| Plugin Title | Monitor IP Forwarding |
| Cloud | AZURE |
| Category | Defender |
| Description | Ensures that Virtual Machine IP Forwarding Monitoring is enabled in Microsoft Defender. |
| More Info | IP Forwarding feature should be monitored to meet you organization's security compliance requirements. |
| AZURE Link | https://learn.microsoft.com/en-us/azure/defender-for-cloud/policy-reference |
| Recommended Action | Enable IP Forwarding Monitoring by ensuring AuditIfNotExists setting is used for 'IP Forwarding on your virtual machine should be disabled' from the Microsoft Defender. |
- Log in to the Microsoft Azure Management Console.
- Select the "Search resources, services, and docs" option at the top and search for "Policy" and select the "Policy".
- Scroll down the left navigation panel and select "Compliance".
- On the "Policy | Compliance" page, under "Name" column select compliance for the "Scope" of necessary Subscription.
- On the "Policy| Compliance" page select the "View Assignment" Tab on the top.
- On the "Policy| Compliance | Subscription" page, Select the "Edit Assignment" Tab at the top.
- On the Assign Initiative page, select the "Parameters" tab and uncheck "Only show parameters that need input or review". It will show you a list of parameters.
- In the list search for the setting "IP Forwarding on your virtual machine should be disabled". If it's set to "Disabled" then "IP Forwarding Monitoring" is not enabled on the selected "Subscription".
- To enable "IP Forwarding Monitoring" click to open the dropdown of "IP Forwarding on your virtual machine should be disabled" and select the "AuditIfNotExists" option.
- Click on the "Review + save" button to make the necessary changes.
- Repeat steps number 3 - 10 to ensure "IP Forwarding Monitoring" is configured from the Azure Defender.
