Graph query

As explained in Azure Security

A graph-based query retrieves information by evaluating nodes and relationships in a graph-structured representation of resources and security context.

A graph query evaluates resources, security findings, contextual insights, and relationships to reveal exploitable conditions and their business effect. In Microsoft Defender for Cloud, Cloud Security Explorer applies these queries to cloud security data, helping prioritize risks such as vulnerable virtual machines that can reach sensitive storage. section 6.3.2 section 6.9

Build a query for internet-exposed virtual machines with high-severity vulnerabilities:

• Open Microsoft Defender for Cloud in the Azure portal and select Cloud Security Explorer. section 6.3.2
• Select Virtual Machines, add a Vulnerabilities filter, and set Severity to Equals > High. section 6.3.2
• Add an Insight filter, select Title, and choose Exposed to the Internet. section 6.3.2
• Select Search, then inspect the returned resources and open individual results for additional insights. section 6.3.2

The same approach can investigate relationships between repositories, compute resources, data stores, recommendations, vulnerabilities, and contextual insights. Onboarded repositories from Defender for DevOps can therefore be examined through Cloud Security Explorer to assess whether they are accessible from the internet. section 11.4.9 section 6.3.2

Repository exposure check

Write a Cloud Security Explorer query that determines whether any repositories in the environment are accessible to the internet. section 11.4.9

Figure 6.7 The cloud security explorer in Microsoft Defender for Cloud

Use the Cloud Security Explorer view to connect query filters with the surrounding security context. section 6.3.2

How Azure Security covers it

How deep it goes

Walks through portal filters for one vulnerability-and-exposure query but stops short of query-language syntax or graph internals.

Examples

Demonstrates internet-exposed virtual machines with high-severity vulnerabilities and proposes checking repository internet accessibility.

What it assumes

Requires security data from the environment; advanced cloud security graph capabilities require the Defender CSPM plan.

What you can do after

Apply via Cloud Security Explorer to investigate resource exposure, vulnerability severity, relationships, and business effect.

How it connects

Connects Cloud Security Explorer with Microsoft Defender for Cloud, Defender CSPM, vulnerabilities, insights, connections, attack paths, and Defender for DevOps.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Related concepts

• cloud security explorerused by · Cloud security explorer is a Microsoft Defender for Cloud capability for querying and exploring security relationships and risks in a cloud environment.
• graphuses · A graph is a mathematical structure consisting of vertices connected by edges that represent relationships or connections.
• knowledge baseuses · A knowledge base is an organized collection of information that can be accessed or queried to support reference, retrieval, or reasoning.
• traversaluses · Traversal is the systematic process of visiting elements or nodes in a data structure according to its links, ordering, or a specified rule.
• SQLequivalent to · SQL is a standardized declarative language for defining, querying, and manipulating data and structures in relational database systems.
• repositoryuses · A software repository is an organized storage location or collection of project files and related artifacts, often managed with version history and change tracking.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.