When you navigate to Microsoft Defender for Cloud,
you will be taken to the Overview page.
Within the Overview page, under Metrics,
you can view how many subscriptions are currently
protected by Microsoft Defender for Cloud.
In my case, this is just one subscription.
It'll also tell you how many resources have been assessed,
how many active recommendations you have,
and the number of security alerts.
Now each of these fields are interactive.
This means that you can actually click on it and it'll
take you to the relevant component.
As we navigate down, you'll see the use of interactive cards.
These cards provide you with an overview of the various
modules within Defender for Cloud.
For example, we've got our Security posture,
our Regulatory compliance, Workload protections,
we have Firewall Manager.
We then have an Inventory and Information protection.
Now all of these cards are all interactive,
so I can click on them to actually navigate to a specific component.
On the right‑hand side, we have some quick view information.
This will provide us with various options,
for example,
upgrading our current details about any type of new workbooks and
the most prevalent recommendations by resource.
So what exactly does each of these components do?
Well, let's focus on the first one, Security posture.
Security posture is where Defender for Cloud will continually assess all of
your resources within your subscription for security issues.
It'll also go ahead and assess your resources that exist in other clouds.
Regulatory compliance will give you insight into your compliance posture.
This is based on assessments from industry standards such as NIST,
the Azure Security Benchmark, and more,
and it'll map those standards and compliance regulations to your
data that you currently have within Azure.
Workload protection, this is a cloud workload protection platform.
It is integrated with Defender for Cloud,
and it provides intelligent protection of your workloads that run on Azure,
your on‑premise machines, and other cloud providers.
As you can see,
it'll show you alerts based on severity in relation to the
resources that it is currently protecting.
Firewall Manager will show you the status of your networks and
different hubs that you may have within your Azure network.
The Inventory tile provides you with an asset inventory page for
viewing your security posture across all of your assets.
And finally, Information protection,
which is essentially a graph that will show you the resource types
that have been scanned by Microsoft Purview.
Microsoft Purview scans your data for any data that contains sensitive data,
and it'll provide you with various recommendations
and alerts for that type of data.
So let's work through the general section of Microsoft Defender for Cloud.
On the Getting started page, this essentially will get you started.
I am using a paid subscription,
so you generally would have the option to try Microsoft Defender for
Cloud or upgrade to an actual paid subscription.
In the Getting started section,
you'll see that you can configure multi‑cloud environments and you can
use the Log Analytics agent to extend Microsoft Defender for Cloud onto
servers that are running outside of Azure.
This is similar to what we have seen in an earlier video based on Azure Arc.
In the Install agents section,
this is where you can enable the ability for agents
to be installed automatically.
Now in my subscription I have already enabled it.
This means that any new virtual machine that I spun up will
automatically get the agent installed,
allowing that machine to communicate with Microsoft Defender for Cloud.
Now as I navigate to Recommendations,
this is where you will see all of the recommendations that
currently exist within Defender for Cloud.
You have the ability to download these as a report,
perform a query, and you have the option to filter your recommendations.
When you look at Secure score recommendations,
these will give you all of the recommendations that will
help reduce your security exposure,
ultimately increasing your security score, and this Secure score
recommendation can also be filtered for Azure,
AWS, and Google Cloud.
Now if you have to click on All recommendations,
this is going to give you all of your recommendations,
irrespective if they address your secure score or not.
So I'm going to go back and switch to Secure score recommendations.
Now within the Recommendations,
you have the ability to explore the recommendation along with the
score that it currently carries and the potential score increase
should you mitigate the finding.
You can also see the status of the recommendation,
along with the unhealthy resources and an insight graph.
So, for example, if I had to expand the Apply system updates,
this will give me two recommendations,
the first one being that I should install the Log
Analytics agent on my virtual machines.
I can see that this is currently unassigned and that one out of my
two virtual machines are currently unhealthy.
If I had to click on this, this would take me to the actual recommendation,
allowing me to see the severity of the recommendation,
the data freshness, it'll give me a description of why I should leverage this,
and then the related recommendations.
The recommendations are also split,
which will show you if there is a dependency and the affected resource.
