Azure Security Center Integration with DefectDojo

Azure Security Center Integration with DefectDojo

Azure Security Center is the former name of Microsoft Defender for Cloud, Microsoft's cloud security posture management and workload protection service for Azure, with connectors for AWS and Google Cloud accounts. It continuously assesses resources against security recommendations, such as restricting network access, enabling encryption, or turning on logging, and marks each resource Healthy or Unhealthy per recommendation, grouped under security controls. Recommendations can be exported from the Azure portal as CSV, which DefectDojo imports. DefectDojo Pro also has a Microsoft Defender for Cloud connector, which pulls vulnerability (CVE) findings rather than recommendations.

Azure Security Center Integration with DefectDojo

Defender for Cloud tells us where our Azure subscriptions drift from good configuration, and it does that well. What it doesn't do is put those recommendations next to our application findings, under our SLAs, with an owner per team. Importing the recommendations export into DefectDojo turns every unhealthy resource into a Finding on the Asset for that subscription, with Microsoft's remediation steps and a link back to the portal. Reimporting the next export shows which resources were fixed and which are newly failing.

Why Azure Security Center Matters

Most cloud exposure comes from configuration, and in a large tenant configuration changes constantly.

• Defender for Cloud assesses live Azure resources continuously, which catches drift that template scanning can't.
• Each recommendation names the affected resource, resource group, and subscription, so it can go to the right team.
• Recommendations come with remediation steps and map to security controls that align with compliance frameworks.
• Its connected AWS and Google Cloud accounts appear in the same export, with the native cloud account ID.
• The portal shows current state, but it doesn't track your SLAs or link findings to the applications that depend on those resources.

Advantages of This Integration

What we gained by routing Defender for Cloud recommendations through DefectDojo:

• Unhealthy resources only. The parser imports rows whose state is Unhealthy and skips Healthy ones, so each Finding is something that needs action.
• Stable identity per resource. DefectDojo deduplicates on the unique ID from the tool, which is the recommendationId: the assessment's full resource path, unique to one recommendation on one resource. The same failure is matched across exports.
• Drift as a delta. Reimporting each export into the same Test mitigates findings for resources that became healthy and adds new failures.
• Ownership by subscription. Importing each subscription into its own Asset gives findings a clear owner and per-subscription metrics.
• Recorded exceptions. Recommendations that don't apply to a workload can be risk-accepted with a reason and expiration date in DefectDojo.

How This Integration Works

DefectDojo imports the export with the Azure Security Center Recommendations Scan scan type.

1. Export recommendations as CSV. In the Azure portal, open Microsoft Defender for Cloud, go to Recommendations, and download the CSV report. The parser only accepts files ending in .csv, and it expects Defender for Cloud's column names, such as recommendationId, recommendationDisplayName, state, severity, and statusChangeDate.

2. Import the file. In the UI, open the Engagement, choose Import Scan Results, select Azure Security Center Recommendations Scan, and upload the CSV. For automation, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Azure Security Center Recommendations Scan" \
  -F "file=@defender-recommendations-prod.csv" \
  -F "product_name=azure-prod-subscription" \
  -F "engagement_name=Cloud Posture" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Azure Security Center Recommendations Scan" \
  --report-path "./defender-recommendations-prod.csv" \
  --product-name "azure-prod-subscription" \
  --engagement-name "Cloud Posture" \
  --auto-create-context

3. Reimport on a schedule. Send later exports to /api/v2/reimport-scan/ against the same Test.

Microsoft Defender for Cloud connector (DefectDojo Pro). The connector covers a different slice of Defender for Cloud: CVE findings from Microsoft Defender Vulnerability Management for Azure VMs (Defender for Servers Plan 2) and container registry images (Defender for Containers). It does not import recommendations or posture findings, so the CSV import above remains the path for those. To set it up, register an app in Microsoft Entra ID, create a client secret, and assign the app the Security Reader (or Reader) role on each subscription. In the connector, enter https://management.azure.com as the Location, then the tenant ID, client ID, and client secret, and optionally a Minimum Severity. Each enabled subscription becomes a Record. Optional Asset Grouping can split findings by resource group or by resource, and Organization Placement can create Organizations per subscription or management group.

Data Granularity: What Gets Imported

The table describes the CSV recommendations import.

Rows in any state other than Unhealthy, including Healthy and Not applicable, are not imported. When the controls column holds a JSON object, the description shows the first control's name.

Use Cases

For weekly posture reviews: A platform team exports recommendations for each production subscription and reimports them. The security lead reviews what changed since last week instead of rereading the full list.

When onboarding a new subscription: The first export from a newly connected subscription often shows dozens of unhealthy resources. Importing into a dedicated Asset lets the team triage, risk-accept items that don't apply, and set SLAs for the rest.

For multicloud teams: Organizations that connect AWS or Google Cloud accounts to Defender for Cloud get those recommendations in the same export, and the native cloud account ID in the description identifies the source account.

For CVEs and posture together on DefectDojo Pro: Teams run the connector for VM and container CVEs and keep importing the recommendations CSV for configuration, so both kinds of Azure risk land on the same Assets.

Operational Tips

• Map one subscription to one Asset, or one Test per subscription, and reimport into it so resolved recommendations are mitigated automatically.
• Keep the .csv extension. Files with any other extension are rejected.
• Filter the export by subscription in the portal before downloading, so one file maps cleanly to one Asset.
• Severity is taken exactly as exported, and recommendation exports typically use High, Medium, and Low. If you want Critical SLAs for specific controls, adjust severity during triage.
• Tag imports with the environment (for example tags=azure,prod) to filter dashboards across clouds.
• Risk-accept recommendations that conflict with an approved design, with an expiration date, so they are reviewed rather than forgotten.