Security contacts should have attack path email notifications enabled at the configured minimum risk level
Checks that Microsoft Defender for Cloud sends attack path email notifications for each subscription, with a minimal risk level defined. The notification setting must be present and its configured risk level must meet the required threshold.
Without alerts on exploitable attack paths, security teams lose visibility, enabling lateral movement, privilege escalation, and data exfiltration before containment, degrading confidentiality, integrity, and availability.
What this control checks
Attack path email notifications are enabled with a minimal risk level that meets the threshold.
Audit evidence
Evidence that deployed resources meet this control: Prowler check defender_attack_path_notifications_properly_configured (prowler azure --checks defender_attack_path_notifications_properly_configured).
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 9.1.15 (Ensure that 'Notify about attack paths with the following risk level (or higher)' is enabled).
CIS Azure Benchmark v5.0.0: Mapped to 8.1.15 (Ensure that 'Notify about attack paths with the following risk level (or higher)' is enabled).
BSI C5:2025: Mapped to OPS-04.01B (Policies and instructions with specifications for protection against malware are documented, communicated, and provided...) and OPS-05.01B (System components under the cloud service provider's responsibility that are used to operate the cloud service in the...).
HIPAA Security Rule 2003: Mapped to 164.308(a)(6)(i) (Security incident procedures).
Framework mappings
The clauses this control is mapped to in each framework.
- 9.1.15 Ensure that 'Notify about attack paths with the following risk level (or higher)' is enabled
- 8.1.15 Ensure that 'Notify about attack paths with the following risk level (or higher)' is enabled
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- OPS-05.01B System components under the cloud service provider's responsibility that are used to operate the cloud service in the production environment are configured with malware protection according to the policies and instructions.
- 164.308(a)(6)(i) Security incident procedures
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_defender_attack_path_notifications_properly_configured - Prowler Check:
defender_attack_path_notifications_properly_configured
Last reviewed: 2026-10-11