Become an Azure Security Center Ninja

[Yuri Diogenes]

[Last update: 01/20/2020]

This blog post has a curation of many Azure Security Center (ASC)/Azure Defender resources, organized in a format that can help you to go from absolutely no knowledge in ASC, to design and implement different scenarios. You can use this blog post as a training roadmap to learn more about Azure Security Center.

Modules

To become an ASC Ninja, you will need to complete each module. The content of each module will vary, refer to the legend to understand the type of content before clicking in the topic’s hyperlink. The table below summarizes the content of each module:

Module	Description
1 – Introducing Azure Security Center and Azure Defender	In this module you will familiarize yourself with ASC and understand the use case scenarios. You will also learn about ASC and Azure Defender pricing and overall architecture data flow.
2 – Planning Azure Security Center	In this module you will learn the main considerations to correctly plan Azure Security Center deployment. From supported platforms to best practices implementation.
3 – Enhance your Cloud Security Posture using Secure Score	In this module you will learn how to leverage Secure Score to continuous improvement of your cloud security posture. This module includes automation samples that can be used to facilitate secure score adoption and operations.
4 – Cloud Security Posture Management Capabilities in ASC	In this module you will learn how to use the cloud security posture management capabilities available in ASC, which includes vulnerability assessment, inventory, workflow automation and custom dashboards with workbooks.
5 – Regulatory Compliance Capabilities in ASC	In this module you will learn about the regulatory compliance dashboard in ASC and give you insights on how to include additional standards. In this module you will also familiarize yourself with Azure Blueprints for regulatory standards.
6 – Cloud Workload Protection Platform Capabilities in Azure Defender	In this module you will learn how the advanced cloud capabilities in Azure Defender work, which includes JIT, File Integrity Monitoring and Adaptive Application Control.  This module also covers how threat protection works in Azure Defender, the different categories of detections, and how to simulate alerts.
7 – Streaming Alerts and Recommendations to a SIEM Solution	In this module you will learn how to use native ASC capabilities to stream recommendations and alerts to different platforms. You will also learn more about Azure Sentinel native connectivity with ASC. Lastly, you will learn how to leverage Graph Security API to stream alerts from ASC to Splunk.
8 – Integrations and APIs	In this module you will learn about the different integration capabilities in ASC, how to connect Tenable to ASC, and how other supported solutions can be integrated with ASC.

Legend

Product videos	Webcast recordings	Tech Community
Docs on Microsoft	Blogs on Microsoft	GitHub
External	Interactive guides

Module 1 - Introducing Azure Security Center and Azure Defender

•  What is Azure Security Center
•  What is Azure Defender
•  Introduction to Azure Defender
•  Securing the hybrid cloud with Azure Security Center
•  Hybrid security management across your data center
•  Understanding ASC and Azure Defender Pricing
•  Azure Security Center Data Flow

Module 2 – Planning Azure Security Center

•  Supported Platforms
•  Features for IaaS workloads
•  Features for PaaS workloads
•  Built-in RBAC Roles in ASC
•  Assigning Permissions in Azure Security Center
•  Design Considerations for Log Analytics Workspace
•  Azure Security Center Monitoring Agent Deployment Options
•  Onboarding on-premises machines using Windows Admin Center
•  Understanding Security Policies in ASC
•  Built-in Policies in ASC
•  Creating Custom Policies
•  Configuring Security Center Resource Type Pricing with Azure Policy
•  Managing Security Center at scale using ARM templates and Azure Policy
•  Centralized Policy Management in Azure Security Center using Management Groups
•  Planning Data Collection for IaaS VMs
•  Considerations for Multi-Tenant Scenario
•  Best Practices for Log Analytics Workspace when using ASC and Azure Sentinel
•  How to Effectively Perform an Azure Security Center PoC
•  Grant tenant-wide permissions to yourself

Module 3 – Enhance your Cloud Security Posture using Secure Score

•  Overview of Secure Score in ASC
•  How to calculate your secure score
•  Secure Score Capabilities
•  How Secure Score affects your governance
•  Enhance your Secure Score in ASC
•  Security recommendations
•  Creating Exemptions and Enforcing Policies
•  Resource exemption
•  Customizing Endpoint Protection Recommendation in Azure Security Center
•  How to keep track of Resource Exemptions in Azure Security Center
•  Survival Guide to Drive your Secure Score Up
•  Deliver a Security Score weekly briefing
•  Send ASC Recommendations to Azure Resource Stakeholders
•  Secure Score Over Time Reports
•  Secure Score Reduction Alert
•  Automation Artifacts for Secure Score Recommendations
•  Remediation Scripts
•  Security Controls in Azure Security Center
  •  Enable MFA
  •  Restrict Unauthorized Network Access
  •  Secure Management Ports
  •  Apply adaptive application control
  •  Remediate Security Configurations

Module 4 – Cloud Security Posture Management Capabilities in ASC

•  Overview of the Asset Inventory feature in ASC
•  Managing Asset Inventory in ASC
•  Overview of Vulnerability Assessment in ASC
•  Vulnerability Assessment Deployment Options
•  Vulnerability Assessment Workbook Template
•  Vulnerability Assessment for Containers
•  Exporting Azure Container Registry Vulnerability Assessment in Azure Security Center
•  Implementing Workflow Automation
•  Workflow Automation Artifacts
•  Creating Custom Dashboard for ASC
•  Using Azure Security Center API for Workflow Automation
•  Understanding Network Map
•  Using Adaptive Network Hardening
•  Identify security vulnerabilities workloads managed by ASC
•  Multi Cloud support in Azure Security Center
•  Connect AWS Account with Azure Security Center
•  Connect GCP Account with Azure Security Center
•  Protection for multi cloud workloads