Under Remediation steps,
I've got an option to perform a Quick fix or I can perform a Manual
remediation and it'll give me a link for the instructions that I
would need to follow should I wish to perform a manual
recommendation. And underneath that I've got my Affected resource, so
let's go ahead and perform a fix.
So I'm going to select my Affected resource,
which is my mem3 server, and now I can either fix it,
trigger a logic application, exempt it or assign an owner.
So I'm going to go ahead and click on Fix.
I would now need to select my Workspace ID,
since this is related to Log Analytics, and I will click on Fix.
So as the fix goes ahead,
the Log Analytics agent will actually get installed on my virtual
machine and the configuration will be done,
allowing it to talk to the workspace that I've just defined.
So as you can see, within security recommendations,
this really gives you an easy view as to where your security
posture lies and what you really need to action,
and of course, giving you the ability to perform a quick fix,
allowing Azure to actually fix it for you and giving you the
instructions if you wanted to fix it yourself.
Now let's move to Security alerts.
Within Security alerts,
Microsoft Defender for Cloud would generate alerts for
resources that you have deployed within Azure on‑premise
and any hybrid cloud environments.
These alerts are generated when Microsoft Defender for Cloud
detects any type of threats on your resources.
It'll also go ahead and prioritize the list of alerts and
provide you with information needed so that you can
quickly investigate the problem.
Now I've gone ahead and actually enabled Sample alerts.
This is just so that I could show you the type of alerts and how
the alerts look within Defender for Cloud.
So let's take a look at a Sample alert.
I'll look at the first one, which is related to
WordPress. We can see the Severity, the Alert title,
the Affected resource, the Resource group,
the time, and it gets mapped to a MITRE ATT&CK tactic. And then we
can, of course, see the Status of the alert.
So the first one which relates to WordPress is not mapped to a MITRE ATT&CK
tactic, so maybe let's take a look at the second one, which is Phishing on
an Azure Web App. So as I click on the alert,
you'll see this kind of looks a little bit like Sentinel.
So we've seen the alert showing up, it gives us details about the alert,
the Severity, the Status, and as I scroll down,
I can see the MITRE ATT&CK tactic, and then I've got options to
view the full details or take action. When I click on Take action,
it will provide me with all of the steps that I need to do in order
to take action. Clicking on Alert details would show me information
about the alert.
And, of course, because this is a sample alert,
there is not much information here,
but essentially we can see the URL that's been flagged by this alert.
All right, so looking at the alerts,
you get the picture that you can leverage Microsoft
Defender for Cloud to quickly explore what alerts are
active and take action on those alerts.
Now as I navigate to Inventory,
this is where we will see a list of all of my inventory currently within
Azure. It'll also show me details about servers that are onboarded via
Azure Arc, and this of course is all interactive,
meaning that I can actually click on it and work with the actual resource by
looking at the recommendations, any alerts that may have been flagged, along
with installed applications. And the process to work with the alerts is the
same as what we've seen earlier, whereby I can simply click on the alert,
which will take me to the details about the alert, and I have
the ability to perform a fix on the alert.
In this example, the alert relates to a vulnerability assessment,
so I'm going to go ahead and proceed to fix this by
leveraging Microsoft Defender for Endpoint.
So the other two options that we have is Workbooks and Community. Workbooks
essentially gives you the flexibility to create your own workbook or
leverage workbooks that are already in existence.
For example, I can leverage some type of public templates,
I can create my own templates, and I can view all of my current
workbooks. Looking at what a workbook actually looks like,
essentially it's an Azure workbook that allows me to view
details really quickly and work with the data the way I
would like it to be visualized.
For example,
this workbook looks at Active Alerts, and it gives
you information about the alerts,
the top attacked resources, and so forth. On the Community side,
essentially this is a link to the Microsoft Defender
community. Here you will have various links that can take
you to different types of blog posts,
videos, and extended learnings, and some additional community stuff that
exists on GitHub. So this concludes the overview of Microsoft Defender for
Cloud where we've actually worked with Defender for Cloud in exploring some
of the recommendations and security alerts.
Now this does not only focus on Windows Server,
but it gives you the ability to leverage Defender for Cloud across your entire Azure estate.