Defender Realignment — Summary for Production Owner
Date: 2026-02-18 Prepared by: Leon Geldenhuys
What We Did
Our Jira tracking for Microsoft Defender for Cloud findings was significantly misaligned with Defender’s actual severity ratings. Many items we categorized as Low or Medium were actually High in Defender. Items marked “Done” in Jira were still showing as Unhealthy in Defender — meaning our security score wasn’t improving as expected.
We pulled live data from Defender via az security assessment list, cross-referenced every Jira ticket against it, and realigned everything.
Changes Made
| Action | Count |
|---|---|
| Renamed DEVOPS-82 Epic from “Defender - P1 (Critical)” to “Defender - High” | 1 |
| Existing items moved to correct severity | 17 |
| ”Done” items reopened (still Unhealthy in Defender) | 9 |
| New Jira issues created for untracked findings | 42 |
| Environment labels added (env-prod / env-nonprod) | all |
| Closed redundant Epic (DEVOPS-109) | 1 |
Before: 54 items across 3 custom tiers (P1/Medium/Low), many miscategorized. After: 90 open items across 3 Defender-aligned tiers (High/Medium/Low), all with environment labels.
Why 3 Tiers, Not 4?
Defender recommendations use High/Medium/Low severity only. The “Critical” shown in the Defender portal is a risk-based aggregation (considers attack paths, internet exposure, lateral movement) — not a per-recommendation severity. We capture that risk-based status using labels (risk-critical, risk-high, attack-path) rather than a separate Epic.
Current State
| Severity | Epic | Open | Wave 1 (prod) |
|---|---|---|---|
| High | DEVOPS-82 | 34 | 27 |
| Medium | DEVOPS-83 | 39 | — |
| Low | DEVOPS-84 | 17 | — |
| Total | 90 |
SLAs
| Severity | Target |
|---|---|
| High | 1 week |
| Medium | 2 weeks |
| Low | 1-2 sprints |
How to Use It
Wave Prioritization
Work is split into waves by severity and environment:
| Wave | What | When | JQL |
|---|---|---|---|
| 1 | High + prod | Now | labels = Defender AND labels = env-prod AND parent = DEVOPS-82 AND status != Done |
| 2 | High + non-prod, Medium + prod | Next sprint | Combined |
| 3 | Medium + non-prod | Following sprint | labels = Defender AND labels = env-nonprod AND parent = DEVOPS-83 AND status != Done |
| 4 | Low + prod | Backlog | labels = Defender AND labels = env-prod AND parent = DEVOPS-84 AND status != Done |
| 5 | Low + non-prod | Backlog | labels = Defender AND labels = env-nonprod AND parent = DEVOPS-84 AND status != Done |
Items with risk-critical or attack-path labels should be escalated within their wave.
Labels on Every Issue
| Label | Meaning |
|---|---|
Defender | All Defender findings (required) |
defender-high / medium / low | Matches the Epic severity |
env-prod | Affects production resources |
env-nonprod | Affects non-production resources |
risk-critical | In Defender’s Critical risk view (add manually when reviewing portal) |
attack-path | Has associated attack path alerts |
Quick JQL Filters
- All open:
project = DEVOPS AND labels = Defender AND status != Done ORDER BY priority DESC - Wave 1 (start here):
project = DEVOPS AND labels in (Defender, env-prod) AND parent = DEVOPS-82 AND status != Done - What’s affecting prod?:
project = DEVOPS AND labels in (Defender, env-prod) AND status != Done ORDER BY priority DESC
Next Steps
Immediate (This Week)
-
Review Wave 1 — 27 High-severity items affecting production. Pull up the JQL filter and review with the team. Key areas:
- VM security: NSG ports (DEVOPS-35), disk encryption (DEVOPS-37), system updates (DEVOPS-107), secrets on VMs (DEVOPS-67, DEVOPS-126)
- SQL hardening: Vulnerability findings (DEVOPS-31, DEVOPS-42), DB roles (DEVOPS-129, DEVOPS-130), TLS enforcement (DEVOPS-115, DEVOPS-122)
- Identity: Privileged roles (DEVOPS-87), disabled accounts (DEVOPS-117, DEVOPS-118), service principal roles (DEVOPS-90)
- Web apps: FTPS (DEVOPS-120), managed identity (DEVOPS-127)
-
Investigate 3 “not found” items — DEVOPS-30, 40, 41 have no matching Defender recommendation. They may be resolved, deprecated, or renamed. Check the Defender portal and close or reclassify.
-
Confirm ambiguous resources — These resources were classified based on best guess:
- vm-tmhp-int → assumed prod (in RG-ESHARS-PROD)
- vm-eshars-sftp → assumed prod (shared service)
- vm-sql-access, vm-hisd-sql-access → assumed prod
- esharsportal → assumed prod
- eshars-loadtest-secrets → assumed non-prod
- nursingmodulepocappservice → assumed non-prod
Sprint Planning
- Add Wave 1 items to the current sprint — Start with the 27 High + prod items
- Assign owners — Each item needs an engineer assigned for triage and remediation
- Review the 30 attack path emails — All relate to “Internet exposed Azure VM with high severity vulnerabilities” (DEVOPS-35, DEVOPS-42). These are generating daily alerts.
Ongoing
- Monthly intake — Pull fresh Defender data, cross-reference, create new tickets. Full process documented in defender-guide.md.
- Update risk labels — When reviewing the Defender portal, add
risk-criticalandattack-pathlabels to relevant issues. - Verify fixes in Defender — After remediation, confirm in Defender (24-hour assessment cycle) before closing Jira tickets.
Reference Documents
| Document | Purpose |
|---|---|
| defender-guide.md | Full how-to guide (intake, triage, closing, JQL, az CLI) |
| defender-process.md | Process definition (Epics, labels, SLAs, workflows) |
| defender-register.md | Quick-reference index of all tracked findings |
| plan-defender-realignment.md | Full plan with results (what was done and why) |
| findings-2026-02-18.json | Raw Defender data from this pull |
| parse_defender.py | Script for monthly intake (reusable) |