Cloud security explorer

As explained in Azure Security

Cloud security explorer is a Microsoft Defender for Cloud capability for querying and exploring security relationships and risks in a cloud environment.

Cloud security explorer is a Microsoft Defender for Cloud capability for querying cloud security data and contextual relationships. Graph-based queries reveal exploitable resources and their potential business effects, helping prioritize risks such as vulnerable, internet-exposed virtual machines with access to sensitive storage. section 6.3.2 section 6.9

Figure 6.7 The cloud security explorer in Microsoft Defender for Cloud

Use the explorer view to inspect relationships among resources, vulnerabilities, insights, recommendations, and connections. section 6.3.2

Build queries from the security information available in the environment:

• Recommendations identify supported security recommendations. section 6.3.2
• Vulnerabilities expose findings from Microsoft Defender for Cloud. section 6.3.2
• Insights provide contextual information about resources. section 6.3.2
• Connections show relationships between resources, such as access to storage accounts or key vaults. section 6.3.2 section 6.3.1

Find internet-exposed vulnerable virtual machines

Open Microsoft Defender for Cloud in the Azure portal and select Cloud Security Explorer. Choose Virtual Machines, add a Vulnerabilities filter with Severity equal to High, then add an Insight filter whose Title is Exposed to the Internet. Select Search and inspect individual results for additional resource insights. section 6.3.2

Practice identity and repository investigations

Query Identity & Access user accounts that do not have MFA enabled and have permissions to Azure Storage Accounts. Separately, query DevOps code repositories that allow public access. These investigations extend the explorer from infrastructure risks to identity and code-to-cloud exposure. section 6.8 section 11.8 section 11.4.9

How Azure Security covers it

How deep it goes

Demonstrates portal-based filters and result inspection without describing an independent query language or automation workflow.

Examples

Uses queries for vulnerable internet-exposed VMs, non-MFA users with storage access, and publicly accessible code repositories.

What it assumes

Requires Defender CSPM for advanced capabilities such as the cloud security graph, while subscription onboarding provides basic posture data.

What you can do after

Diagnose/debug with it by constructing portal queries that reveal exposed, vulnerable, or improperly accessible resources.

How it connects

Connects vulnerabilities, recommendations, insights, resource connections, attack paths, Defender CSPM, and DevOps repositories.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Related concepts

• graph queryuses · A graph query retrieves or derives information by traversing or analyzing nodes and edges representing entities and their relationships.
• cloud security graphuses · The cloud security graph is a contextual model of an environment's resources, connections, exposures, lateral-movement possibilities, and vulnerabilities used to identify security risks and attack paths.
• Microsoft Defender for Clouduses · Microsoft Defender for Cloud is a cloud security service that assesses security posture, detects threats, and provides security recommendations for cloud and hybrid workloads.
• repositoryuses · A software repository is an organized storage location or collection of project files and related artifacts, often managed with version history and change tracking.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.