Cloud workload protection

As explained in Azure Security

Cloud workload protection is the monitoring of cloud workloads for suspicious activity and indicators of compromise, with security alerts generated for potentially significant threats.

Cloud workload protection continuously monitors cloud environments for suspicious activity and potential signs of compromise. When activity reaches a high level of suspicion, Microsoft Defender for Cloud generates a security alert with investigation details. It complements security hygiene: fixing misconfigurations reduces exposure, while monitoring helps identify attacks that still occur. section 6.5.2 section 7.1

Defender for Cloud distributes monitoring across stages of the kill chain, covering activity from initial probing through lateral movement and attempted data exfiltration. Capabilities are organized into resource-specific Defender plans because monitoring virtual machines, containers, databases, key vaults, and other workloads differs. section 7.1 section 7.0

Common workload-protection plans include:

• Microsoft Defender for Servers, App Service, Azure SQL Databases, SQL Servers on Machines, Open-Source Relational Databases, Azure Cosmos DB, Storage, Containers, Key Vault, Resource Manager, and DNS. section 7.2
• Email notifications can alert relevant stakeholders when security alerts are generated. section 7.11
• Workflow automation can invoke Logic Apps and integrate alerts with IT service management or messaging platforms. section 7.11
• Continuous export can stream Defender for Cloud data to Event Hubs or Log Analytics workspaces, while workbooks provide visual monitoring. section 7.11

Figure 7.1 Microsoft Defender for Cloud plans that can be enabled on an Azure subscription

Use the plan overview to compare the Defender for Cloud protections available for an Azure subscription. section 7.2

How Azure Security covers it

How deep it goes

Explains continuous detection, kill-chain coverage, resource-specific plans, alerts, and integrations without detailing detection algorithms.

Examples

Uses virtual machines, Kubernetes, databases, key vaults, containers, storage, and resource-specific Defender plans as monitoring examples.

What it assumes

Assumes Azure resources and basic security hygiene, while distinguishing monitoring from posture assessment and remediation recommendations.

What you can do after

Operate/configure Defender plans, review security alerts, notify stakeholders, automate responses, export data, and visualize monitoring results.

How it connects

Connects cloud security posture management, DevOps security management, kill chain analysis, security alerts, workflow automation, and Logic Apps.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Related concepts

• information security continuous monitoringequivalent to · Information security continuous monitoring is the ongoing collection and analysis of systems, networks, controls, and activity to maintain security awareness and identify relevant changes, threats, or incidents.
• Microsoft Defender for Clouduses · Microsoft Defender for Cloud is a cloud security service that assesses security posture, detects threats, and provides security recommendations for cloud and hybrid workloads.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.