Extend Azure Provider: Microsoft Defender External Attack Surface Monitoring (EASM)

[mm-weber]

Can someone please extend the Azure provider with EASM related information?

az rest --method GET --url https://management.azure.com/subscriptions/<subscriptionName>/providers/Microsoft.Easm/workspaces?api-version=2023-04-01-preview

{
  "value": [
    {
      "id": "/subscriptions<subscriptionName>resourceGroups/<resourceGroupName>/providers/Microsoft.Easm/workspaces/<workspaceName>",
      "location": "eastus",
      "name": <workspaceName>,
      "properties": {
        "dataPlaneEndpoint": "eastus.easm.defender.microsoft.com",
        "provisioningState": "Succeeded"
      },
      "systemData": {
        "createdAt": "2025-03-31T11:43:47.504995Z",
        "createdBy": "<user>",
        "createdByType": "User",
        "lastModifiedAt": "2025-03-31T11:43:47.504995Z",
        "lastModifiedBy": "<user>",,
        "lastModifiedByType": "User"
      },
      "tags": {},
      "type": "microsoft.easm/workspaces"
    }
  ]
}

Suggested MQL

azure.subscription.resourceGroups {providers.Microsoft.Easm.workspaces}

[afiune]

This looks more like a Microsoft Defender thing https://learn.microsoft.com/en-us/rest/api/defenderforeasm/?view=rest-defenderforcloud-2024-08-01

I am going to add a new service called azure.subscription.easmDefender similar to azure.subscription.cloudDefender

[afiune]

It doesn't look that EASM exist in the Go SDK https://github.com/Azure/azure-sdk-for-go so if we want this today, we will have to make raw HTTP requests, are we ok with that? Have we done that in the past?

[afiune]

Additionally, EASM is in preview mode https://learn.microsoft.com/en-us/rest/api/defenderforeasm/?view=rest-defenderforeasm-controlplanepreview-2023-04-01-preview

@vjeffrey @mm-weber we should wait a bit to add this resource.

[afiune]

I pushed my changes to a branch 👆🏽 for now.