azure_generate_security_report
Generate comprehensive security assessment reports from Azure scan results. Supports quick (4 tools) or full (40 tools) scan with compliance and remediation details.
Instructions
ENHANCED v1.14.0 Generate comprehensive security assessment report from scan results. NEW: fullScan parameter now runs ALL 40 security tools (was 34)! Quick scan (default) runs 4 core tools. Comprehensive scan (fullScan: true) runs ALL 40 tools including: Storage (with SAS+WORM), NSG (with service endpoints+LB), SQL (PostgreSQL/MySQL/Redis), KeyVault, VMs, CosmosDB, ACR, AKS, RBAC, Service Principals (RBAC-based), Managed Identities (with federation), Function Apps (with Event Grid/Service Bus), Backup Security (with ASR), VNet Peering, Private Endpoints, Diagnostic Settings, Defender Coverage, Policy Compliance, and more. Produces executive summary, risk prioritization, findings by severity (CRITICAL/HIGH/MEDIUM/LOW), remediation matrix, compliance mapping (CIS/NIST). Supports PDF, HTML, CSV, JSON export.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| subscriptionId | Yes | Azure subscription ID to report on | |
| resourceGroup | No | Optional: Filter by specific resource group | |
| format | No | Output format: 'markdown' (default), 'json', 'html', 'pdf', or 'csv' | |
| outputFile | No | Optional: Save report to file (e.g., C:\\reports\\security-report.pdf) | |
| fullScan | No | Run comprehensive scan using all 40 security tools (v1.14.0: +6 new tools including Backup, VNet Peering, Private Endpoints, Diagnostic Settings, Defender, Policy). Default: false for quick 4-tool scan. Includes: VMs, AKS, ACR, CosmosDB, RBAC, Managed Identities, Public IPs + core scans + new v1.14.0 enhancements | |
| includeRemediation | No | Include detailed remediation guidance (default: true) | |
| includeCompliance | No | Include compliance framework mapping (default: true) |