Module 5 – Regulatory Compliance Capabilities in ASC

•  Regulatory compliance dashboard
•  Understanding Regulatory Compliance Capabilities in ASC
•  Regulatory Compliance dashboard and security benchmark
•  Adding new regulatory compliance standards
•  Blueprint samples for regulatory compliance standards
•  Regulatory Compliance workbook

Module 6 – Cloud Workload Protection Platform Capabilities in Azure Defender

•  Understanding Just-in-Time VM Access
•  Reducing the Attack Surface with Just-In-Time VM Access
•  Implementing JIT VM Access
•  Automate JIT VM Access Deployment with PowerShell
•  File Integrity Monitoring in Azure Defender
•  Define known-safe applications using Adaptive Application Control
•  Understanding Threat Protection in Azure Defender
•  Azure Defender for Servers
•  Azure Defender for AKS
•  Azure Defender for Containers
•  Azure Defender for Storage
•  Azure Defender for SQL
•  Azure Defender for SQL Anywhere
•  Azure Defender for KeyVault
•  Azure Defender for AppService
•  Azure Defender for IoT
•  Understanding Security Incident
•  Overview of Security Alerts in ASC
•  Alert Reference Guide
•  Alert Suppression
• Simulating Alerts in Azure Defender
  •  Alert validation
  •  Simulating alerts for Windows
  •  Simulating alerts for Linux
  •  Simulating alerts for Containers
  •  Simulating alerts for Storage
  •  Simulating alerts for Azure Key Vault
•  Integration with Microsoft Defender for Endpoint
•  Resolve security threats with ASC
•  Protect your servers and VMs from brute-force and malware attacks with ASC
•  Investigating Azure Security Center alerts using Azure Sentinel
•  Service Layer Protection - Azure Defender for Resource Manager and DNS [01/21 Update]

Module 7 – Streaming Alerts and Recommendations to a SIEM Solution

•  Continuous Export capability in ASC
•  Deploying Continuous Export using Azure Policy
•  How Azure Sentinel and Azure Security Center Work Together
•  Connecting Azure Sentinel with ASC
• Closing an Incident in Azure Sentinel and Dismissing an Alert in Azure Security Center
• Accessing Azure Security Center Alerts in Splunk using Graph Security API Integration

Module 8 – Integrations and APIs

•  Integration with Tenable
•  Integrate security solutions in ASC
•  REST APIs for ASC
•  Obtaining Secure Score via REST API
•  Using Graph Security API to Query Alerts in ASC

Other Resources

• Azure Security Center Labs [01/21 Update]
• Become an Azure Sentinel Ninja
• Become an MDATP Ninja
• Cross-product lab (Defend the Flag)

Have a great time ramping up in Azure Security Center and becoming an ASC Ninja!! 

Reviewers:

• Nicholas DiCola. Principal PM Manager
• Rebecca Halla, Senior PM Manager
• Tom Janetscheck, Senior PM

[knsw7]

fantastic content - Thanks. Is there a plan to make a full fledged MS Learn in-depth course on ASC and Sentinel. ASC there is a level 200, but no course yet on Sentinel.

[James van den Berg]

Awesome blogpost @Yuri Diogenes with great Content 

Just Shared it with Education in Amsterdam for Teachers and Students 

Cheers James

[Yuri Diogenes]

Thanks @knsw7 - I'm glad you liked it. For cross-product lab, please try https://github.com/microsoft/DefendTheFlag/

[Yuri Diogenes]

Thanks @James van den Berg - that's great! 

[Katie Anderson]

Great to see this, Yuri!

[OzymandiasTron]

Great blogpost. I will definitive recommend this for everyone interested in ASC. 

[Philip Torner]

Great stuff, just posted this internally for all our Security Champions

[Tara_Larson]

Thank you Yuri- Have posted to the MW & S&C TSs 

[prakashjha]

Thanks! This looks great. I am hoping it will help me in my journey to a Az-500 certification.

[leourbano]

Excellent content. Thanks for share.

[Terry Patterson]

Keep up the GREAT team and community work. We have really have benefited from these well curated and very instructive videos and guidance. As a Microsoft Partner we are able to educate our team, plan and implement security services on Azure and Office 365 for our clients with confidence. ASC is our best buddy along with Sentinel, Cloud APP Security, ARC, ATP and Defender. So many security tools all rolled up into one dashboard makes our job so much easier.

Also not to forget the compliance center and Azure blue prints. We are working with clients in Healthcare, Financial and California regulatory systems and security is just a one-click away. Very much enjoying ARC and ability to patch, monitor and isolate. And then finally adding Azure Lighthouse and Endpoint Manager to rollup clients and implement extensive device controls making a zero-trust security posture possible from a central management portal at scale.

Loving Azure and Office integrated Security.

Best, Managed Connections, trusted Microsoft partner!

[Frank Falvey]

Thanks for sharing this blogpost @Yuri Diogenes

[PBradz]

This is a truly great help for anyone looking to learn ASC, thanks for putting it together @Yuri Diogenes 

I will certainly be sharing this with more than a few people.

[Dean Gross]

@Yuri Diogenes thanks for pulling this together, lots of great info all in one place makes it much easier for us to stay informed.  I did notice that the Best practices posting at https://techcommunity.microsoft.com/t5/azure-sentinel/best-practices-for-designing-an-azure-sentinel... has a lot of questions that have not been answered by the author. Could you please have someone take a look and provide some answers. thanks

[Sasha - Sasa Kranjac]

Awesome resource @Yuri Diogenes and the team @Nicholas DiCola (SECURITY JEDI) , @RebeccaHalla , @Tom Janetscheck !

Thanks!

Sasha

[Yuri Diogenes]

@Tiander Turpijn please see @Dean Gross comment.