Remediate Security Alerts Using Azure Defender (part 1)

By Ashwin Venugopal -

 



To read part 2 please click here

Security Alerts

Security Center can generate alerts for resources deployed on Azure as well as on on-premises and hybrid cloud environments which are always triggered by advanced detections and are available only with the Azure Defender.

Respond to today's threats

There have been some important changes in the threat landscape over the last 20 years due to which the realities have been changed leading to an unprecedented level of professionalism in the attacker ranks. They are now interested in  stealing information, financial accounts, and private data- all of which they can use to generate cash on open market or use a particular business, political, or military position. 

To counter these, organizations often deploy various point solutions focused on defending either the enterprise perimeter or endpoints by looking for known attack signatures and these solutions often tend to generate a high volume of low fidelity alerts, which requires a security analyst to triage and investigate. Most organizations lacks the time and expertise required to respond to these alerts leading to so many go eventually unaddressed. 

Besides, the attackers have also evolved their methods to subvert many signature-based defenses and adapt to aloud environments which lead to the extensive requirement of new approaches to more quickly identify emerging threats as well as expedite detection and response. 

What are security alerts and security incidents?

Alerts are the notifications that Security Center generates whenever it detects threats on your resources while prioritizing and listing the alerts, along with the information needed for you to quickly investigate the problem.

A security incident is known as a collection of related alerts instead of listing each alert individually. Security Center uses Cloud Smart Alert Correlation to correlate different alerts and low fidelity signals into security incidents.

How does Security Center detect threats?

Security Center employs advanced security analytics, which is much better than the signature-based approaches and they includes the following:

  • Integrated threat intelligence- Microsoft has an immense amount of global threat intelligence and the researchers can also receive threat intelligence information shared among major cloud service providers as well as feeds from other third parties. Azure Security Center can use this information to alert you to threats from known bad actors.

  • Behavioral analytics- It is a technique that analyzes and compares data to a collection of known patterns that are determined through complex machine learning algorithms that are applied to the massive datasets. Azure Security Center can use behavioral analytics to identify compromised resources based on the analysis of virtual machine logs, virtual network device logs, fabric logs, and other sources.

  • Anomaly detection- Azure Security Center also uses anomaly detection to identify threats. Unlike to behavioral analysis, anomaly detection is more "personalized" and focuses on baselines specific to your deployments. Machine learning is applied to determine normal activity for your deployments which then generate rules to define outlier conditions that could represent a security events.

Continuous monitoring and assessments

Azure Security Center is appreciated for having security research and data science teams throughout Microsoft who continuously monitors for the changes in the landscape including the following initiatives:
  • Threat intelligence monitoring- which includes mechanisms, indicators, implications, and actionable advice about the existing or emerging threats. This information is shared in the security community, and Microsoft continuously monitors threat intelligence feeds from internal as well as external sources.

  • Signal sharing- Insights from security teams across the Microsoft's broad portfolio of cloud and on-premises services, servers, and client endpoint devices are shared as well as analyzed. 

  • Microsoft security specialists- Ongoing engagement with teams across Microsoft that works in specialized security fields, like forensics, and web attack detection. 

  • Detection tuning- Algorithms are run against customer datasets, and security researchers work with customers to validate the results. True and false positives are used to refine machine learning algorithms.  



To read part 2 please click here






Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different...
Read more

Deployment (Part 1)

By Ashwin Venugopal -
Image
  To read part 2, please click  here To read part 3, please click  here Azure Resources Microsoft Sentinel needs following resources to be created: Subscription (if a dedicated subscription(s) will be used) Resource group(s) Log Analytics workspace(s) Automation rules/playbook Alert rules Workbooks Microsoft Sentinel offers hundreds of alert rules, workbooks, and automation playbook templates along with hunting scripts. The templates can be used to activate/deploy schedule alerts, create customized dashboards, create automation playbooks and perform threat-hunting activities. Generally, once deployed, the resources created have to be adjusted to match the existing environment, configure local credentials, etc. Methods of deployment: Manual- Administrator can manually configures the Microsoft Sentinel resources with the help of Azure portal. Any manual process has the inherent risks of human operator error, lack of compliance with potential change control procedures, and u...
Read more

Project Resourcing (Part 2)

By Ashwin Venugopal -
Image
  To read part 1, please click  here Engineering - SIEM The SIEM engineers configures Microsoft Sentinel, including Log Analytics, Logic Apps, workbooks, and playbooks. They are also responsible for the following high-level tasks: Initial configuration of Azure tenant, including provisioning required resources, assigning access roles, and configuring workspace parameters like log retention, resource tagging, and blueprints.  Deployment and configuration of syslog/CEF log collection agents in appropriate locations to collect logs from on-premises devices. Generally, it will be joint effort of both system engineer and SIEM engineer, involving configuration and potential troubleshooting.  Working with system owners to enable log forwarding and configuring any required parsing of log data in Log Analytics.  Working with security operations to create and deploy KQL analytic rules to offer detections for SOC/Computer Security Incident Response Team (CSRIT) use. Tuning...
Read more