Azure Monitor collects, analyzes, visualizes, and responds to telemetry from applications, guest operating systems, Azure resources, underlying services, and Azure as a platform. Its standardized view of security and performance data supports investigations into suspicious activity and potential compromise. section 9.2
Configure collection according to the telemetry source:
- Use platform data, including platform metrics, which Azure collects automatically. section 9.10
- Create diagnostic settings for resource logs and activity logs, then send them to a Log Analytics workspace or Azure Storage account. section 9.10
- Use Azure Monitor Agent for guest operating-system logs; configure a data collection rule to specify the data and destination. section 9.10
Detecting anomalous usage
Define an alert rule for a performance metric such as virtual-machine CPU usage. When the threshold is exceeded, Azure Monitor generates an alert and can connect notifications to Azure Logic Apps or Azure Functions for response workflows. section 9.5 section 9.10
Treat Azure Monitor as one layer of Azure security: its data can reveal compromise indicators, but securing an environment also requires addressing other controls and misconfigurations. section 1.1
