Microsoft Defender for Cloud. Microsoft Defender for Cloud, again,
there's a theme, hybrid cloud/multi‑cloud AI‑backed cloud‑hosted security
posture management solution. That's quite a mouthful. Under the hood, this
product began as Azure Security Center, which was essentially a recommendation
engine. That still exists even now with the rebrand. You get a secure score for
your environment that you've onboarded into Defender for Cloud, and this is an
arbitrary number where higher values denote a better security posture. And as
you take action on the security recommendations that Defender for Cloud gives
you, that improves your secure score.
The idea is that it's going to give everybody on your team, not
only dedicated InfoSec professionals, a way to view the overall
security posture of your environment to use Microsoft‑provided
proven practices to improve the security posture of your
environment. And just go from there.
You'll find that Defender for Cloud integrates tightly with Azure
Policy, and Azure Policy integrates tightly with many of the
world's compliance and legal frameworks,
so you'll find that by leveraging Azure Policy
within Microsoft Defender for Cloud,
it can go a long way to help your compliance with whatever
regulatory or legislative or industry‑specific certifications
your business has to attest to.
There is also an automated security alert system.
It's not as robust as Sentinel, but it's not
intended to be. Defender, as I said,
is more of a general‑purpose security hygiene tool set. Sentinel
is for dedicated full‑time InfoSec analysis.
I created this diagram as a way to depict the overlap between Microsoft Defender
for Cloud on one side and Microsoft Sentinel on the other.
We could look at it that Microsoft Defender for Cloud covers
data collection, remediation, and detection,
but not so much the automated response.
Although, technically, if I were to refactor this diagram,
I might want to bring respond in because you can do
playbooks in Microsoft Defender for Cloud,
but you don't get the full KQL, Kusto Query Language, threat
hunting that you do with Microsoft Sentinel.
See, Sentinel could really be looked at as a superset
of Microsoft Defender for Cloud.
As a matter of fact,
guess what one of the connectors is for Microsoft
Sentinel. It's Defender for Cloud.
So, again,
that idea is you can take all of the general‑purpose security
recommendations from MDC, surface those, and take action on them
centrally within Microsoft Sentinel.
This would be particularly useful for businesses who have multiple Azure AD
tenants with associated subscriptions because those environments are going to have separate instances of Microsoft defender for cloud