# Defender Secure Score Monitor

> Monitor and improve Microsoft Defender for Cloud Secure Score. Tracks score trends, identifies quick wins to improve the score, checks Defender plan coverage, and highlights critical security recommendations. Use when asked about secure score, security posture, Defender status, or security improvements.

- **Type:** Skill
- **Install:** `agentstack add skill-ricmmartins-azure-sre-agent-skills-06-defender-secure-score`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [ricmmartins](https://agentstack.voostack.com/s/ricmmartins)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [ricmmartins](https://github.com/ricmmartins)
- **Source:** https://github.com/ricmmartins/azure-sre-agent-skills/tree/main/skills/06-defender-secure-score

## Install

```sh
agentstack add skill-ricmmartins-azure-sre-agent-skills-06-defender-secure-score
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Defender Secure Score Monitor

## Purpose
Track and improve your Microsoft Defender for Cloud Secure Score through focused monitoring, trend analysis, and actionable remediation guidance. Answers "what's our security score and how do we improve it?"

## When to use this skill
- User asks "what's our secure score?"
- User asks how to improve security posture
- Weekly security posture check
- Before a security audit or customer questionnaire
- After deploying new resources (to check score impact)

## Difference from Compliance/Governance Audit
The Compliance skill does a broad governance audit (policy, RBAC, tagging, locks, naming). This skill is **laser-focused on Defender for Cloud Secure Score** — the single most important security KPI — and provides targeted actions to improve it.

## Assessment procedure

### Step 1: Current Secure Score
Get the overall score and per-control breakdown.

```bash
az rest --method get --url "https://management.azure.com/subscriptions//providers/Microsoft.Security/secureScores/ascScore?api-version=2020-01-01"
```

```bash
az rest --method get --url "https://management.azure.com/subscriptions//providers/Microsoft.Security/secureScores/ascScore/secureScoreControls?api-version=2020-01-01"
```

Note: The `az security secure-scores list` CLI command may fail in some environments. The REST API approach above is more reliable. Replace `` with the target subscription ID.

Report:
- **Current Secure Score**: X% (X/Y points)
- **Trend** (if memory available): improved/declined vs. last check
- Top 5 controls with the most room for improvement (highest `max - current`)

### Step 2: Unhealthy assessments (recommendations)
Get the list of active security recommendations.

```bash
az rest --method get --url "https://management.azure.com/subscriptions//providers/Microsoft.Security/assessments?api-version=2021-06-01" --query "value[?properties.status.code=='Unhealthy'].{displayName:properties.displayName, severity:properties.metadata.severity, category:properties.metadata.categories[0], resourceId:properties.resourceDetails.id}"
```

Group by severity:
- 🔴 **High**: Must fix — significant risk
- 🟡 **Medium**: Should fix — moderate risk
- 🟢 **Low**: Nice to have — minimal risk

### Step 3: Quick wins (most points for least effort)
Identify recommendations that:
1. Affect the most resources (batch fix possible)
2. Have the highest point value per control
3. Can be fixed with a single CLI command or policy

Examples of quick wins:
- Enable HTTPS-only on App Services
- Enable secure transfer on storage accounts
- Enable Defender plans that are off
- Restrict public network access

### Step 4: Defender plan coverage
Check which Defender plans are enabled.

```bash
az security pricing list --query "[].{plan:name, tier:pricingTier, subPlan:subPlan}" -o table
```

Expected plans to be enabled for full coverage:
- Servers (P2 recommended)
- App Service
- SQL (databases)
- Storage
- Containers (with vulnerability assessment)
- Key Vault
- Resource Manager (ARM)
- DNS

Flag disabled plans and estimate score impact of enabling them.

### Step 5: Attack surface indicators
Check the most exploitable security gaps.

1. **Public management ports** (SSH/RDP open to internet):
   ```bash
   az graph query -q "resources | where type == 'microsoft.network/networksecuritygroups' | mvexpand rules = properties.securityRules | where rules.properties.access == 'Allow' and rules.properties.direction == 'Inbound' and (rules.properties.destinationPortRange == '22' or rules.properties.destinationPortRange == '3389' or rules.properties.destinationPortRange == '*') and rules.properties.sourceAddressPrefix in ('*', '0.0.0.0/0', 'Internet')" -o table
   ```

2. **Storage accounts with public blob access**:
   ```bash
   az storage account list --query "[?allowBlobPublicAccess==true].{name:name, rg:resourceGroup}" -o table
   ```

3. **SQL servers with public endpoint**:
   ```bash
   az sql server list --query "[?properties.publicNetworkAccess=='Enabled'].{name:name, rg:resourceGroup}" -o table
   ```

4. **Key Vaults accessible from public network**:
   ```bash
   az keyvault list --query "[?properties.publicNetworkAccess=='Enabled'].{name:name, rg:resourceGroup}" -o table
   ```

### Step 6: Credential and certificate hygiene
Check for expiring secrets that could cause outages or security drift.

1. **Key Vault secrets expiring within 30 days** (per vault):
   ```bash
   az keyvault secret list --vault-name  --query "[?attributes.expires!=null && attributes.expires --query "[?attributes.expires!=null && attributes.expires The subscription is earning only **ZZ%** of its maximum Secure Score. There is a **N-point gap** to close.

### Score improvement plan

| Priority | Action | Points | Effort | Resources affected |
|----------|--------|--------|--------|-------------------|
| 1 | Enable HTTPS-only on 4 App Services | +4 | 5 min | app-web-*, app-api-* |
| 2 | Enable Defender for Storage | +3 | 2 min | subscription-level |
| 3 | Restrict SQL public access on 2 servers | +3 | 30 min | sql-prod-*, sql-staging-* |
| 4 | Add NSG to 2 subnets without rules | +2 | 15 min | subnet-data-*, subnet-mgmt-* |
| **Total achievable** | | **+12** | **~1 hour** | |

### Critical findings (fix now)
Items that represent immediate exploitable risk.

### Remediation commands
Pre-formatted az cli commands for each quick win, ready to approve and execute.
Use `GetAzCliHelp` to validate the command syntax before suggesting.
```bash
# Enable HTTPS-only on App Service
az webapp update --name  --resource-group  --set httpsOnly=true

# Enable Defender for Storage
az security pricing create --name StorageAccounts --tier Standard
```

### References
- Defender for Cloud: https://learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls
- Security Recommendations: https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference
- Defender Plans: https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction

### Recommended cadence
Schedule this skill as a **weekly** task via SRE Agent scheduled tasks for continuous score improvement tracking.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [ricmmartins](https://github.com/ricmmartins)
- **Source:** [ricmmartins/azure-sre-agent-skills](https://github.com/ricmmartins/azure-sre-agent-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-ricmmartins-azure-sre-agent-skills-06-defender-secure-score
- Seller: https://agentstack.voostack.com/s/ricmmartins
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.