Hello, Cloud Gurus, and welcome back.
In this lesson, we're going to take a look
at Monitoring and Securing Windows Server
with Hybrid Technologies.
Let's take a look at what we're going to cover.
First up, we'll go over
the hybrid monitoring and security solutions
available to you from Azure.
We'll take a look at configuring hybrid monitoring,
and then we'll finish up with a demo
where we will configure monitoring and securing
for Windows Server hybrid workloads.
Now, I don't expect this topic
to be a huge part of the exam,
but it is a huge topic.
So I'm aiming to get you started in this lesson,
but know that there is a lot more to explore
if you have the time to do so.
Anyways, let's jump in.
Let's quickly take a look at some of the solutions
that are available to help you monitor
and secure your hybrid workloads.
And this will probably be some light provision,
but I want to briefly cover this off
before we dive into how you can configure these services
for hybrid workloads.
Firstly, we have the monitoring agent.
It's a piece of software that you deploy to your service
either in Azure or on premises
and this is usually done via extension
on the VM or the Azure Arc-connected machine.
And then you have the Log Analytics workspace
which is responsible for storing all
of your logs and metrics.
An Azure monitor is used to present and alert on your logs
and metrics that are stored in the Log Analytics workspace.
And Azure Sentinel is also dependent
on your Log Analytics workspace
and provides threat intelligence,
detection, and investigation.
And finally, Microsoft Defender for Cloud
is a suite of products that provides additional security
for your workloads.
What we are most interested for the AZ-800 exam
is the Microsoft Defender for service product
that is part of Microsoft Defender for Cloud
and that provides advanced security protection
for your server and virtual machines.
Now the purpose of Microsoft Defender and Sentinel
might sound similar, but they're very different.
If you wanted to get an idea
of fundamentally how they are different,
Microsoft Defender is primarily proactive,
fixing security issues before they happen.
Where with Sentinel
is about making sure your security problems
don't become much bigger problems.
Now let's take a look at how these services tie together
and provide comprehensive monitoring and security
for your Window Servers.
When you connect your on-premises VMs to Azure Arc,
your on-premises VMs
get an Azure Resource Manager,
resource identity in Azure.
Using this resource identity,
you can install virtual machine extensions
via Azure Arc to take advantage of other Azure services.
Let's take a look at this at a high level.
Let's say you have some VMs
and some Azure Arc-enabled servers.
You'll likely want to start
with installing a monitoring agent.
And this can be either the Log Analytics agent
or the Azure monitor agent.
For some functionality,
you might need to install the Log Analytics agent,
but Microsoft is moving to the newer Azure monitor agent.
And I'll include a link on this lesson
so you can take a look at the monitoring agents available
and choose the one that meets your requirements.
Once you have a monitoring agent installed,
you can configure it
to collect information from your server
and this includes metrics like CPU performance
and logs like application and security logs.
And then send those metrics and logs
to a Log Analytics workspace.
And the Log Analytics workspace
is a repository for your monitoring data.
Once you have your service connected
to the Log Analytics workspace,
you can start to enable
additional monitoring and security features.
The first of these is Azure Monitor.
Azure Monitor allows you to view metrics and logs
and create alerts
and even automatically respond to those alerts.
And you can also link Microsoft Sentinel
to your Log Analytics workspace
to get additional security functionality.
Microsoft Sentinel provides threat analytics
and intelligence.
And finally, you can enable Microsoft Defender for Cloud
which provides advanced security capabilities
like security policy and compliance,
vulnerability scanning, and advanced threat protection.
All right, let's take a look at a demo
of Monitoring and Securing Windows Server Hybrid Workloads.
In this demo, we will use our Azure Arc connected machine
that we connected in the previous lesson.
We'll start by deploying a Log Analytics workspace
and we'll use that Log Analytics workspace
to store our monitoring data, including metrics and logs.
And we will install the Log Analytics agent
using an extension
and there are quite a few ways to do this,
but we'll do it manually so you can take a look
at the relationship between the Azure Arc connected machine
and the Log Analytics workspace.
And this will connect our Azure Arc connected machine
to the Log Analytics workspace
and from there, we'll head over to Azure Monitor
to enable the VM insight solution.
Insights are a capability of Azure monitor
that provides guided monitoring
and troubleshooting experiences,
which are a good starting point
when you're configuring monitoring
for a new resource for the first time.
And then finally, we'll use Microsoft Defender for Cloud
to enable advanced threat protection
for our virtual machine.
Let's take a look at the demo.
All right, so here we are on the Azure portal.
Let's go ahead and create our Log Analytics workspace
that will be used to store our metrics data and our logs.
To do that, we'll start
by searching for Log Analytics workspace
and we'll select Log Analytics workspaces.
And then we'll go ahead and click Create.
And we need to provide a resource group
for our Log Analytics workspace.
I've already created a resource group
so I'm going to go ahead and select that.
