[Autogenerated] now we're going to come back to the automation account
but let's jump over to defender for cloud because I wanted to briefly
demo the Microsoft defender for servers.
Now this is a pretty robust platform.
We've discussed it a bit in this learning path so far.
The bottom line is if you go to getting started you can enable the
Microsoft defender features in your subscription.
Ala, carte.
And as you can see, I've turned on Microsoft defender for servers here,
it's going to be a fixed cost per server per month.
And this then will surface recommendations for our servers,
our Ark servers and our native Azure servers.
Speaking of which,
let's come back over to secure score and let's take a
look at some of those recommendations.
Let's come into my subscription and we can see for instance under
the remediate vulnerabilities capability machines should have a
vulnerability assessment solution.
Now, I had mentioned that when you turn on Microsoft defender for servers,
you get an integrated license for Microsoft defender,
the vulnerability scanner.
So it looks like I've got five machines that do have the Microsoft threat and
vulnerability management software or agent already installed.
And here we have our arc machine as well as our native Windows machines.
But I can fix this problem with cli one.
Now notice it says fix in many cases,
Microsoft defender for cloud is able to remediate literally its own
automatic way but there are some remediation is that are more
complicated that you need to spearhead and what you've got there is
integration with the logic app platform.
A logic app is a member of the Azure app services family that allows you
to stitch together various rest api or application programming
interfaces to perform business process automation.
So in this case if this were a more complex solution,
maybe where you wanted to install a third party vulnerability assessment
solution that needed notification and more robust management,
you can code that in your logic app and code is kind of a play on words
because one of the benefits of the logic app is that there's a graphical
designer where you can simply sign into these different SAS services and
then stitch together your process workflow without having to know a
programming language.
That's actually one of the benefits of the logic app but that's an
exam alert only inasmuch as on your a c 800 exam,
if it talks about a way to create a more complex
remediation and Microsoft defender for cloud er,
Azure sentinel,
the correct answer would be triggering or creating a logic app and then
scheduling your fix to trigger that logic app makes sense.
Alright,
that's really mainly what I wanted to cover here in
Microsoft defender for server.
The fact that you wind up with that integrated license for the
vulnerability scanner and you can take advantage of the
results of those vulnerability scans.
If we go under workload protections for example,
we can number one scroll down to the bottom and check out
our VM vulnerability assessment results and again it looks
like I still have some machines,
one arc machine and perhaps the remediation hasn't gone through
on cli one yet to bring those guys into scope.
But then more importantly,
we can see the fruits of the vulnerability scanning up here,
right on the alerts list,
where I've got a bunch of suspicious authentication activity
entries here for various machines and if you click in there
you can view the full details, see the effective resource.
Let me click view full details and in this case it shows me
the attacker's IP address looks like they're trying to do
rdP sessions to this machine, trying different user name.
So this is definitely one of the hazards of having a public
IP address on an Azure virtual machine.
I can essentially guarantee you'll see this kind of problem.
A nice thing about Microsoft defender for cloud and for servers
is that you can wind up tracking incidents that is collections of
these individual security alerts.
Although really that notion of the collection of the incident
has really been offloaded into Azure sentinel.
It used to be completely a part of what was called Azure security center, but that's no longer the case