> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Security Alert Emails Set To Subscription Owners

### More Info:

Enable security alert emails to subscription owners.

### Risk Level

Medium

### Address

Operational Maturity, Security

### Compliance Standards

* CIS AZURE
* Cloudanix Best Practice
* Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Ensure Security Alert Emails Set To Subscription Owners" in Azure using the Azure console, follow the below steps:

        1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).
        2. Navigate to the Security Center by clicking on the "Security Center" icon in the left-hand menu.
        3. In the Security Center, click on the "Security policy" tab in the left-hand menu.
        4. In the Security policy tab, click on the "Edit" button to edit the security policy.
        5. Scroll down to the "Email notification settings" section and ensure that the "Send email notifications to subscription owners" option is enabled.
        6. If the option is not enabled, click on the toggle switch to enable it.
        7. Once enabled, click on the "Save" button to save the changes.

        After completing the above steps, the misconfiguration "Ensure Security Alert Emails Set To Subscription Owners" will be remediated in Azure. Azure will now send email notifications to the subscription owners for any security alerts.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Ensure Security Alert Emails Set To Subscription Owners" for Azure using Azure CLI, follow these steps:

        1. Open the Azure CLI command prompt.

        2. Run the following command to set the security alert email to the subscription owner:

           ```
           az monitor activity-log alert update --name {alert_name} --resource-group {resource_group_name} --condition-category "Security" --email-service-owners true --enabled true
           ```

           Replace `{alert_name}` with the name of the security alert that you want to update, and `{resource_group_name}` with the name of the resource group that contains the alert.

        3. Verify that the security alert email has been set to the subscription owner by running the following command:

           ```
           az monitor activity-log alert show --name {alert_name} --resource-group {resource_group_name}
           ```

           This command will display the details of the security alert, including the email settings.

        By following these steps, you can remediate the misconfiguration "Ensure Security Alert Emails Set To Subscription Owners" for Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Ensure Security Alert Emails Set To Subscription Owners" for Azure using Python, you can use the Azure Python SDK to programmatically configure security alerts.

        Here are the step-by-step instructions to remediate this misconfiguration:

        1. Install the Azure Python SDK by running the following command:

        ```
        pip install azure-mgmt-monitor
        ```

        2. Authenticate with Azure by creating a Service Principal. You can follow the instructions in this Microsoft documentation to create a Service Principal: [https://docs.microsoft.com/en-us/azure/developer/python/azure-sdk-authenticate?tabs=cmd#create-a-service-principal](https://docs.microsoft.com/en-us/azure/developer/python/azure-sdk-authenticate?tabs=cmd#create-a-service-principal)

        3. Once authenticated, you can use the following Python code to configure security alerts to be sent to subscription owners:

        ```
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.monitor import MonitorManagementClient
        from azure.mgmt.monitor.models import ActionGroup, EmailReceiver, ActionGroupPatchBody

        # Replace the values below with your own
        subscription_id = '<your-subscription-id>'
        resource_group_name = '<your-resource-group-name>'
        action_group_name = '<your-action-group-name>'
        owner_email = '<your-owner-email>'

        # Create the credentials object
        credentials = ServicePrincipalCredentials(
            client_id='<your-client-id>',
            secret='<your-client-secret>',
            tenant='<your-tenant-id>'
        )

        # Create the MonitorManagementClient object
        monitor_client = MonitorManagementClient(credentials, subscription_id)

        # Create the action group
        action_group = ActionGroup(
            group_short_name=action_group_name,
            receivers=[EmailReceiver(name='Owner', email_address=owner_email)],
            enabled=True
        )
        monitor_client.action_groups.create_or_update(resource_group_name, action_group_name, action_group)

        # Update the default security alert action group to use the new action group
        default_action_group = ActionGroupPatchBody(
            enabled=True,
            action_group_id=action_group.id
        )
        monitor_client.alert_rules.update_action_group(resource_group_name, 'default', default_action_group)
        ```

        This code creates a new action group with an email receiver for the subscription owner's email address, and then updates the default security alert action group to use the new action group.

        Make sure to replace the placeholders in the code with your own values before running it.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_security_center_contact" "subscription_security_contact" {
          # Set this to the email address that should receive Azure Security Center alerts.
          email = "SECURITY_CONTACT_EMAIL@example.com" # replace with your security contact email

          # Optional but recommended
          phone = "SECURITY_CONTACT_PHONE_NUMBER"      # replace or remove if not needed

          # Ensure alert emails are enabled and sent to subscription owners/admins
          alert_notifications = "On"
          alerts_to_admins    = "On"
        }
        ```

        This change is in-place (no resource replacement); `terraform plan` should show `alert_notifications` and `alerts_to_admins` changing from `Off` (or being added) to `On` for `azurerm_security_center_contact.subscription_security_contact`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.microsoft.com/en-us/azure/security-center/security-center-provide-security-contact-details](https://docs.microsoft.com/en-us/azure/security-center/security-center-provide-security-contact-details)