Continuous export

As explained in Azure Security

Continuous export is the ongoing transfer of selected security data from a source service to a configured destination as changes or scheduled snapshots occur.

Continuous export streams selected Microsoft Defender for Cloud data to another system, helping organizations retain, analyze, and operationalize security information beyond the service’s retention period. section 7.11 section 7.5.1

Configure continuous export by choosing three elements:

• Select recommendations, secure score data, security alerts, or regulatory compliance data. section 7.5.1
• Choose a Log Analytics workspace to retain data inside Azure, or an Event Hub to send it outside Azure, such as to an on-premises SIEM. section 7.5.1
• Enable streaming updates, weekly snapshots, or both. Streaming updates send data when selected values change; snapshots send the current state once per week per subscription. section 7.5.1

Retain alerts and recommendations for 180 days

To retain medium- and high-severity security alerts and recommendations in a Log Analytics workspace, open Microsoft Defender for Cloud in the Azure portal, select Environment Settings, choose the subscription, and open Continuous Export. Select the Log Analytics Workspace tab, enable Security Recommendations and Security Alerts, choose Medium and High, enable Security Findings for nested recommendations, select Streaming Updates and Snapshots, choose the configuration resource group and destination subscription, select the workspace, and save. Alerts appear in the SecurityAlert table and recommendations in the SecurityRecommendation table. Configure the appropriate workspace or Event Hub permissions before saving. section 7.5.2

Figure 7.9 Configuring continuous export in Microsoft Defender for Cloud

Use the configuration view to locate the subscription, destination workspace, selected data types, severity filters, and export frequencies. section 7.5.2

How Azure Security covers it

How deep it goes

Explains data selection, destinations, frequencies, portal configuration, permissions, and resulting Log Analytics tables.

Examples

Uses a portal configuration that exports medium- and high-severity alerts and recommendations to Log Analytics with streaming and weekly snapshots.

What it assumes

Requires Security Admin or Owner access plus workspace-solution or Event Hub permissions appropriate to the selected destination.

What you can do after

Operate continuous security-data retention and analysis by configuring exports through the Azure portal.

How it connects

Connects Defender for Cloud with Log Analytics workspaces, Event Hubs, on-premises SIEMs, Microsoft Sentinel, and Azure Monitor workbooks.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Related concepts

• Microsoft Defender for Clouduses · Microsoft Defender for Cloud is a cloud security service that assesses security posture, detects threats, and provides security recommendations for cloud and hybrid workloads.
• Log Analyticsconfigures · Log Analytics is an Azure Monitor service and data store for collecting, retaining, querying, and analyzing logs, telemetry, and related operational data.
• snapshothas part · A snapshot is a fixed representation or copy of data or system state as it existed at a particular point in time.
• workbookused by · An Azure Monitor workbook is an interactive report that combines data queries, visualizations, and text to present operational or security information.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.