And now we need to provide a name
for our Log Analytics workspace.
So I'm just going to call it law-australiaeast
and then I'm going to go ahead
and set the region to Australia East,
and then we can go ahead and click Review and Create.
And then we can go ahead and click Create.
And this will just take a moment to create.
So we'll come back when this is done.
All right, that Log Analytics workspace has been deployed.
Let's go and take a look.
So we'll select Go to Resource.
Now there's some information we need to collect
from this Log Analytics workspace
so that we can install the Log Analytics agent
on our Azure Arc connected machine.
And the information we need to gather
is under settings and then agents management.
And we need to grab the workspace ID and the primary key.
So I'm going to go ahead and collect that information.
All right, I've got that information collected.
Then let's navigate over to Azure Arc
and we'll use the extensions
to install the Log Analytics workspace
on our Azure Arc connected machine.
So let's go ahead and search for Azure Arc,
and then we'll navigate into Servers under Infrastructure,
and then we'll navigate into our connected machine.
We'll just collapse this left pane
and then we'll navigate into Extensions.
And now we can go ahead and click Add.
And we want to install the Log Analytics agent,
so we'll go ahead and select that and then click Next.
And then we can go ahead and provide that workspace ID
and workspace key that we collected earlier.
And then we can go ahead and select Review and Create.
And then we can go ahead and select Create.
Now this will just take a moment
to deploy to our virtual machine.
So we'll come back when this is done.
All right, the installation is now complete.
Let's navigate back to our Azure Arc connected machine
and take a look.
So we'll navigate home
and then we'll navigate into Azure Arc.
We'll navigate into Servers again
and then we'll navigate into our connected machine.
Collapse this left-hand menu,
and then we'll select Extensions.
Now Microsoft really likes to confuse us
with the naming of these monitoring agents.
It says the name here is Microsoft Monitoring Agent.
For our purposes, that's the Log Analytics agent.
All right, with that agent now deployed,
let's take a look at enabling VM insights
using Azure Monitor.
Now I just want to show you that you can actually
enable VM insights under the monitoring section
of this Azure Arc connected machine.
But we're going to go ahead and do this from Azure Monitor.
So let's navigate over to Azure Monitor.
And then under Insights, we'll select Virtual Machines.
And then we'll go ahead and select the Not Monitored tab.
And then we'll enable VM insights
on our Arc virtual machine.
Then we can go ahead and select Enable.
Now this will just take a moment to deploy.
So we'll come back when this is done
and I'll give it a little bit of extra time as well
so we can start collecting some monitoring data
from our virtual machine.
So I'll be back in just a moment.
All right, the installation of VM insights is now complete.
Let's navigate back to our Arc VM
and take a look at the VM insights for that VM.
So we'll navigate back home.
Then we'll navigate into ArcVM1.
And then under monitoring, we'll navigate to Insights.
And by default, it's loaded up to the map tab here.
We don't have any network traffic
to and from this VM as yet,
but when we do, we'd start to get an idea
of where this VM is communicating with on our network.
But for now, let's take a look at the performance tab.
And we can see here, we're starting
to collect some really good performance information
from our virtual machine,
including CPU utilization,
available memory, disk performance, and network performance.
All right, now let's take a look
at Microsoft Defender for Cloud.
We'll go ahead and search for Microsoft Defender for Cloud
and we'll go ahead and select that.
And then we'll go ahead and select getting started.
And then let's go ahead
and enable Microsoft Defender for Cloud
for our Log Analytics workspace.
So we'll select our Log Analytics workspace,
and we'll scroll all the way
down to the bottom and click Upgrade.
Now we've already installed the agent
on our virtual machine.
So I'm going to continue without installing agents.
Now I'm going to click on Assessed Resources.
Now I'm going to click Add Non-Azure Server,
and then click Upgrade on our Log Analytics workspace.
Now we can go ahead and click Add Servers.
And we can see here, we already have one of our servers
connected to this Log Analytics workspace,
which is that Azure Arc VM that we've already configured.
All right, Microsoft Defender for Cloud
is now configured for this Arc VM.
That wraps up this demo.
Let's go and take a look
at what we're covered in this lesson.
All right, so what have we covered?
You can enable additional Azure functionality
by installing extensions on Azure Arc connected machines.
And you can collect metrics and logs
in a Log Analytics workspace
by deploying a monitoring agent,
such as the Log Analytics agent
or the Azure monitor agent.
And you can use the Azure Monitor insights feature
to get guided monitoring and troubleshooting experiences
for your resources.
And Microsoft Defender for servers,
which is part of Microsoft Defender for Cloud,
provides advanced security protection for your servers.
And finally, Azure Sentinel can be linked
to a Log Analytics workspace
to provide threat intelligence,
detection, and investigation.
All right, thanks for being with me in this lesson.
I hope you found it useful
and I look forward to seeing you in the next lesson.