book

Microsoft Defender for Cloud Cookbook

Name: Microsoft Defender for Cloud Cookbook
Author: Sasha Kranjac
ISBN: 9781801076135

by Sasha Kranjac

July 2022

Intermediate to advanced

314 pages

5h 34m

English

Packt Publishing

Read now

Unlock full access

Microsoft Defender for Cloud Cookbook
ContributorsAbout the authorAbout the reviewers
Preface
Who this book is forWhat this book coversTo get the most out of this bookDownload the color imagesConventions usedGet in touchReviewsShare Your Thoughts
Chapter 1: Getting Started with Microsoft Defender for Cloud
Technical requirementsEnabling Microsoft Defender for Cloud Plans on Azure Subscriptions and Log Analytics WorkspacesGetting readyHow to do it…How it works…Enabling an Microsoft Defender for Cloud Plans on an Azure SubscriptionGetting readyHow to do it…How it works…There's more…Enabling an Microsoft Defender for Cloud Plans on a Log Analytics WorkspaceGetting readyHow to do it…How it works…Enabling an Microsoft Defender for Cloud Plans on multiple Azure Subscriptions and Log Analytics WorkspacesGetting readyHow to do it…How it works…Configuring data collection in a Log Analytics WorkspaceGetting readyHow to do it…How it works…Configuring provisioning extensions automaticallyGetting readyHow to do it…How it works…Enabling a Log Analytics agent for Azure VMs manually in the Log Analytics Workspace settingsGetting readyHow to do it…How it works…Enabling a Log Analytics agent for Azure VMs manually in the Virtual Machine settingsGetting readyHow to do it…How it works…There's more…Configuring a Log Analytics agent for Azure VMs extension deploymentGetting readyHow to do it…How it works…Configuring email notificationsGetting readyHow to do it…How it works…Assigning Microsoft Defender for Cloud permissionsGetting readyHow to do it…How it works…Onboarding Microsoft Defender for Cloud using PowerShellGetting readyHow to do it…How it works…There's more…Enabling Microsoft Defender for Cloud integration with other Microsoft security servicesGetting readyHow to do it…How it works…
Chapter 2: Multi-Cloud Connectivity
Technical requirementsConnecting non-Azure virtual machines using Azure ArcGetting readyHow to do it…How it works…Connecting non-Azure virtual machines using Microsoft Defender for Cloud portal pagesGetting readyHow to do it…How it works…Setting up Amazon Web Services Config and Amazon Web Services Security HubGetting readyHow to do it…How it works…Creating an Identity and Access Management AWS role for Microsoft Defender for CloudGetting readyHow to do it…How it works…Connecting Amazon Web Services to Microsoft Defender for CloudGetting readyHow to do it…How it works…There's more…Configuring GCP Security Command Center and enabling GCP Security Command Center APIGetting readyHow to do it…How it works…Creating a GCP service account and connecting GCP to Microsoft Defender for CloudGetting readyHow to do it…How it works…
Chapter 3: Workflow Automation and Continuous Export
Technical requirementsCreating logic apps for use in Microsoft Defender for CloudGetting readyHow to do it…How it works…There's more…See alsoAutomating threat detection alert responsesGetting readyHow to do it…How it works…Automating Microsoft Defender for Cloud recommendation responsesGetting readyHow to do it…How it works…Automating regulatory compliance standards responsesGetting readyHow to do it…How it works…Configuring continuous export to Event HubGetting readyHow to do it…How it works…Configuring continuous export to a Log Analytics workspaceGetting readyHow to do it…How it works…
Chapter 4: Secure Score and Recommendations
Technical requirementsUnderstanding, filtering, and sorting recommendationsGetting readyHow to do it...How it works...Downloading a recommendation reportGetting readyHow to do it...How it works...Creating a recommendation exemption ruleGetting readyHow to do it...How it works...Creating a recommendation enforcement ruleGetting readyHow to do it...How it works...There's more...Preventing creating resources using a Deny ruleGetting readyHow to do it...How it works...There's more...Disabling a recommendationGetting readyHow to do it...How it works...Fixing recommendations on affected resourcesGetting readyHow to do it...How it works...Managing a recommendation query in Azure Resource Graph ExplorerGetting readyHow to do it...How it works...Getting a secure score using Azure Resource GraphGetting readyHow to do it...How it works...There's more...
Chapter 5: Security Alerts
Technical requirementsFiltering, grouping, and exporting security alertsGetting readyHow to do itHow it worksThere's moreResponding to security alerts using automated responsesGetting readyHow to do itHow it worksCreating suppression rulesGetting readyHow to do itHow it worksThere's moreOrganizing security alerts and changing a security alert statusGetting readyHow to do itHow it works
Chapter 6: Regulatory Compliance and Security Policy
Technical requirementsManaging Microsoft Defender for Cloud's default security policyGetting readyHow to do it…How it works…Adding a custom security initiative and policyGetting readyHow to do it…How it works…Adding a regulatory compliance standardGetting readyHow to do it…How it works…See alsoImproving regulatory compliance, exempting, and denying a compliance controlGetting readyHow to do it…How it works…Accessing and downloading compliance reportsGetting readyHow to do it…How it works…
Chapter 7: Microsoft Defender for Cloud Workload Protection
Technical requirementsEnabling a vulnerability assessment solutionGetting readyHow to do it…How it works…Enabling and configuring JIT access on a virtual machine Getting readyHow to do it…How it works…Requesting access to a JIT-enabled virtual machineGetting readyHow to do it…How it works…Configuring the adaptive application control groupGetting readyHow to do it…How it works…Managing adaptive network hardeningGetting readyHow to do it…How it works…There's more…Remediating vulnerabilities in Azure Container Registry imagesGetting readyHow to do it…How it works…Managing a SQL vulnerability assessmentGetting readyHow to do it…How it works…Managing file integrity monitoringGetting readyHow to do it…How it works…
Chapter 8: Firewall Manager
Technical requirementsCreating an Azure firewallGetting readyHow to do it…How it works…Creating an Azure firewall using PowerShellGetting readyHow to do it…How it works…Creating an Azure firewall policyGetting readyHow to do it…How it works…Creating an Azure firewall policy using PowerShellGetting readyHow to do it…How it works…

Chapter 9: Information Protection
Creating and managing sensitivity labelsGetting readyHow to do it…How it works…There's more…Creating and managing information types and managing information protection policyGetting readyHow to do it…How it works…There's more…
Chapter 10: Workbooks
Technical requirementsCreating a workbook from an existing templateGetting readyHow to do it…How it works…Creating a workbook from an empty workbookGetting readyHow to do it…How it works…There's more…Managing workbooks and workbook templatesGetting readyHow to do it…How it works…
Why subscribe?
Other Books You May EnjoyPackt is searching for authors like youShare Your Thoughts

Content preview from Microsoft Defender for Cloud Cookbook

Chapter 3: Workflow Automation and Continuous Export

In this chapter, you will learn how to configure Microsoft Defender for Cloud workflow automation, configure continuous data export, and automate Microsoft Defender for Cloud responses.

Although automation is great and very useful, since it reduces security administrator fatigue and greatly shortens the time to react to events and potential threats, it is of the utmost importance to know that you should not automate everything immediately. Automation needs to be planned, and a decision to automate, especially if it concerns security, needs to be justified and developed over time.

Enabling automation just to reduce or eliminate work could make an environment less secure, so some tasks need ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781801076135

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Microsoft Defender for Cloud Cookbook

by Sasha Kranjac

Chapter 3: Workflow Automation and Continuous Export

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.