

Using the Azure REST API for programmatic export:

# Get an access token

ACCESS_TOKEN=$(az account get-access-token --query accessToken -o tsv)

# Export security assessments via REST API

curl -s -X GET \

"https://management.azure.com/subscriptions/<subscription-id>/providers/Microsoft.Security/assessments?api-version=2021-06-01" \

-H "Authorization: Bearer ${ACCESS_TOKEN}" \

-H "Content-Type: application/json" \

-o azure-security-center-findings.json

# Export VM vulnerability findings (sub-assessments)

curl -s -X GET \

"https://management.azure.com/subscriptions/<subscription-id>/providers/Microsoft.Security/subAssessments?api-version=2019-01-01-preview" \

-H "Authorization: Bearer ${ACCESS_TOKEN}" \

-H "Content-Type: application/json" \

-o azure-sc-sub-assessments.json

For continuous automated export, configure Azure Security Center's built-in continuous export to stream findings to a Log Analytics workspace or Event Hub, then use a Logic App or Azure Function to trigger the DefectDojo import pipeline.

Step 2 — Import into DefectDojo

Use Azure Security Center Recommendations Scan as the scan type:

curl -X POST https://<defectdojo-host>/api/v2/import-scan/ \

-H "Authorization: Token <your-api-token>" \

-F "scan_type=Azure Security Center Recommendations Scan" \

-F "file=@azure-security-center-findings.json" \

-F "engagement=<engagement-id>" \

-F "product=<product-id>" \

-F "active=true" \

-F "verified=false"

Step 3 — Reimport for recurring exports

For subscriptions assessed on a regular schedule, use the reimport endpoint to update existing finding states rather than accumulate redundant test records:

curl -X POST https://<defectdojo-host>/api/v2/reimport-scan/ \

-H "Authorization: Token <your-api-token>" \

-F "scan_type=Azure Security Center Recommendations Scan" \

-F "file=@azure-security-center-findings.json" \

-F "test=<test-id>"

DefectDojo marks findings absent from the new export as resolved, creates records for new findings, and leaves previously accepted or false-positived findings untouched.

Data Granularity: What Gets Imported

Use Cases

For continuous Azure security posture management across an organization: An organization with 30 Azure subscriptions uses Defender for Cloud's management group aggregation to collect cross-subscription findings into a central security account. Weekly exports import into DefectDojo, organized by subscription under a product-per-subscription structure. Security recommendations route to infrastructure teams; VM vulnerability findings from Defender for Servers route to application engineering; identity and access findings route to the IAM team. SLA tracking in DefectDojo surfaces which teams are meeting remediation commitments and which subscriptions have the longest-standing unaddressed High severity findings.

For Defender for Servers vulnerability management: Microsoft Defender for Servers generates sub-assessment vulnerability findings for OS packages and application components on Azure VMs — essentially CVE-level findings analogous to what traditional vulnerability scanners produce. These import into DefectDojo with CVE IDs, CVSS scores, and patch availability data, giving the vulnerability management team persistent tracking for workload-level findings alongside the configuration recommendation findings from Security Center's posture management layer.

During a pre-audit compliance preparation: Ahead of a PCI DSS or ISO 27001 audit, the security team filters Azure Security Center findings to the relevant compliance framework and imports them into a dedicated DefectDojo engagement. Findings are triaged, remediated, and a follow-up export reimported to confirm closure. The before-and-after record in DefectDojo provides auditors with structured evidence of identified gaps and documented remediation — without manual extraction from the Azure compliance dashboard.

For multi-cloud security posture consolidation: Organizations running workloads across Azure and AWS use DefectDojo as the single pane of glass for cloud security posture findings from both providers — Azure Security Center findings alongside AWS Security Hub findings in a unified vulnerability management workflow with consistent SLA policies, assignment models, and reporting across cloud providers.

For new subscription security baseline establishment: When a new Azure subscription is provisioned, an automated Security Center assessment export runs as part of the subscription bootstrap process. Results import into a DefectDojo engagement tied to the new subscription, establishing a tracked security baseline from day one. The security team reviews findings, documents accepted architectural decisions, and ensures every subscription in the estate has an auditable starting posture record rather than accumulating undiscovered debt.

Operational Tips

• Separate recommendations and sub-assessments into distinct DefectDojo engagements: Security Center configuration recommendations and Defender for Servers VM vulnerability findings (sub-assessments) have fundamentally different remediation owners and workflows. Importing them into separate engagements — with separate SLA policies and assignment rules — keeps ownership clean and prevents configuration and vulnerability findings from competing in the same triage queue.
• Use management group scope for organization-wide exports: Exporting assessments at the management group level rather than subscription-by-subscription captures findings across your entire Azure estate in a single API call, simplifying pipeline design. Map the results to per-subscription or per-business-unit products in DefectDojo using the subscriptionId field as the routing key.
• Set export schedules to align with your SLA windows: If your High SLA target is 30 days and Security Center findings are exported weekly, DefectDojo's SLA tracking will be accurate enough for most findings. For Critical findings with 48-hour targets in production subscriptions, daily exports with automated reimport provide the data freshness that meaningful SLA tracking requires.
• Configure continuous export for high-velocity environments: For production subscriptions with active workloads and frequent configuration changes, Azure Security Center's built-in continuous export to Event Hub or Log Analytics — combined with an Azure Function or Logic App that triggers DefectDojo import — provides near-real-time finding ingestion without polling overhead.
• Document Azure Security Center exemptions as DefectDojo risk acceptances: Azure Security Center supports resource-level exemptions for recommendations that reflect intentional architectural decisions. Where exemptions are created in Azure, mirror the decision as a risk acceptance in DefectDojo — the rationale, approver, and expiration date are then auditable in the vulnerability management platform rather than visible only to those with Azure portal access.
• Tag findings by resource category and Azure service on import: Tagging DefectDojo findings with the Azure resource category (Compute, Networking, Data, IdentityAndAccess, AppService) and the affected Azure service enables filtering and reporting by service area across your subscription estate — useful for identifying which Azure service categories are driving the most remediation workload across your environment.
• Use Secure Score trend data to complement DefectDojo finding metrics: Azure Security Center's Secure Score provides a quantified posture metric that security leadership understands intuitively. Track Secure Score trends alongside DefectDojo's open finding counts and SLA compliance rates — the combination gives a richer picture of whether remediation activity is translating into measurable posture improvement across your Azure estate.
• Filter Not Applicable and Not Assessed status findings on import: Azure Security Center assessments include resources in Not Applicable or Not Assessed states that are not actionable as security findings. Ensuring your export filter or DefectDojo import pipeline excludes these statuses keeps your active finding queue focused on genuine Unhealthy resources requiring remediation.