````plaintext
## Bicep Template

```bicep
// main.bicep - Microsoft Defender for Cloud Configuration
// Enables Defender plans for comprehensive security posture management
// and vulnerability scanning across Azure resources
//
// FedRAMP 20x KSI Alignment:
// - KSI-AFR-01: Vulnerability scanning and asset discovery
// - KSI-AFR-04: Vulnerability detection and remediation tracking
// - KSI-AFR-06: Continuous security assessments
// - KSI-AFR-07: Security posture and secure score monitoring
// - KSI-AFR-09: Compliance dashboard and regulatory mapping
// - KSI-AFR-11: Cryptographic module recommendations
// - KSI-PIY-01: Automated inventory (real-time asset tracking)
// - KSI-PIY-05: Evaluate implementations (security evaluation)
// - KSI-PIY-06: Security investment effectiveness metrics
// - KSI-PIY-07: Supply chain risk management
// - KSI-PIY-08: Executive support (engagement metrics)
// - KSI-TPR-04: Supply chain risk monitoring

targetScope = 'subscription'

param location string = deployment().location
param defenderEmailContact string
param defenderPhoneContact string = ''

// Security contact configuration
resource securityContact 'Microsoft.Security/securityContacts@2023-12-01-preview' = {
  name: 'default'
  properties: {
    emails: defenderEmailContact
    phone: defenderPhoneContact
    alertNotifications: {
      state: 'On'
      minimalSeverity: 'Medium'
    }
    notificationsByRole: {
      state: 'On'
      roles: ['Owner', 'Contributor']
    }
  }
}

// Enable Defender for Servers (VMs and VM Scale Sets)
// Supports: KSI-AFR-01 (vulnerability scanning), KSI-AFR-04 (vulnerability detection)
resource defenderForServers 'Microsoft.Security/pricings@2024-01-01' = {
  name: 'VirtualMachines'
  properties: {
    pricingTier: 'Standard'
    subPlan: 'P2'  // P2 includes vulnerability assessment, JIT access, file integrity monitoring
  }
}

// Enable Defender for App Service
resource defenderForAppService 'Microsoft.Security/pricings@2024-01-01' = {
  name: 'AppServices'
  properties: {
    pricingTier: 'Standard'
  }
}

// Enable Defender for Azure SQL Databases
resource defenderForSqlServers 'Microsoft.Security/pricings@2024-01-01' = {
  name: 'SqlServers'
  properties: {
    pricingTier: 'Standard'
  }
}

// Enable Defender for SQL Servers on VMs
resource defenderForSqlServerVms 'Microsoft.Security/pricings@2024-01-01' = {
  name: 'SqlServerVirtualMachines'
  properties: {
    pricingTier: 'Standard'
  }
}

// Enable Defender for Open-Source Relational Databases
resource defenderForOssDatabases 'Microsoft.Security/pricings@2024-01-01' = {
  name: 'OpenSourceRelationalDatabases'
  properties: {
    pricingTier: 'Standard'
  }
}

// Enable Defender for Storage
// Supports: KSI-AFR-01 (asset discovery), KSI-PIY-01 (automated inventory)
resource defenderForStorage 'Microsoft.Security/pricings@2024-01-01' = {
  name: 'StorageAccounts'
  properties: {
    pricingTier: 'Standard'
    extensions: [
      {
        name: 'OnUploadMalwareScanning'
        isEnabled: 'True'
        additionalExtensionProperties: {
          CapGBPerMonthPerStorageAccount: '5000'
        }
      }
      {
        name: 'SensitiveDataDiscovery'
        isEnabled: 'True'
      }
    ]
  }
}

// Enable Defender for Containers (AKS, ACR, running containers)
// Supports: KSI-AFR-01 (container vulnerability scanning), KSI-TPR-04 (supply chain monitoring)
resource defenderForContainers 'Microsoft.Security/pricings@2024-01-01' = {
  name: 'Containers'
  properties: {
    pricingTier: 'Standard'
    extensions: [
      {
        name: 'ContainerRegistriesVulnerabilityAssessments'
        isEnabled: 'True'
      }
    ]
  }
}

// Enable Defender for Key Vault
resource defenderForKeyVault 'Microsoft.Security/pricings@2024-01-01' = {
  name: 'KeyVaults'
  properties: {
    pricingTier: 'Standard'
  }
}

// Enable Defender for Resource Manager
resource defenderForArm 'Microsoft.Security/pricings@2024-01-01' = {
  name: 'Arm'
  properties: {
    pricingTier: 'Standard'
  }
}

// Enable Defender for DNS
resource defenderForDns 'Microsoft.Security/pricings@2024-01-01' = {
  name: 'Dns'
  properties: {
    pricingTier: 'Standard'
  }
}

// Enable Defender for Cosmos DB
resource defenderForCosmosDb 'Microsoft.Security/pricings@2024-01-01' = {
  name: 'CosmosDbs'
  properties: {
    pricingTier: 'Standard'
  }
}

// Auto-provisioning settings - Deploy Log Analytics agent to VMs
resource autoProvisioning 'Microsoft.Security/autoProvisioningSettings@2017-08-01-preview' = {
  name: 'default'
  properties: {
    autoProvision: 'On'
  }
}

// Link to Log Analytics workspace for Defender data collection
resource workspaceSetting 'Microsoft.Security/workspaceSettings@2017-08-01-preview' = {
  name: 'default'
  properties: {
    workspaceId: logAnalyticsWorkspaceId
    scope: subscription().id
  }
}

// Parameters
param logAnalyticsWorkspaceId string

// Outputs
output securityContactId string = securityContact.id
output defenderPlansEnabled array = [
  'VirtualMachines'
  'AppServices'
  'SqlServers'
  'SqlServerVirtualMachines'
  'OpenSourceRelationalDatabases'
  'StorageAccounts'
  'Containers'
  'KeyVaults'
  'Arm'
  'Dns'
  'CosmosDbs'
]
```

## Usage Notes

**FedRAMP Alignment:**
- Enables Defender across ~8-10 KSIs (AFR, PIY, TPR families)
- Supports automated vulnerability scanning (KSI-AFR-01, KSI-AFR-04)
- Enables security posture management (KSI-PIY-01, KSI-TPR-04)
- Provides compliance dashboards for evidence collection

**Deployment:**
```bash
# Set parameters
DEFENDER_EMAIL="security@example.com"
DEFENDER_PHONE="+1-555-0100"
LOG_ANALYTICS_ID="/subscriptions/{sub-id}/resourceGroups/{rg}/providers/Microsoft.OperationalInsights/workspaces/{workspace}"

# Deploy at subscription scope
az deployment sub create \
  --location eastus \
  --template-file main.bicep \
  --parameters defenderEmailContact=$DEFENDER_EMAIL \
               defenderPhoneContact=$DEFENDER_PHONE \
               logAnalyticsWorkspaceId=$LOG_ANALYTICS_ID
```

**Alternative Tools:**
If not using Defender for Cloud, consider:
- **Qualys** or **Tenable** for vulnerability scanning
- **Azure Policy** for compliance monitoring
- **Azure Resource Graph** for inventory management
- **Trivy** or **Snyk** for container scanning

````
