Threat detection

As explained in Azure Security

Threat detection is the process of identifying activity or conditions that may represent a security threat or attack, including during container workload execution.

Threat detection identifies suspicious activity that may indicate an attack while container workloads run. In Kubernetes, effective monitoring covers both the control plane and worker nodes, helping surface crypto-mining processes, fileless attacks, malicious images, and unauthorized processes. section 4.4.3 section 7.2.2

Microsoft Defender for Containers applies layered runtime detection:

• Collects Kubernetes audit logs and security events from the API server to detect threats at the cluster and control-plane level. section 7.2.2
• Deploys the Microsoft Defender profile on each worker node to collect node signals for analysis in Defender for Cloud. section 7.2.2
• Uses auto-provisioning to deploy the Defender profile across nodes in an Azure Kubernetes Service cluster. section 7.2.2
• Generates a security alert when confidence is sufficiently high that suspicious activity represents an attack, then supports deeper investigation and response through Microsoft Sentinel. section 4.4.3

Runtime attack signal

A process started inside an immutable production container is suspicious. If an attacker deploys a crypto-mining image or launches a fileless attack, monitoring can detect the activity and raise an alert; patching the running container is not a durable fix because scale-out recreates it from the registry image. section 4.4.3 section 7.2.2

Figure 7.4 An architecture diagram of Defender for Containers for an Azure Kubernetes Service cluster

Use the architecture diagram to trace how Defender for Containers receives signals from an Azure Kubernetes Service cluster. section 7.2.2

How Azure Security covers it

How deep it goes

Explains control-plane logs, node agents, alert generation, investigation, and response, while deferring deeper service coverage.

Examples

Uses crypto-mining, fileless attacks, malicious container images, and processes started inside production containers.

What you can do after

Diagnose suspicious container activity through Defender for Cloud alerts and investigate incidents further with Microsoft Sentinel.

How it connects

Connects Kubernetes control planes, worker nodes, Microsoft Defender for Containers, Defender for Cloud, Microsoft Sentinel, and container registries.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Data-Driven CybersecurityAdvanced threat detection is the proactive identification and mitigation of potential cybersecurity threats using monitoring, anomaly detection, predictive analytics, or AI-driven models.

Compare how 2 books explain threat detection →

Related concepts

• threat huntingcontrasts with · Threat hunting is the proactive investigation of systems and networks to discover malicious activity that automated detection may have missed.
• scheduled query ruleused by · A scheduled query rule is a detection rule that periodically runs a query and generates security alerts or incidents when its results meet defined criteria.
• Microsoft Defender for Containerspart of · Microsoft Defender for Containers is Microsoft's cloud security service for detecting threats, assessing vulnerabilities, and enforcing security policies across containerized workloads and Kubernetes environments.
• artificial intelligenceused by · Artificial intelligence is the field concerned with creating computational systems that perform tasks associated with human intelligence, such as learning, reasoning, perception, or decision-making.
• security information and event managementused by · Security information and event management is a class of security systems that centrally collects, correlates, and analyzes security events and log data to support monitoring and response.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.