export Microsoft Defender for Cloud alerts

techhadoop azure, Microsoft Defender, security

To export Microsoft Defender for Cloud alerts and recommendations to an Azure Event Hub or Log Analytics Workspace continuously, you configure an Export Setting (Microsoft.Security/exportSettings).

Since the native azurerm provider doesn’t have a dedicated high-level resource for exportSettings, the recommended approach is using the azurerm_orchestrated_virtual_machine_scale_set or the resource manager provider azapi_resource from the official Azure/azapi provider.

Complete Terraform Configuration (main.tf)

Below is the complete Terraform code using the azapi provider to continuously route all Defender for Cloud alerts and recommendations to an Azure Event Hub.

Terraform

terraform {
  required_version = ">= 1.5.0"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.90"
    }
    azapi = {
      source  = "Azure/azapi"
      version = "~> 1.12"
    }
  }
}
provider "azurerm" {
  features {}
}
provider "azapi" {}
data "azurerm_subscription" "current" {}
# 1. Target Resource Group for the Event Hub
resource "azurerm_resource_group" "rg" {
  name     = "rg-defender-export-prod"
  location = "eastus"
}
# 2. Event Hub Namespace and Event Hub Target
resource "azurerm_eventhub_namespace" "eh_ns" {
  name                = "ehns-defender-export-prod"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  sku                 = "Standard"
  capacity            = 1
}
resource "azurerm_eventhub" "eh" {
  name                = "eh-defender-alerts"
  namespace_name      = azurerm_eventhub_namespace.eh_ns.name
  resource_group_name = azurerm_resource_group.rg.name
  partition_count     = 2
  message_retention   = 1
}
resource "azurerm_eventhub_authorization_rule" "eh_auth" {
  name                = "defender-export-rule"
  namespace_name      = azurerm_eventhub_namespace.eh_ns.name
  eventhub_name       = azurerm_eventhub.eh.name
  resource_group_name = azurerm_resource_group.rg.name
  listen              = false
  send                = true
  manage              = false
}
# 3. Defender Continuous Export Setting via AzAPI
resource "azapi_resource" "defender_continuous_export" {
  type      = "Microsoft.Security/exportSettings@2021-06-01"
  name      = "current" # Subscription-level export must be named "current"
  parent_id = data.azurerm_subscription.current.id
  body = jsonencode({
    properties = {
      exportData = "Full"
      resourceGroup : azurerm_resource_group.rg.id
      dataExportProperties = {
        destinationType = "EventHub"
        connectionString = azurerm_eventhub_authorization_rule.eh_auth.primary_connection_string
      }
      dataTypeExportProperties = [
        {
          dataType = "Alerts"
        },
        {
          dataType = "Recommendations"
        }
      ]
    }
  })
}

Export Options Breakdown

  • dataTypeExportProperties: Controls what data types are pushed. You can set Alerts, Recommendations, SecureScores, or RegulatoryComplianceAssessment.
  • Export Destinations:
    • Event Hub (destinationType = "EventHub"): Ideal for forwarding alerts to third-party SIEMs (e.g., Splunk, Datadog) or external security operations centers.
    • Log Analytics Workspace (destinationType = "Serverless"): Useful if you prefer querying exported records directly via KQL (Kusto Query Language) outside of Microsoft Sentinel.

Verification: Once deployed, trigger a test security alert or navigate to Microsoft Defender for Cloud > Environment settings > Continuous export in the Azure Portal to confirm that the subscription status shows your Event Hub connection.

Leave a Reply